Re: [Status] Jari Arkko's BLOCK on charter-ietf-spring-00-06

[Robert Raszuk <[e-mail]>]

> all an attacker then needs to do is:
>
> 1. pick a route which transits an IPv6-SR capable node
> 2. add a forged extension header
>
> voila - you can get anywhere you want in the IPv6-SR domain;

Not really ...

Yes it will be allowed to get into any network, however it is very
easy not to examine extension headers on such packets hence only
provide v6 transit as any DFZ would provide today without any SR
enabled.

Segment routing != source routing .. perhaps the analogy made by some
folks is really counter productive to the technology at stake. But
your points are great as those issues you bring when addressed by
subsequent drafts will make the solution much more robust for any AF
it is deployed to work with.

Many thx,
R.