Re: I-D Action: draft-vyncke-6man-segment-routing-security-00.txt

[Brian E Carpenter <[e-mail]>]

Hi,

This draft says:

>    The SRH is simply another version of the routing header as described
>    in [RFC2460] and is:
> 
>    o  inserted when entering the segment routing domain which could be
>       done by a node or by a router;

There is no provision for routers to insert headers in an IPv6 packet,
because this changes the packet size (and the payload length) and
therefore breaks PMTU mechanisms. Only the host that originates a packet
can insert headers.

It seems that draft-previdi-6man-segment-routing-header-01 has the
same problem. It says:

>    When creating the SRH (either at ingress node or in the SDN
>    controller) the following is done:
> 
>       Next Header and Hdr Ext Len fields are set according to [RFC2460].
> 
>       Routing Type field is set as TBD (SRH).
> 
>       The DA of the packet is set with the address of the FIRST segment
>       of the path.

(etc.)

These are operations that can only be done by the host that creates
the IPv6 packet, which is also the only place that a fragment header
can be included if needed. As I understand it, the "ingress node" is
a router, not the originating host. So this seems to be broken.

   Brian