Subject: Re: (IPng 7503) Re: Last Call: IPv6 Jumbograms to Proposed Standard

From: "Steven M. Bellovin" <[email-masked]>
Date: Fri, 04 Jun 1999 22:33:30 -0400

In message <v04205108b37e1714908c@[171.69.199.124]>, Steve Deering writes:
> Very belated comment:
> 
> At 9:30 PM -0400 5/10/99, Steven M. Bellovin wrote:
> >Bump in the wire is fine -- it's AH that's the problem.
> 
> No.  Bump-in-the-wire (or anything else that inserts extension headers
> into IPv6 packets, unknown to the originating upper-layer protocol)
> breaks other things as well as AH, for example fragmentation-avoidance
> through MTU discovery, and the TCP MSS mechanism.

I thought you had said, in a note to me on another topic, that header
insertion was ok as long as the inserted header was removed before it
got to the same protocol layer at the other end.

That notwithstanding, I agree with your basic point.  If you're going to
use a peripheral to insert AH, instead of doing it on-host, you have to
configure your device driver appropriately, and therefore reduce the MTU.
(This suggests that drivers SHOULD allow a delta to their natural MTU, if
any.)  An IPSEC box that handles multiple hosts is using tunnel mode, and
hence encapsulation, in any event.  But perhaps the real question here
is whether or not transport mode is appropriate.
> 
> The safe way to add info to a packet en-route (i.e., anywhere past the
> originating upper-layer protocol) is by encapsulation, not header-insertion.
> 
> If the IPsec specs allow or encourage en-route header-insertion, they
> are incompatible with the rest of the IP architecture (both versions),
> and ought to be fixed.

IPsec says "put a header *here* for transport mode".  It says nothing about
how you implement that; however, much cryptographic gear is done in outboard
units for quite a number of reasons.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Steve Deering <[email-masked]>
Date: Fri, 4 Jun 1999 19:47:10 -0700

>got to the same protocol layer at the other end.

That's true, or more generally, any transformation en-route is permitted
as long as it is undone before delivery, even translation to Swahili.
Note however, that that may have a serious performance impact if, for
example, it causes packets that would otherwise have fit in the path
MTU to now require fragmentation.

The problem with bump-in-the-stack header-insertion is that there is no
way to know that the destination has a corresponding bump that will
remove the inserted header before delivery.
>any.) 

I don't think that's sufficient to deal with the MSS problem.

> An IPSEC box that handles multiple hosts is using tunnel mode, and

It's appropriate when the transport protocol knows it's happening.
It's not appropriate to do without the knowledge of the transport
layer.  Outboard implementation usually implies that the transport
layer will not know it's happening.

(Sorry for re-starting a thread that I won't be able to continue with:
I am departing for a week's mostly-laptop-free vacation early tomorrow
morning.)

Steve