Subject: (IPng 7533) Re: Last Call: IPv6 Jumbograms to Proposed Standa rd

From: "Steven M. Bellovin" <[email-masked]>
Date: Fri, 14 May 1999 10:04:00 -0400

In message <[email-masked]>, Craig Metz writes:
> In message <[email-masked]>, you write:
> >and routers can't verify the AH field.
> 
>   Um, actually, there are good reasons why routers might want to (they would,
> of course, have a SA for this purpose). This is one of the reasons why
> multiple AHs can sometimes be useful.

Sure, they might want to verify the flow.  But that in turn requires that
the packet be addressed *to* the router, so we can have such an SA, which
in turn implies tunnel mode with the real flow-id in the inside header.
> 
> >u_char  ip_p;                   /* protocol */
> >                Probably doesn't need checking; can be bound to SPI
> >                if needed.
> 
>   IMO, ICMP about a flow should use the same SA as the bulk of the flow, whic
> h
> wouldn't be possible if we bound this to the SA.

OK.  Since the protocol id is covered by the transport pseudo-header,
which in turn is protected by ESP's MAC.
> 
> >As for options, except for security label the remaining options
> >are either changeable en route, and hence exempt, or of interest
> >to routers, or both.
> 
>   The easy solution is to just not use options (or IPv6 options bag headers a
> nd
> routing headers). In many parts of the 'net, you already can't get very far i
> f
> there are options in your packets.
> 
>   If you simply don't use options, then I agree with you that we can get away
> with basically only doing the transport header/encapsulating header and the
> payload beyond.

Apart from Brian's point -- that we want to ensure that options are useful
in v6 -- I've yet to see a hop-by-hop option that's (a) important to the
end system, and (b) not modified en route.
> 
> >The security label is one that might require integrity.
> 
>   It requires integrity and might require intermediate checking.

As with the flow-id, intermediate routers can't validate it except in tunnel
mode.

On a metanote, I fear we're restarting the AH debate, which I really didn't
want to do, especially on this mailing list.  Let me suggest that one
focus of IPv6 deployment and testing be on interoperability issues
concerning all of IPSEC -- there's certainly room for minor tweaks between
now and when we go to "Draft" status.  We especially need information
on transport mode, since tunnel mode is being deployed extensively for
VPNs.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------