RE: I-D Action: draft-ietf-6man-ipv6-alt-mark-07.txt

Hi Stewart,
Yes, my intention is to specify that, if it is needed to apply the Alternate Marking outside a controlled domain (e.g. e2e service monitoring) authentication MUST necessarily be used.
Regards,

Giuseppe

From: Stewart Bryant <stewart.bryant@gmail.com>
Sent: Thursday, July 22, 2021 4:43 PM
To: Giuseppe Fioccola <giuseppe.fioccola@huawei.com>
Cc: Stewart Bryant <stewart.bryant@gmail.com>; Erik Kline <ek.ietf@gmail.com>; Christopher Wood <caw@heapingbits.net>; Yoshifumi Nishida <nsd.ietf@gmail.com>; 6man@ietf.org; draft-ietf-6man-ipv6-alt-mark.all@ietf.org
Subject: Re: I-D Action: draft-ietf-6man-ipv6-alt-mark-07.txt

HI,

Later in the text in section 6 (security) it says

As stated above, the precondition for the application of the

   Alternate Marking is that it MUST be applied in specific controlled

   domains, thus confining the potential attack vectors within the

   network domain.

If section 2 text is weaked, it both contradicts and weakens the security assumptions.

I suppose you could say that authentication MUST be used if the protocol is deployed outside a controlled domain, but I don’t think you can let it run in the wild as is.

- Stewart

On 22 Jul 2021, at 15:08, Giuseppe Fioccola <giuseppe.fioccola@huawei.com<mailto:giuseppe.fioccola@huawei.com>> wrote:

Hi Erik,
Thanks for the input.
I tend to agree that the condition “MUST” can be changed to “SHOULD”. I can address your comments in the -08 version.

Regards,

Giuseppe

From: Erik Kline <ek.ietf@gmail.com<mailto:ek.ietf@gmail.com>>
Sent: Wednesday, July 21, 2021 11:15 PM
To: Giuseppe Fioccola <giuseppe.fioccola@huawei.com<mailto:giuseppe.fioccola@huawei.com>>
Cc: Stewart Bryant <stewart.bryant@gmail.com<mailto:stewart.bryant@gmail.com>>; Christopher Wood <caw@heapingbits.net<mailto:caw@heapingbits.net>>; Yoshifumi Nishida <nsd.ietf@gmail.com<mailto:nsd.ietf@gmail.com>>; 6man@ietf.org<mailto:6man@ietf.org>; draft-ietf-6man-ipv6-alt-mark.all@ietf.org<mailto:draft-ietf-6man-ipv6-alt-mark.all@ietf.org>
Subject: Re: FW: I-D Action: draft-ietf-6man-ipv6-alt-mark-07.txt

Giuseppe,

I think in S2.1 "MUST NOT" be used outside a "controlled domain" is perhaps a bit too strong.  Similarly in S6, "MUST be applied in...controlled domains" might be moderated down to "SHOULD only be applied...".

I'll note that it is possible for an AH option to be used to ensure the DstOpt variant is unmodified en route, and these two in conjunction can be used wherever desired to send such packets outside the given domain (subject, of course, to all the middlebox interference any such packet would inevitably receive -- but that's a separate issue).

On Tue, Jun 22, 2021 at 11:27 AM Giuseppe Fioccola <giuseppe.fioccola@huawei.com<mailto:giuseppe.fioccola@huawei.com>> wrote:
Dear Stewart, Christopher, Yoshi, All,
Please note that I just submitted a new version of the draft. It has been thoroughly reviewed to address the comments received during the Last Call.

Your inputs are always welcome.

Regards,

Giuseppe

-----Original Message-----
From: ipv6 <ipv6-bounces@ietf.org<mailto:ipv6-bounces@ietf.org>> On Behalf Of internet-drafts@ietf.org<mailto:internet-drafts@ietf.org>
Sent: Tuesday, June 22, 2021 8:13 PM
To: i-d-announce@ietf.org<mailto:i-d-announce@ietf.org>
Cc: ipv6@ietf.org<mailto:ipv6@ietf.org>
Subject: I-D Action: draft-ietf-6man-ipv6-alt-mark-07.txt

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the IPv6 Maintenance WG of the IETF.

        Title           : IPv6 Application of the Alternate Marking Method
        Authors         : Giuseppe Fioccola
                          Tianran Zhou
                          Mauro Cociglio
                          Fengwei Qin
                          Ran Pang
        Filename        : draft-ietf-6man-ipv6-alt-mark-07.txt
        Pages           : 21
        Date            : 2021-06-22

Abstract:
   This document describes how the Alternate Marking Method can be used
   as a passive performance measurement tool in an IPv6 domain.  It
   defines a new Extension Header Option to encode Alternate Marking
   information in both the Hop-by-Hop Options Header and Destination
   Options Header.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-6man-ipv6-alt-mark/

There is also an htmlized version available at:
https://datatracker.ietf.org/doc/html/draft-ietf-6man-ipv6-alt-mark-07

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-6man-ipv6-alt-mark-07

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

--------------------------------------------------------------------
IETF IPv6 working group mailing list
ipv6@ietf.org<mailto:ipv6@ietf.org>
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------