Re: Dumb question about routing headers

Hello Ron,

Your example with 2nd dst being a multicast illustrates a very legitimate
use case for Quic protocol robust delivery or for that matter even TCP
across geo-diverse transit sites. Of course one's application needs to be
upgraded to support such arbitration but this is not a big issue.

What you call (D)DoS I would call real time data delivery resilience.

Thank you very much,
Robert.

On Mon, May 25, 2020 at 11:56 PM Ron Bonica <rbonica=
40juniper.net@dmarc.ietf.org> wrote:

> Mark,
>
> There might be a use-case for the following Routing header:
>
> - 1st destination: unicast
> - 2nd destination: unicast
> - final destination: multicast
>
> But the following Routing header might be used as a DoS attack against the
> final destination:
>
> - 1st destination: unicast
> - 2nd destination: multicast
> - final destination: unicast
>
> The source sends a single packet. The final destination receives one copy
> of that packet from each member of the multicast group.
>
>
>            Ron
>
>
>
> Juniper Business Use Only
>
> -----Original Message-----
> From: Mark Smith <markzzzsmith@gmail.com>
> Sent: Monday, May 25, 2020 5:42 PM
> To: Ron Bonica <rbonica@juniper.net>
> Cc: Brian E Carpenter <brian.e.carpenter@gmail.com>; 6man <ipv6@ietf.org>
> Subject: Re: Dumb question about routing headers
>
> [External Email. Be cautious of content]
>
>
> Hi Ron,
>
> On Mon, 25 May 2020 at 13:56, Ron Bonica <rbonica@juniper.net> wrote:
> >
> > Inline…..
> >
> >
> <snip>
> >
> >
> >
> > A related question is are multicast addresses within the list if hops to
> visit valid?
> >
> >
> >
> > [RB] There is no rule against this, but there certainly should be!
> >
> >
>
> While I can't think of a use for multicast addresses in a source route, I
> don't think we should prohibit it yet without more thought.
> The multicast source address RPF check during multicast forwarding
> prevents multicast packets being sent back towards where they came from, so
> I don't think a forwarding loop using multicast addresses can be formed,
> even if specified in the routing header.
>
> If source address RPF checks were also universally performed for unicast
> packets at each forwarding point then I don't think the RFC
> 5095 attack could have occurred either, because the attack involves
> creating a path where packets are sent back towards where they came from,
> creating the forwarding loop.
>
> Regards,
> Mark.
>
>
> <snip>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>