[tcpm] 793bis: what to say about source routing

[Wesley Eddy <[e-mail]>]

One of the IESG comments that needs to be addressed on 793bis regards 
source routing.  There is the comment:

    [S3.9.2.1]

    * I feel like there should be some additional caveat about security
       implications of support for source routing.  RFC 6274, for example, says
       packets with LSRR (6274s3.13.2.3) and SSRR (6274s3.13.2.4) options should
       be dropped, citing various security concerns.

       I'm not sure there needs to be a lot of text; perhaps just an observation
       that some end systems may not support the source route semantics described
       here for security (or policy) reasons?

After looking at what 6274 says (which is Informational) and 793bis, 
here are my main thoughts:

    (1) The text in question was written for IPv4, prior to IPv6 with
    its own methods (deprecated RH0, and now other things like segment
    routing).

    (2) I'm not aware of anything changing with regard to 1122's
    description of IPv4 source routing support in IP stacks.

    (3) Looking at defaults on popular Linux systems, it looks like
    "net.ipv4.conf.default.accept_source_route = 1" is not uncommon ...
    so source routing support probably still exists.  I didn't look at
    what the TCP code does though, with regard to incoming source routed
    packets to see if it matches what 793bis says.

So, my suggestion is that we rename that section of 793bis (section 
3.9.2.1) to be specific to *IPv4* source routing, and then append at the 
end of the section a sentence like:

    RFC 6274 describes security concerns with IP source routing, and
    source routing may be disabled or unsupported on some systems.

Does this sound good?  Note that it basically leaves any flavors of IPv6 
source routing unmentioned (which seems right, since there isn't 
anything on standards track to use).  I would be very happy if someone 
more knowledgeable about the state of source routing support and usage 
could check this and share their thoughts.