Subject: RE: scope-exceeded and routing headers

From: Brian Zill <[email-masked]>
Date: Wed, 26 Jan 2000 12:00:14 -0800

This was actually discussed (somewhere) not too long ago when I asked more
or less the same question.  The consensus seemed to be:

1) Scoped addresses in routing headers are allowed to leave their scope.
Routers are not expected to run through all the hops in a router header to
perform scope verification.  Senders are assumed to know what they are
doing.

2) Believing that scoped addresses provide some sort of quasi-security
guarantees about where a given packet comes from is a bad idea.  People
should use real security if they want real security.

And while I don't recall whether it was discussed at the same time or not, I
believe that it has never been the case that receivers of packets arriving
via routing headers could/should assume that they could reply without using
a reversed routing header of some sort.  But I could be wrong about that.

--Brian

> -----Original Message-----
> From: Richard Draves [mailto:[email-masked]]
> Sent: Wednesday, January 26, 2000 11:19
> To: IPng List
> Subject: scope-exceeded and routing headers
> 
> 
> The ICMPv6 draft defines a new destination unreachable code point for
> scope-exceeded errors, when forwarding a packet would cause 
> it to leave the
> scope of the source address.
> 
> Does this same error situation apply to routing header processing?
> 
> It seems like allowing a routing header to carry a packet beyond the
> source's scope might be useful in some situations, and if the 
> sender is
> going to the trouble of specifying a routing header then 
> presumably they
> know what they are doing. On the other hand, this could easily violate
> assumptions that receivers make about the source address in 
> packets they
> receive. (Like being able to reply without using a reversed 
> routing header,
> or pseudo-security assumptions.)
> 
> Thanks,
> Rich
> --------------------------------------------------------------------
> IETF IPng Working Group Mailing List
> IPng Home Page:                      http://playground.sun.com/ipng
> FTP archive:                      ftp://playground.sun.com/pub/ipng
> Direct all administrative requests to [email-masked]
> --------------------------------------------------------------------
> 
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: [email-masked]
Date: Thu, 27 Jan 2000 10:29:43 +0900

>should use real security if they want real security.

	That depends on what is meant by "leave the scope".  Could you give
	me more concrete example?

	My take was that, you can't leave scope boundary because routes cannot
	forward them.  This is because there's no indication of "zones"
	(or scope-id) in the routing header.  When router interprets routing
	header, it needs to find the outgoing interface (or zone), and the
	only hint it has is the incoming interface.

	For example, to forward this packet:
		src = link-local
		dst = link-local (= router)
		rthdr = link-local (to where fourter forwards it)
	router needs to guess which interface it should be forwarded.
	possible solutions I can think of is
	- forbidden
	- forward to the node on the incoming interface, hence you are not
	  leaving the scope

	This goes the same with:
		src = link-local
		dst = link-local (= router)
		rthdr = site-local (to where fourter forwards it)
	since if the router is on site boundary, it can't be forwarded.

	We may be able to set an exception when we set global address
	in the routing header.
		src = link-local
		dst = link-local (= router)
		rthdr = global (where router forwards it)
	In this case, it can reach the final destination (because there's only
	single global address space), however, reverse path is not available.

itojun