IETF Logo Mail Archive

[spring] WGLC comment on draft-ietf-spring-srv6-security (operationally enforceable mitigations)

Meir Goldman <fazon@fazoncore.org> Fri, 13 February 2026 02:26 UTC

Return-Path: <fazon@fazoncore.org>
X-Original-To: spring@mail2.ietf.org
Delivered-To: spring@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 2703EB6AD273 for <spring@mail2.ietf.org>; Thu, 12 Feb 2026 18:26:53 -0800 (PST)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -1.896
X-Spam-Level:
X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YAAySVGDstKU for <spring@mail2.ietf.org>; Thu, 12 Feb 2026 18:26:52 -0800 (PST)
Received: from TL0P290CU003.outbound.protection.outlook.com (mail-israelcentralazon11023084.outbound.protection.outlook.com [40.107.174.84]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256)) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 91CFEB6AD26A for <spring@ietf.org>; Thu, 12 Feb 2026 18:26:52 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=kUwOP8iFzArVlmzw1rqCqvQqjivv1cObeKmTbEzMuY6uD+9W6akNcG2MdgBgBt+GxjGJ737KIC4eF9WGZQV+E/vM9qAv7pCo4T+VTguVQ1kmnnms4QKMD8v+X6f3vSUs/8UdEAj0aTX8S8fYi9KMZmzb8T55xrOBeg1LHlBIQD62+c4/CTqAZRV1mxyA/KxFQnF2+OtY7OqWDMdnb4OpKCLvZIvc29ecFbPlVP89pEKVWge4pCRaUmdlhfNz7PaQqN9DBunoBJKffirqBUQj9dt6CwcFmXQiu83qmw7L1vKL4AXqn5elOviz1hgis9FHd1xnNg6hhZOnGdv2nNyg9g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=hph/4expOANZdANl/w9UgsTtH7JD77gaA2nu+0ui05c=; b=BAor0WPsEHJNo2qV7n6pJEnd/H9HvRX6WYJ/22ezgXtJ6AowLsBuNtMKrVd78+yk6gGNARGW3WEQoFYEHTiBmvc2Jw9gPJCmdy4x4qJTbq/hGWy2B+koGQa7+l3/V7aujwGGswk08PEc4gMXQvLQUH84tgwZCMvvwyAEmCK9Z25bCI4hTGR0kbhE/Ufaw8KJPhRDChJ9PwAbXH65SZKNMMj3SaEH2gO1mCenqFxbZYjW3UBzf6y8AkWl9M+k3107aojlf/XzmbBU5dut1l+Qk16OIKeSU5Dska0vKWC9Mzj1c7E7gZt0mfMsNXgIu/OxoQmyb1P4xDSthANt0FsCFQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=fazoncore.org; dmarc=pass action=none header.from=fazoncore.org; dkim=pass header.d=fazoncore.org; arc=none
Received: from TLZP290MB0303.ISRP290.PROD.OUTLOOK.COM (2603:1096:950:40::12) by TLZP290MB0276.ISRP290.PROD.OUTLOOK.COM (2603:1096:950:36::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9611.13; Fri, 13 Feb 2026 02:26:43 +0000
Received: from TLZP290MB0303.ISRP290.PROD.OUTLOOK.COM ([fe80::38ff:f3a8:7ae8:46de]) by TLZP290MB0303.ISRP290.PROD.OUTLOOK.COM ([fe80::38ff:f3a8:7ae8:46de%4]) with mapi id 15.20.9611.012; Fri, 13 Feb 2026 02:26:43 +0000
From: Meir Goldman <fazon@fazoncore.org>
To: "spring@ietf.org" <spring@ietf.org>
Thread-Topic: WGLC comment on draft-ietf-spring-srv6-security (operationally enforceable mitigations)
Thread-Index: AQHcnJAWF5y6cPWsbESpDQYSQMyaGQ==
Date: Fri, 13 Feb 2026 02:26:43 +0000
Message-ID: <TLZP290MB030315EC5D15F7E5E41E1278B561A@TLZP290MB0303.ISRP290.PROD.OUTLOOK.COM>
Accept-Language: ru-RU, en-US
Content-Language: ru-RU
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=fazoncore.org;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: TLZP290MB0303:EE_|TLZP290MB0276:EE_
x-ms-office365-filtering-correlation-id: f2d1545c-9e18-49d8-de1b-08de6aa7543e
