Re: [v6ops] WG Doc? draft-gont-v6ops-ipv6-ehs-packet-drops

["Ray Hunter (v6ops)" <[e-mail]>]

Joe Touch wrote:
> On 4/5/2016 10:00 AM, Mark Smith wrote:
>> Adding, deleting or changing EHs in the network would be silent about
>> who made the changes (except when modification records who did the
>> change e.g. RH0). In this case the packet source address has lost its
>> much of its clarity, because there are now multiple sources of the
>> information in the packet.
>
> Given the pervasive presence of NAT and other header rewriting devices,
> there are already many such sources. Unless the header is authenticated,
> there are no assurances as to exactly where the information therein
> originated.
>
> Joe
>
>
NAT is not pervasively present in IPv6 networks, so that's not really 
relevant to the discussion.

The outer packet headers can't be fully invariant end to end, because 
some fields have to/ may be rewritten along the path, even in normal 
operations e.g. HBH options, flow label, and hop count. So any 
protection of header content would have to be very limited in scope.

But even authenticated headers get messed around, so that's also no 
solution in and of itself.  Look at the hoops that people have to jump 
through (both technical and legal) to make https and other strong end to 
end transports work over NAT and proxies.

IMHO the end to end principle is still worth fighting for.

But IMVHO another consequence of the end to end principle is that if you 
want end to end protection, you'd better do it yourself, at a layer you 
control, and not rely on any underlying infra to guarantee it for you. 
On a routed network, there's always a man in the middle. So you can 
never trust headers in the general case, even if they're authenticated.

Whilst the end to end principle itself doesn't preclude in-flight 
deep-packet-inspection (where appropriate/legally justified/technically 
possible). [Note: Your lawyers may disagree. You may be subject to 
different laws.]

-- 
regards,
RayH
<https://www.postbox-inc.com/?utm_source=email&utm_medium=siglink&utm_campaign=reach>