Re: I-D Action: draft-smith-6man-in-flight-eh-insertion-harmful-00.txt

Hi Brian,

On Sun, 13 Oct 2019 at 09:15, Brian E Carpenter
<brian.e.carpenter@gmail.com> wrote:
>
> Hi Mark,
>
> As you have no doubt seen, the active proposal for EH insertion (draft-voyer-) states that the source and destination addresses of packets subject to insertion both lie within a controlled domain.
> Now while draft-carpenter-limited-domains calls for secure mechansims for determining whether a node is inside or on the border of a domain, it seems to me that address scope (and therefore routing scope) is today the state of the art for that. Of course you're correct that configured scope is subject to human error, but that already has very serious consequences, especially BGP misconfigurations. I think that draft-voyer-6man-extension-header-insertion-07 (not the earlier versions) is resistant to your arguments. It certainly does not describe the use case you give at https://tools.ietf.org/html/draft-smith-6man-in-flight-eh-insertion-harmful-00#section-3 .
>
> EH insertion for packets that traverse the open Internet is certainly harmful and violates RFC 8200. draft-voyer-6man-extension-header-insertion-07 does not propose that.

Yes, they've mitigated leaking by enclosing in a tunnelling header
with local network addresses. However, that's now being used to ignore
problems with EH insertion when used with an outer IPv6 tunnel packet.
The processing of the IPv6 tunnel packet is now not compliant with RFC
8200. The Source Address field is a lie after the first mid-tunnel SRH
insertion.

Many of the the problems in the EH insertion considered harmful draft
occur whether or not the IPv6 packet happens to have a payload that is
also another IPv6 packet.

Regards,
Mark.

>
> Regards
>    Brian Carpenter
>
> On 09-Oct-19 18:30, internet-drafts@ietf.org wrote:
> >
> > A New Internet-Draft is available from the on-line Internet-Drafts directories.
> >
> >
> >         Title           : In-Flight IPv6 Extension Header Insertion Considered Harmful
> >         Author          : Mark Smith
> >       Filename        : draft-smith-6man-in-flight-eh-insertion-harmful-00.txt
> >       Pages           : 10
> >       Date            : 2019-10-08
> >
> > Abstract:
> >    In the past few years, as well as currently, there have and are a
> >    number of proposals to insert IPv6 Extension Headers into existing
> >    IPv6 packets while in flight.  This contradicts explicit prohibition
> >    of this type of IPv6 packet proccessing in the IPv6 standard.  This
> >    memo describes the possible failures that can occur with EH
> >    insertion, the harm they can cause, and the existing model that is
> >    and should continue to be used to add new information to an existing
> >    IPv6 and other packets.
> >
> >
> > The IETF datatracker status page for this draft is:
> > https://datatracker.ietf.org/doc/draft-smith-6man-in-flight-eh-insertion-harmful/
> >
> > There are also htmlized versions available at:
> > https://tools.ietf.org/html/draft-smith-6man-in-flight-eh-insertion-harmful-00
> > https://datatracker.ietf.org/doc/html/draft-smith-6man-in-flight-eh-insertion-harmful-00
> >
> >
> > Please note that it may take a couple of minutes from the time of submission
> > until the htmlized version and diff are available at tools.ietf.org.
> >
> > Internet-Drafts are also available by anonymous FTP at:
> > ftp://ftp.ietf.org/internet-drafts/
> >
> > _______________________________________________
> > I-D-Announce mailing list
> > I-D-Announce@ietf.org
> > https://www.ietf.org/mailman/listinfo/i-d-announce
> > Internet-Draft directories: http://www.ietf.org/shadow.html
> > or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> >