Re: [Spud] endpoint control

On Wed, Jun 29, 2016 at 3:45 AM, Smith, Kevin, (R&D) Vodafone Group
<Kevin.Smith@vodafone.com> wrote:
> Hi Tom,
>
>> Do you see any reason (other than maybe current deployability) that these can't be done in HBH options instead of TCP options?
>
> Probably down to forwarding performance too, as Hop-by-Hop must be processed by all network devices. And deployability as you say; because IPv6 is unfortunately not prevalent yet in mobile core networks...
>
The first problem is being relaxed in 2460bis draft. It allows HBH to
be ignored by network devices, which should cover the case where there
are "too many options to parse" in a DOS attack.

Tom

> https://tools.ietf.org/html/draft-krishnan-ipv6-hopbyhop-05 recommends using other extension headers instead, due to a denial of service threat. But these are intended for the destination and not interim nodes, and we'd need to check that EH are consistently passed across a range of vendors' routers.
>
> Many thanks,
> Kevin
>
> -----Original Message-----
> From: Tom Herbert [mailto:tom@herbertland.com]
> Sent: 28 June 2016 18:37
> To: Smith, Kevin, (R&D) Vodafone Group
> Cc: Brian Trammell (ietf@trammell.ch); spud@ietf.org
> Subject: Re: [Spud] endpoint control
>
> On Tue, Jun 28, 2016 at 3:41 AM, Smith, Kevin, (R&D) Vodafone Group <Kevin.Smith@vodafone.com> wrote:
>> Hi Brian,
>>
>> I think Mobile Throughput Guidance would be a good candidate for PLUS path-to-endpoint signalling. The latest (albeit expired) MTG draft [1] is bound to TCP Options, and was considering use of TCP-AO for authentication; PLUS could allow MTG for both TCP and UDP-based flows. However it seems that proposed PLUS mechanism:
>>
>>>(1) For forward signaling, the sending endpoint must place "scratch space" in the packet with a label on it stating that it's okay to modify; this okay-to-modify state is enforced by a MAC which only verifies the length but not the content of the scratch space.
>>
>> ...may not provide the guarantee that (1) the MTG information was indeed injected by the cellular network and (2) that it has not been modified by another node. Have I got that right? Or would such an authentication/integrity check applicable to path data be in scope of PLUS?
>>
>> Cheers,
>> Kevin
>> Vodafone R&D
>>
>> [1]
>> https://www.ietf.org/archive/id/draft-flinck-mobile-throughput-guidanc
>> e-03.txt , expired
>>
> Hi Kevin,
>
> That is an interesting use case. Do you see any reason (other than maybe current deployability) that these can't be done in HBH options instead of TCP options?
>
> Thanks,
> Tom
>
>
>> _______________________________________________
>> Spud mailing list
>> Spud@ietf.org
>> https://www.ietf.org/mailman/listinfo/spud