Re: IPv6 header insertion in a controlled domain

[[e-mail]]

Tom,

> IMO, even before we ask the of how to make header insertion work, we
> need to ask and get answers to the question why it's needed. That's
> why I created the thread on necessity (please comment on it). Until
> there is a clear justification for this mechanism, I personally don't
> see why the WGshould spend time trying to "make it work".

I started this thread to see if there was agreement that the mechanism _could_ be made to work in the most simple topology.
I don't think "why" is required to have that discussion.

>> In my simple example above.
>> Do you agree that in a controlled distributed system there is no perceivable difference between node A inserting the header or node B doing it?
>> Conceptually you could think of it as a tunnel with muliple endpoints (although that's a bit hard to visualize ;-)).
>> 
>> Can we agree that inserting headers and changing the packet size among participating nodes in a distributed system is not inherently unsafe?
> 
> Please see draft-smith-6man-in-flight-eh-insertion-harmful-01.
> Contrary to some interpretations of that draft, it is intended to be
> applicable to the whole Internet and not just saying that EH insertion
> is harmful on the "open Internet". For instance, loss of attribution
> and ICMP breakage will be problems in controlled domains. One might
> argue that those problems can be mitigated in such domains, however
> have worked in large operator networks I am skeptical that any
> mitigations will be sufficient.

Right, I would imagine those could be mitigated.
A tunnel head-end must implement an ICMP proxy anyway.

With regards to the open Internet, I think we know and agree that EH insertion cannot be made to "work" there.
(At least not for my definition of work).

Best regards,
Ole