Re: I-D Action: draft-vyncke-6man-segment-routing-security-00.txt

On Jul 11, 2014, at 5:30 AM, Brian E Carpenter wrote:
> Hi,
> 
> This draft says:
> 
>>   The SRH is simply another version of the routing header as described
>>   in [RFC2460] and is:
>> 
>>   o  inserted when entering the segment routing domain which could be
>>      done by a node or by a router;
> 
> There is no provision for routers to insert headers in an IPv6 packet,
> because this changes the packet size (and the payload length) and
> therefore breaks PMTU mechanisms. Only the host that originates a packet
> can insert headers.
> 
> It seems that draft-previdi-6man-segment-routing-header-01 has the
> same problem. It says:
> 
>>   When creating the SRH (either at ingress node or in the SDN
>>   controller) the following is done:
>> 
>>      Next Header and Hdr Ext Len fields are set according to [RFC2460].
>> 
>>      Routing Type field is set as TBD (SRH).
>> 
>>      The DA of the packet is set with the address of the FIRST segment
>>      of the path.
> 
> (etc.)
> 
> These are operations that can only be done by the host that creates
> the IPv6 packet, which is also the only place that a fragment header
> can be included if needed. As I understand it, the "ingress node" is
> a router, not the originating host. So this seems to be broken.

well, unless the multiple interoperable implementations we have are 
also broken, I can tell you (and show you) it's a reality that works 
well, that address a set of requirements (especially in terms of 
service chaining) and "routers" can happily insert extensions headers.

Now, let's agree on the definition of "router". If it's a device 
acting at layer 3 and that "routes" packets based on DA and FIB 
instructions, then it is obvious that a router can insert an SRH.

However, it is also obvious that we do not expect core routers do so.

s.

> 
>   Brian
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------