Re: Next steps on Extension Header Insertion

[Brian E Carpenter <[e-mail]>]

On 04/11/2016 02:11, Sander Steffann wrote:
> Hi,
> 
>> What you are saying is something like:
>>
>> "The IPv6 header fields described as immutable in RFC4302 MUST NOT be changed by the network. If within an administrative domain any of the immutable fields are changed, they MUST be restored on exit from the domain."
>>
>> Correct?
> 
> Yes, thank you for coming up with a good short bit of text. As RFC4302 defines the next-header field as immutable that would lock down the EH chain,

Yes but... I understand that AH is more or less deprecated by the security community.
So while it has correctly identified what needs to be immutable, I'm not sure it's
a sound basis for a general requirement (much as I agree with that requirement).

Also, when we tried to write text for the flow label about restoring it on exit
from a domain, we were pretty much told to go away and stop being silly.

    Brian

> 
>> Cheers,
>> Ole
>>
>> PS: As an operator would you be happy if I sent packets with NH=59, SA=:: with an integrity check covering all fields apart from the HLIM field, and everything else beyond the IPv6 header (40 bytes) was encrypted?
> 
> Hmmmmm. Interesting question. As a network operator I'd probably drop that packet because of BCP38. As a security engineer I would be scratching my head and wondering what was going on. But effectively the payload wouldn't be that different from ESP...
> 
> Cheers,
> Sander
> 
> 
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>