[IPv6]draft-herbert-eh-inflight-removal-03

[Sebastian Moeller <[e-mail]>]

Here are my questions from reading this draft (prefixed [SM])...


Top level: Seems self-consistent and (potentially) useful, but will interfere with my interpretation of the end to end principle. This might still a pragmatic compromise to make EHs usable over the internet (and without usage nothing is going to improve in regards to EHs I guess).

Commenting on:
https://datatracker.ietf.org/doc/html/draft-herbert-eh-inflight-removal-03


Another drawback is information exposure.  If the network provides
  the addresses of egress routers to hosts then it is divulging network
  topology information that could be considered a security risk.


[SM] But isn't this already discoverable by playing TTL games a la traceroute?



Encapsulation is complex from a host implementation point of view.
  An IPinIP encapsulation adds at least forty bytes of overhead to the
  packet which reduces the effective MTU for the application and
  requires special end host processing that may be prohibitive on low
  end devices


[SM] Isn't the same true for removing EHs? Unless all paths using these use sufficiently larger MTU... or is the argument that the sender will already know since it is originating the extension headers?



 The secondary purpose for removing extension headers in-flight is to
  avoiding leaking information outside of a limited domain.


[SM] This feels a bit like a straw-man argument, if information leakage is considered problematic, don't use effectively 'in-band' signalling...



The packet does not contain an Authentication header.  If the
     packet contains and Authentication header then the Hop-by-Hop
     Options header MUST NOT be removed

[SM] Can the endpoints actually detect that condition? If no the MUST seems mostlty decorative, if yes why not have the enpoints take matters into their own hands instead of using hopes and prayers some other node will be handling this? I might have a naive interpretation of the meaning and utility of MUST...



Copying the IPv6 Header
  Extension header removal can be accomplished by performing a data
  copy of the IPv4 header (forty bytes) to the offset after the
  extension header being removed minus forty bytes.

[SM] The explicit IPv4 seems to be a typo, no?


Regards
	Sebastian