Re: A problem with RFC 6465's Uniform Format for Extension Headers

[Brian E Carpenter <[e-mail]>]

On 11/02/2014 02:54, RJ Atkinson wrote:
> At Thursday, 6th February 2014 07:21:49 -0500, Thomas Narten wrote:
>> At Wed, 05 Feb 2014 01:25:03 -0300, Fernando Gont wrote:
>>> 1) If this problem remains un-addressed, then it's impossible to
>>> differentiate between new upper-layer headers (e.g. a new transport
>>> protocol) and new extension headers. Since such new extension headers
>>> might be leveraged for malicious purposes, the end-result is that
>>> middle-boxes are going to block *everything* (see RFC7045),
>>> which means:
>>>
>>>   + no new extension headers
>>>   + no new transport protocols
>>>
>>> ... so I think we really don't want to go there.
>> But we are already there. Folk won't deploy anything other than
>> TCP/UDP because NAT won't deal with it. That has already been reality
>> and is the reason that other or new transport protocols appear to be
>> virtually undeployable today.
>>
>> Reality is that existing middleboxes tend to process what they
>> understand and have been explicitely coded to deal with. They just
>> punt on anything else because that is the easiest/safest thing to do.
>>
>> I see little that we can do to change that.
>>
>> Thomas
> 
> I agree with Thomas Narten's analysis.  
> 
> The deployed situation perhaps isn't ideal, but the IETF ought to  
> hew to the deployed reality.  Today's reality is that the Internet 
> is very unlikely to deploy any new transport protocol(s) or any new 
> IPv6 extension headers.  My own preference (has been and) would be 
> to outright ban all new IPv6 Extension Headers -- insisting that 
> future IPv6 extensions be specified as options within the existing 
> Destination Options header or Hop-by-Hop Options header.

Not to dispute the facts of life as Thomas and Ran present them,
but let me point out that this argument recurses. If we forbid
additional Extension Headers (i.e. freeze things as they are listed
in RFC 7045) but allow new Options, in a few years somebody will
write

   Today's reality is that the Internet is very unlikely to deploy
   any new IPv6 Destination Options, because firewalls block
   unknown options.

Guess what? This argument has been used against new IPv4 options
since 1994 to my personal knowledge.

(Hop-by-hop options are pretty much a dead duck anyway.)

Just saying...

   Brian