Re: [spring] WGLC - draft-ietf-spring-srv6-network-programming

[Tom Herbert <[e-mail]>]

On Tue, Dec 10, 2019 at 4:49 PM Joel M. Halpern <[e-mail]> wrote:
>
> Fernando, I really wish I could agree with you.
> But I can't.
>
> In 8200, it is clear that the meaning fo "Destination Address" for an
> IPv6 packet is the value placed in the IPv6 destination address field.
> the fact that if we had looked ahead we might have said something
> different does not change what words we chose to use.  If I am going to
> insist (as I have in other contexts) that other folks live with the
> words we compromised on in 8200, then I have to live myself with the
> words we compromised on in 8200.
>
Joel,

That might be the wording, but don't believe that was the intent. The
real intent is revealed by some of the earlier text that said
(draft-ietf-6man-rfc2460bis-07):

"The insertion of Extension Headers by any node other than the source
of the packet breaks PMTU-discovery and can result in ICMP error
messages being sent to the source of the packet that did not insert
the header."

That is true, and breaking ICMP is an issue that has been raised
repeatedly. It also breaks AH as pointed out. Furthermore, if RFC8200
allows SRH insertion to occur, then we'd have to accept that it allows
ANY type EH insertion (except maybe fragmentation?) to occur at any
destination address! Not only that, we also need to accept that this
would allow NAT devices to insert EH when the destination address is
the NAT address.

So the possibility that destination address wasn't spelled out as
being final destination seems to be an unfortunate omission, but even
so, that omission doesn't somehow magically make EH insertion robust
or mitigate the problems of EH insertion that have already been
discussed. Neither does it provide the rationale why encapsulation
with the EH can't be used instead which is clearly the option that
most closely adheres to the Robustness principle.

Tom

> I have concerns about whether PSP is a good design.  I am trying to
> write a useful note on the topic.  (And without such a note, I can not
> expect anyone to care about thoughts in my head.)   But I can not and
> will not claim that PSP violates RFC 8200.
>
> Yours,
> Joel
>
> On 12/10/2019 6:16 PM, Fernando Gont wrote:
> > Bruno,
> >
> > On 10/12/19 13:18, [e-mail] wrote:
> >> Fernando,
> >>
> >> Thank you for spelling out your comment, plus on the WGLC thread.
> >> More in-line
> >>
> >>> Bruno,
> >>>
> >>> On 5/12/19 12:15, [e-mail] wrote:
> >>> [....]>
> >>>> This email starts a two weeks Working Group Last Call on
> >>>> draft-ietf-spring-srv6-network-programming [1].
> >>>>
> >>>>
> >>>>
> >>>> Please read this document if you haven't read the most recent version,
> >>>> and send your comments to the SPRING WG list, no later than December 20.
> >>>>
> >>>>
> >>>>
> >>>> You may copy the 6MAN WG for IPv6 related comment, but consider not
> >>>> duplicating emails on the 6MAN mailing list for the comments which are
> >>>> only spring specifics.
> >>>>
> >>>>
> >>>>
> >>>> If you are raising a point which you expect will be specifically debated
> >>>> on the mailing list, consider using a specific email/thread for this point.
> >>>>
> >>>> This may help avoiding that the thread become specific to this point and
> >>>> that other points get forgotten (or that the thread get converted into
> >>>> parallel independent discussions)
> >>>
> >>> Penultimate Segment Popping describes/specifies the removal of a SRH at
> >>> a place other than the final destination of the packet.
> >>>
> >>> Such behavior violates RFC8200, which specifies:
> >>>
> >>     > Extension headers (except for the Hop-by-Hop Options header) are not
> >>     > processed, inserted, or deleted by any node along a packet's delivery
> >>     > path, until the packet reaches the node (or each of the set of nodes,
> >>     > in the case of multicast) identified in the Destination Address field
> >>     > of the IPv6 header.
> >>>
> >>> Note, of course, that the reference of "Destination Address" in RFC8200
> >>> is clearly the final destination of the packet -- for instance, RFC8200
> >>
> >> I hear and can understand your reading of RFC8200.
> >
> > Could you please check RFC8200, and tell me what other possible
> > interpretation of "Destination Address" you might have, in the context
> > of RFC8200.
> >
> > RFC8200 does not even specify any routing header types. SO...where's the
> > ambiguity?
> >
> >
> >
> >> At minimum, I think that we can agree that there is another reading, as expressed by other WG participants, and hence I disagree with "of course".
> >
> > No, I argue that there is not. IN fact, I argue that folks have been
> > following that strategy for way too long, and that's quite frustrating.
> >
> >
> >
> >> Personally, I understand "Destination Address" as "Destination Address field of the IPv6 header." as indicated explicitly in the text quoted.
> >
> > The quoted text is from RFC8200. In the context of RFC8200 the
> > Destination Address can only contain the ultimate destination of the
> > packet. Where's the ambiguity?
> >
> > And let me ask you, as chair, another question, that will lead you to
> > the same place: is IPv6 and end to end protocol?
> >
> >
> > The fact that I may claim that RFC8200 contains a receipe for BBQ does
> > not actually mean that that's the case.
> >
> >
> >
> >> I'm fine with having this clarified with 6MAND chairs and AD. That been said, the Internet AD would have an opportunity to DISCUSS this.
> >
> > For the record, I think this is a major issue that should be cleared
> > before it can be claimed that there is consensus to request publication
> > of this document.
> >
> >
> >
> >>
> >>> does not specify any routing header type, and hence the meaning is
> >>> unambiguous (there's no destination other than the final destination of
> >>> the packet).
> >>>
> >>> This is of course in line with IPv6 being and end-to-end protocol, and
> >>> crucial for other related mechanisms to work as expected (such as IPsec
> >>> AH). Please also check: draft-smith-6man-in-flight-eh-insertion-harmful.
> >>>
> >>> So, in order to proceed with the document, there are multiple options
> >>> forward:
> >>>
> >>> 1) Just remove the corresponding text/behavior
> >>
> >> That is indeed one option. But as of today, this is not my assumption.
> >>
> >>> 2) Implement a similar mechanism in an RFC8200-compliant manner (e.g.,
> >>> re-encap)
> >>
> >> SRH insert is out of scope of this specification. So yes, IPv6 encaps is used.
> >> We are talking SRH removal. I'm assuming that you are referring to PSP. My understanding is that this function (PSP) is to distribute the (forwarding plane) load between the PSP and the USP. In a way similar to MPLS PHP. But in all cases, this is not about SRH insertion.
> >
> > It's about SRH removal, which is also forbiden by RFC8200.
> >
> >
> >
> >
> >>> 3) Do the necessary standards work to update RFC8200, such that it
> >>> allows this sort of behavior, and only ship the network-programming
> >>> draft for publication when at least 6man has consensus to proceed on
> >>> that path.
> >>
> >> Not the preferred path as of today.
> >
> > Yes, it should be evident that it seems the preferred path has been
> > (starting with EH insertion at the time) to circumvent existing
> > specifications.
> >
> >
> >
> >>
> >>> P.S.: I will go through the document once again... but the same
> >>> reasoning should be applied to any EH-insertion/removal at a place other
> >>> than the source of the packet or its final destination.
> >>
> >> It looks to me that SRH insertion and SRH removal are to be treated differently.
> >
> > I don't see how or why. Both violate the same requirement in RFC8200.
> >
> >
> > Thanks,
> >
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------