Subject: scope-exceeded and routing headers

From: Richard Draves <[email-masked]>
Date: Wed, 26 Jan 2000 11:19:02 -0800

The ICMPv6 draft defines a new destination unreachable code point for
scope-exceeded errors, when forwarding a packet would cause it to leave the
scope of the source address.

Does this same error situation apply to routing header processing?

It seems like allowing a routing header to carry a packet beyond the
source's scope might be useful in some situations, and if the sender is
going to the trouble of specifying a routing header then presumably they
know what they are doing. On the other hand, this could easily violate
assumptions that receivers make about the source address in packets they
receive. (Like being able to reply without using a reversed routing header,
or pseudo-security assumptions.)

Thanks,
Rich
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Jim Bound <[email-masked]>
Date: Wed, 26 Jan 2000 22:11:07 -0500

>scope of the source address.

This is a prudent dst unreach principle architecturally with the IPv6
addressing model.

>Does this same error situation apply to routing header processing?

Absolutely.

>or pseudo-security assumptions.)

If a packet is to exceed the source's scope thru forward operation that
is simple illegal to me in IPv6.  Its black and white and not gray.

/jim

---

From: Erik Nordmark <[email-masked]>
Date: Thu, 27 Jan 2000 13:24:22 -0800 (PST)

> Does this same error situation apply to routing header processing?

The site-prefixes draft makes the assumption that it is ok to send
a packet with a global source, global destination, and a 1 element source
route which contains the site-local address of the destination node.
This is to handle Mobile IPv6 nodes that leave their site but are communicating
using site-local addresses. (There is also a Home Address option in the packets
containing the site-local address of the sender.)

Assuming we want to support this we don't want to check all elements of the
source route when leaving a site.
But when forwarding a packet (with or without a routing header) we should
always check the source IP address.

Exactly what case where you asking about?
The source address being out of scope or the addresses in the routing header
being out of scope?

   Erik

---

From: Francis Dupont <[email-masked]>
Date: Thu, 27 Jan 2000 22:32:37 +0100

In your previous mail you wrote:

=> I share Jim's position about this issue.

   
=> there is no rationate for scope-exceeded errors but for me the idea
is to avoid the forwarding of packets which can't be returned to the
source if something is going wrong down on the path.
For source routed packets this is weaker than the "no reverse path"
condition, I think in such cases a "SHOULD NOT" is enough
(for scope-exceeded errors, I believe the statement is "MUST NOT
be forwarded").

   Absolutely.
   
=> I agree! I'll refuse any proposal to look at inside routing headers
for any routers (only intermediate routers, ie. routers in the source
route, should deal with routing headers).

   
=> I agree, scope-exceeded errors just add a (useful) check in
the forwarding code.

Regards

[email-masked]