Re: Next steps on Extension Header Insertion

[Sander Steffann <[e-mail]>]

Hi,

> What you are saying is something like:
> 
> "The IPv6 header fields described as immutable in RFC4302 MUST NOT be changed by the network. If within an administrative domain any of the immutable fields are changed, they MUST be restored on exit from the domain."
> 
> Correct?

Yes, thank you for coming up with a good short bit of text. As RFC4302 defines the next-header field as immutable that would lock down the EH chain,

> Cheers,
> Ole
> 
> PS: As an operator would you be happy if I sent packets with NH=59, SA=:: with an integrity check covering all fields apart from the HLIM field, and everything else beyond the IPv6 header (40 bytes) was encrypted?

Hmmmmm. Interesting question. As a network operator I'd probably drop that packet because of BCP38. As a security engineer I would be scratching my head and wondering what was going on. But effectively the payload wouldn't be that different from ESP...

Cheers,
Sander