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|366016|376014|10070799003|1800799024|7055299006|8096899003|38070700021;
x-microsoft-antispam-message-info: Y7clvnPZP9IfzeCRU32X4VBC0EN3IrlxSrWT8gtoe/e4KPCpxoyZOwNkrJDHq8+ZobxgNY7tLArSYpWDd96i+pHks8FLkTcRNz4hTypkIEstcV9SUvEpQesL3y695ng+Jr/E4sCgdY+YE3V65X9iezISGUHNLXBFotlQ7/M3EGGhnUpCkPSZ9eG1ZJowlu6P87Pat8LSvv+g+d33VVR/i3TyTRM4BPJx1LtHbeeVx3IsQ8WzKPQp2iydJUI5MEwPjMP4/XqJu2m2rR8rU7EvyVgInSrxOIyjvbwbK3za4TMtJfXagbGoUK0nT5PNOZeoDXiwMRgUMj7gCdXyRc7OhYjNeaQq0yiNrPI0qdfOQLrQjQkOrRULpSXqRI9Rh4RwJuxNjOS8FdE8dOrXi+1VZe3+Mbgy9djgLSOanpla8v6StzgjBO1snjjWS3cZun/6KlPNFVVeJpUObf5fiN6XGba1K/oRUxTJJA5c86txnN7jwUS/VTWsvOZR/ZTw44G8LDrV2dJWJqg2HpZnLfobX1lnfXbIOQ4s72o3L2462+narSbDczr5mKOrH2YohMf2mJHXzkzBwcih9WVtlsSX2RBvuYGz3tP4dly7IFf4/6G9olBuNCMLS65rroAnu+Wc/0OlJOGOuKwjAF4OgIYzEHNrrkAPy0fZIpQrhB5zI2vizQZ/wmg5O4dYFX+8ak1QaRRoC3NbwqPFJj4X/+HtMpqhHcPOewdUgE+5WgK1yhX41s7y5yHvg00FZNJjkPGe9btwL8Xp3DKuhYC8DgTpenq9ItkahFPpgi7WnnuCFiPrtVSGFO56FDyn9BLIzPN2Q72p6ieUpU8ke9/aS64ePF5oPOwFPUuAbSofBzdTzOhnuPI3Hk7u3OrBCHH3Fk47+yfq0kUYQxnA+JHHmxfc/J9qOfb2SHR907NjdkqqhdiEsC+/emnAqFS2oNz7kld/7rDclgeewKTCu4sFm7lMeZePqzcywnIoGeVu019ZKmAj+MOA1ABalgItRbhCyJkJo8RUOZ64dyjmAxPLQm/cJbFLwQ9UXY/yK2JxtPaO6OHhrLTrlamYjOjo+fAHUKDs4/0W2zbzavm3kvEkRKspGZhnJ4nvI7Ijnd4Sh+iMEZA11Xgzjl+FHWGUts4lclEc1eub+B2107rSN98N15TISt2FKv3vSowg4KXJpeMPG4z8U2Rfi/04yU6XuckLegpjNyo1HaKbrc3wLnXCpZs/4rDoA9xG141b7pDM2CG5NCEDF/KywpojVFNfI8uODhKtekg5siScuDgaAz2ndWxz+yYBO+sPLjF7EXjRZi6iObY3sxb04NWOuFJU/OJJhGQbi1LTV76OsnXAmpstf2qBB+uvI0RYD1Rwsw+4PIdNCuzKL/ugW2oh6y6OcsShBOQaWXhE+28Rex00Ldaa3l8rrPJEreTSIPnl2fh9CfKMlljFjud5Q6LIBqISiEseb3Y+hhaEehBnB1cMEpF8b0RF1MwY56SWrIlJAdOYcwzXfjDnGKTXqjeKpjtqoyodQaaRAWhGrlVsbumtg79OWeLgq8TFWYQcK1f7jlKc0LepJ6RMzSfeXl6nUZId4ZVCgR/uenhfORBcT6qwS/XeU7ngCA==
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:TLZP290MB0303.ISRP290.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(376014)(10070799003)(1800799024)(7055299006)(8096899003)(38070700021);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: PrJ6pQNu0KVEMpZovAGjqdCwNgtEz5ncGCPt3OdvKhKEuJcjnvwb9R6lB571ZD6IlVWcE44NNIEDBsc+kudOEBhdcQfWdQP6WtZ1Fv3awu2WYCG7TnbA00gkHc7kMIEBaqW9jwZlPgveUXypuXOzHQK17TErfFqYxf0Pn55lpxJINvmv0x2qstYf/kxtvvWPSgMO1TqgMsxxdmGJKILypMNLKnmfrUDh+5TRo3THu4A4sOu8GPQeqZo4PiFO6kVULfexDsp4Rwe7oWUHKHvvPO/V2lcZiqcloxuP0UKPpxqHaCxdNVSvFlUgcWGjEHM6YhIZCh6HntRynIQpSPSVVWBkNIdj+qgzIp7vsQjzyTs52m59UV8+RnMo36JTAV0hnonm7T9pxRw/g3KCaIdID5F7L6g8rArxXG5OiJUuCAtiKMdelav06F2vzDbko5WL0nxCiadANb5QxdbS8TrjgfkVXy2/Y8c+Fc/47cMJ6+brodnkRiuXHJxHELLIuZTiWPgpDIwo5D6JMN/RgeRLxj1gqmVCCUcD6kUBCpk2BbXX30aCdB+0gZappdiCg5yTFNDxtfDyPghO/TClTKy6oRzK2qpYBiCEa6OEjzA0qRQXvLVEeZ8lWZsWAZ0dos57tenLQLqPzHYdmb7KjAM/f6ADLzDVjrjYTIORtE27Hxcx0DQ7bZ5Alm9e+KDP7cJuhXygeWzpY+u1cuQgMFxvFH/dXAkBHtqV5S0ovwn6481rsXlS+8ARGu8+/u6fNDGsDq1fLlYWZUHK4NOAljAZGccXKCLoK4+U0g8W8VGh+o0DNKtpEz3wNJNm4pj7JZrPQBHqIocb9Y3kSuM+IBhiX0xtudashDFNCwevB71Bct0OuKD9mvlbh2mHhsdQicPt21mx2ENRrOsST/+oH9k+mBeE7CnXP6LaJ/V8M+0QJ+uJTv7PKOI3lIGQW6X/H7GW9aCuGkqSdsmZujhp1voIvW9w/Hd1sHcMx1HrpGLv4h60TCU6djtqedXKsiCjkFXpBsduudmMuSw0s5lCRpRmveajBWP50dNCf23RBBgzA9Zlo2FBAqJm2ZD3ZyvU76mFaFaqmNk3tcsBLJwGV9zJzbzWc0wOR1EFSayPUtX01oVNrbxczFelQ28Lzl+v/8NRRiY7IYi/eQQ6xeNBsKEKrRp8hFl+Kx4psH6351GxGUu01BsZZ3F7be2ATFNSZyX7lmo6D2bzdEsQglgntiW8UZAlVLx5yiaF/JnQNGXZedmw0nYdB9krKN8JOHKjtRm7mQsWDoYtFSouUQsF2F2LwJ+sp8G0BK+gh3ZmTMTfY+qp/CbqYQS+tnv4KvNzsxfdY588UNX0BcuNSphlTX9OZH9AZzlP78icoh4yjQRslVTTD5Wo4VDuyzE3WYsNFBnqivLTgYFKn4TTg+7zM7HBdSjxitAkB1O0L5fNOJoteFtTnh6H42v+/qcAA1SNXEgdPsJ0YqJ/f7w8qxYQ8ze8gdagq5n4pxwRtLD3PqjioU1COQbtDDGozWUyeBL3s2eEciae5in6dSngLQBxLBNq7TAkzQQRnKWNzGKxGRsaAGHjWarOpy1e9ItUxZ7brfXt5UTcmwGRM9RKfuS8zEXRB2giWYmFpNPozkv/Fq5Cai1oDE0c5NXbQtW3l6/m7/6R3cuf7pbAaW3eHCWzMDUHP5pvN+TeLox5qer+RgXehnch7aAnaOp4jlM9cRkW/MOHjPU2btyinnBRx42kCXFheNYxozG0PzaYuX02vNQyXO3DQO8E8Vad1nUzI+3GWqIE
Content-Type: multipart/alternative; boundary="_000_TLZP290MB030315EC5D15F7E5E41E1278B561ATLZP290MB0303ISRP_"
MIME-Version: 1.0
X-OriginatorOrg: fazoncore.org
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: TLZP290MB0303.ISRP290.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: f2d1545c-9e18-49d8-de1b-08de6aa7543e
X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Feb 2026 02:26:43.8521 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: f17367ad-889d-4730-9854-891cf491cff0
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: zMc6V+4TRGK4rx0k6G/J1e0Ds4vHqyBbzdqts3T5hGchbYKyl8e0qoYKEClVtvdhfSB3n7tVaseyhf0QAACQLQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: TLZP290MB0276
X-MailFrom: fazon@fazoncore.org
X-Mailman-Rule-Hits: nonmember-moderation
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spring.ietf.org-0
Message-ID-Hash: BTHCT33HKIRRPTB74HQEK4DVMYG22KLF
X-Message-ID-Hash: BTHCT33HKIRRPTB74HQEK4DVMYG22KLF
X-Mailman-Approved-At: Fri, 13 Feb 2026 01:13:05 -0800
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [spring] WGLC comment on draft-ietf-spring-srv6-security (operationally enforceable mitigations)
List-Id: "Source Packet Routing in NetworkinG (SPRING)" <spring.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spring/2iqFz7Y4wRmELyc2IHeW6bNEqkI>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spring>
List-Help: <mailto:spring-request@ietf.org?subject=help>
List-Owner: <mailto:spring-owner@ietf.org>
List-Post: <mailto:spring@ietf.org>
List-Subscribe: <mailto:spring-join@ietf.org>
List-Unsubscribe: <mailto:spring-leave@ietf.org>

The draft is valuable as a security considerations document, but I suggest emphasizing operationally enforceable guidance:

1) Clearly state boundary enforcement expectations (who is allowed to inject SRH/segments; what must be filtered/dropped at domain edges).
2) Add explicit guidance on extension header / fragmentation handling so mitigations remain effective in real deployments.
3) Where possible, tie mitigations to concrete controls (ACLs/policy filters/strict validation of SRH and segment lists) rather than only descriptive text.

Regards,

Meir Goldman
FAZON Foundation
fazon@fazoncore.org
https://fazon.org

v2.46.0 | Report a Bug | By Email | System Status