Subject: [OPSEC] on adoption of draft-gont-opsec-ip-options-filtering

From: Joe Abley <[email-masked]>
Date: Wed, 11 May 2011 09:22:11 -0400

Hi all,

Fernando Gont has asked Warren and I whether this working group is amenable to adopting draft-gont-opsec-ip-options-filtering as a wg document.

 http://tools.ietf.org/html/draft-gont-opsec-ip-options-filtering-01

Please send comments to this list in the next week (before 18 May 2011). Please include some kind of indication of whether you are in favour of adoption, and indicate whether you might be interested in working on the document as a contributor or reviewer.

Thanks,

Joe & Warren

---

From: "Carlos Pignataro (cpignata)" <[email-masked]>
Date: Thu, 12 May 2011 22:38:37 -0400

Hi Joe,

I think that the problem space of IP Optioned packet treatment is most definitely worth investing WG time, and I support that. However, I am not quite sure that this I-D is vectored in the right direction to be an initial basis for that work, or it contains some foundational gaps. At least, I have a set of questions and observations.

I was meaning to send a review in response to Fernando's earlier message on list, I will try to do that sooner and definitely before the 18th.

I am interested in working on the/a document about ip-options-filtering as a contributor.

Carlos P.

On May 11, 2011, at 9:23 AM, "Joe Abley" <[email-masked]> wrote:

> _______________________________________________
> OPSEC mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsec
>

---

From: Florian Weimer <[email-masked]>
Date: Sat, 14 May 2011 15:34:40 +0200

* Carlos Pignataro:

> I think that the problem space of IP Optioned packet treatment is
> most definitely worth investing WG time, and I support that.

I agree.

I suspect that considering what is deployed today, Internet endpoints
must assume that packets carrying IP Options are either forwarded as
if the options were not present, or dropped.  This is independent of
the option type.  Options may work on some networks, but operators
will undoubtly switch off option processing by any feasible means if
the need arises.  I suspect that this could happen in the core, too,
and applications relying on IP options would then be screwed.  (Just
as multicast applications were screwed when one large operator
switched off multicast support when it threatened to impact unicast
service a couple of years ago.)