Re: [v6ops] Extension Headers / Impact on Security Devices

Gert Doering <gert@space.net> Wed, 27 May 2015 07:39 UTC

Return-Path: <gert@Space.Net>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 866431A88A7 for <v6ops@ietfa.amsl.com>; Wed, 27 May 2015 00:39:48 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.51
X-Spam-Level:
X-Spam-Status: No, score=-0.51 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kIWK_dpl_hU5 for <v6ops@ietfa.amsl.com>; Wed, 27 May 2015 00:39:46 -0700 (PDT)
Received: from mobil.space.net (mobil.space.net [IPv6:2001:608:2:81::67]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 912461A88B4 for <v6ops@ietf.org>; Wed, 27 May 2015 00:39:46 -0700 (PDT)
X-Original-To: v6ops@ietf.org
Received: from mobil.space.net (localhost [IPv6:::1]) by mobil.space.net (Postfix) with ESMTP id C6EE9608E5 for <v6ops@ietf.org>; Wed, 27 May 2015 09:39:43 +0200 (CEST)
X-SpaceNet-Relay: true
Received: from moebius3.space.net (moebius3.Space.Net [IPv6:2001:608:2:2::250]) by mobil.space.net (Postfix) with ESMTPS id 89FB0608CF for <v6ops@ietf.org>; Wed, 27 May 2015 09:39:43 +0200 (CEST)
Received: (qmail 94666 invoked by uid 1007); 27 May 2015 09:39:43 +0200
Date: Wed, 27 May 2015 09:39:43 +0200
From: Gert Doering <gert@space.net>
To: Brian E Carpenter <brian.e.carpenter@gmail.com>
Message-ID: <20150527073943.GA54385@Space.Net>
References: <555AB8FA.2080405@si6networks.com> <F6AA9AEA-49F0-488C-84EA-50BE103987C8@nominum.com> <555B8622.5000806@isi.edu> <555BA184.8080701@gmail.com> <555BA43F.8010303@isi.edu> <5564FB74.5020303@gmail.com> <5564FE3F.4050102@isi.edu> <556503CF.4030101@gmail.com> <55650821.4060907@isi.edu> <55650E82.3090407@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <55650E82.3090407@gmail.com>
X-NCC-RegID: de.space
User-Agent: Mutt/1.5.23 (2014-03-12)
Archived-At: <http://mailarchive.ietf.org/arch/msg/v6ops/XoPtz5g-cRclDEi-47h3LJp8JYw>
Cc: v6ops@ietf.org
Subject: Re: [v6ops] Extension Headers / Impact on Security Devices
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/v6ops/>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 27 May 2015 07:39:48 -0000

Hi,

On Wed, May 27, 2015 at 12:23:30PM +1200, Brian E Carpenter wrote:
> > FWIW, I don't see anything that prohibits adding headers either.
> 
> "With one exception, extension headers are not examined or processed
> by any node along a packet's delivery path, until the packet reaches
> the node (or each of the set of nodes, in the case of multicast)
> identified in the Destination Address field of the IPv6 header."
> 
> To me that clearly implies not adding (which is a form of processing).

So how do the SR folks handle that?  From what I heard, the intended
deployment really is "inside your administrative domain, SR headers get
added, processed, and when the packet leaves your domain, they can be
(optionally) removed again to not upset your neighbours"...

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (0)89/32356-444           USt-IdNr.: DE813185279