Re: SRH insertion vs SRH insertion + encapsulation

[Fernando Gont <[e-mail]>]

On 9/9/19 09:08, Ole Troan wrote:
> Hi Brian,
> 
[...]
>>>
>>> And I am pointing that out because of what feels like moral righteousness and hypocrisy to me, not because I think header insertion is a good idea or even doable. 
>>
>> I think the real question here is whether we want it to be possible *in principle* to verify that a packet has not been modified in transit, except for fields that are known to be mutable. NPTv6 is indeed a case where we consciously made this worse. ("NPTv6 involves modifying IP headers in transit, so it is not compatible with security mechanisms, such as the IPsec Authentication Header, that provide integrity protection for the IP header.") Addresses are not mutable as far as AH is concerned.
> 
> I am not quite sure if that's the real question. ;-)
> Something like header insertion could only possibly work in a limited domain, e.g. inserted on ingress, removed on egress.
> Thereby keeping the end to end transparency. Changing of the packet size breaks PMTUD.
> 
> AH is a neat lithmus test. At least in theory. And I think it should be kept for no other reason than that.
> I believe ILNP makes changes in only binding to the identifier not the locator.
> And as NAT has become such an integrated part of the Internet architecture you might argue if AH should bind to addresses at all, and that consideration applies to the transport protocols too of course.


I'm really curious what's the criteria with which you decide what's part
of the architecture, and what's not. For example, here you say that NATs
are part of the architecture. Not a long time ago you claimed on ietf@
that firewalls are not part of the architecture....


> 
>>
>> If we are willing to say that a feature is useable only within a domain where AH is not used, that seems OK, but only if the concepts of a domain, its membership, and its boundary nodes, are well defined. (To be clear, I don't think draft-voyer-6man-extension-header-insertion-06 is anywhere near explaining how a domain is defined and managed.) Or the IETF decides to declare AH dead. In any case, it's wider than a 6man decision.
> 
> Indeed. I think what we are talking about here is only possible within a limited domain.
> And no, I don't think draft-voyer is nearly done. I think we asked the authors to document the issues with header insertion and proposed mitigations or why those issues weren't applicable in the limited domain. I see only the PMTUD issue mentioned, and then without any mitigation.

THe first question is normally what problem you are trying to solve, and
why you can't solve it with what we already have.

It would seem to me that the "process" here is being *very biased*.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492