Re: [v6ops] Extension Headers / Impact on Security Devices

[Brian E Carpenter <[e-mail]>]

On 27/05/2015 11:56, Joe Touch wrote:
> 
> 
> On 5/26/2015 4:37 PM, Brian E Carpenter wrote:
>> On 27/05/2015 11:14, Joe Touch wrote:
>>>
>>>
>>> On 5/26/2015 4:02 PM, Brian E Carpenter wrote:
>>>> On 20/05/2015 08:59, Joe Touch wrote:
>>> ...
>>>>>> No. RFC 2460 makes it clear that hops don't modify extension headers
>>>>>> (except for shuffling within a routing header).
>>>>>
>>>>> HBH headers are the exception and can be modified in-transit, which
>>>>> would affect a transport-offset header.
>>>>
>>>> I don't get where RFC 2460 allows that.
>>>
>>> Section 4 states:
>>>
>>>    With one exception, extension headers are not examined or processed
>>>    by any node along a packet's delivery path, until the packet reaches
>>>    the node (or each of the set of nodes, in the case of multicast)
>>>    identified in the Destination Address field of the IPv6 header.
>>> ...
>>>
>>>    The exception referred to in the preceding paragraph is the Hop-by-
>>>    Hop Options header, which carries information that must be examined
>>>    and processed by every node along a packet's delivery path, including
>>>    the source and destination nodes.
>>>
>>> In addition, RFC2460 defines a bit to handle when changes to such
>>> options occurs en-route:
>>>
>>>       1 - Option Data may change en-route
>>>
>>> What is the purpose of that bit if the data can never change en-route?
>>>
>>> Such changes can affect the content and *length* of these options.
>>
>> Oh yuck. I suspect that allowing a length change is an unintended side
>> effect, but you're correct that it isn't forbidden. I've certainly
>> always read that text as allowing an update of the current value
>> of the content, not an increase in the length.
> 
> FWIW, I don't see anything that prohibits adding headers either.

"With one exception, extension headers are not examined or processed
by any node along a packet's delivery path, until the packet reaches
the node (or each of the set of nodes, in the case of multicast)
identified in the Destination Address field of the IPv6 header."

To me that clearly implies not adding (which is a form of processing).

   Brian

> Not that I think that's a great thing to play with, but seems in-scope too.
> 
> Joe
>