Re: Please review: 6MAN WG Adoption call: draft-baker-6man-hbh-header-handling-03

[Mark Smith <[e-mail]>]

On 21 Oct 2015 12:34 am, <[e-mail]> wrote:
>
>
>
> >The unicast source address in a packet indicates the source of all
information in a packet - the packet originator.
>
> >If a device in the network adds information, such as extension headers,
the unicast source address value has lost some if its meaning, because it
now doesn't identify the source of all >of the contents of the packet.
>
> >The packet is now a "multi-source" packet, rather than a single or
"uni-source" packet, yet only the first of the packet content sources is
available in the packet's unicast source >address field.
>
> >Any mechanisms that depend on a source address identifying the single
and original source of the packet, such as PMTUD, may now fail.
>
> On networks today, you will see "third party reset".  That is, a middle
box sending a reset to a destination address with what appears to be the
unicast source address of the originator. But, it is not actually sent by
that source address but by a box in the middle.  Just saying, the source
address does not in all cases indicate the packet originator.  And, I am
not talking about MITM.  This situation can happen today if there are too
many retransmits, for example.
>
> Not saying we want to perpetuate this kind of behavior.

(Terse because I'm on a train)

We shouldn't, and if we get to the point where addresses are cryptography
authenticated, that won't work.

That is of course an example of source address spoofing. If you were to try
to trouble shoot that, without being aware there is a device in the network
spoofing source addresses, you'd spend a lot of time suspecting and
investigating a device that wasn't at fault.