Re: A problem with RFC 6465's Uniform Format for Extension Headers

[Brian E Carpenter <[e-mail]>]

On 07/02/2014 01:21, Thomas Narten wrote:
> At Wed, 05 Feb 2014 01:25:03 -0300, Fernando Gont wrote:
>> 1) If this problem remains un-addressed, then it's impossible to
>> differentiate between new upper-layer headers (e.g. a new transport
>> protocol) and new extension headers. Since such new extension headers
>> might be leveraged for malicious purposes, the end-result is that
>> middle-boxes are going to block *everything* (see RFC7045), which means:
>>
>>   + no new extension headers
>>   + no new transport protocols
>>
>> ... so I think we really don't want to go there.
> 
> But we are already there. Folk won't deploy anything other than
> TCP/UDP because NAT won't deal with it. That has already been reality
> and is the reason that other or new transport protocols appear to be
> virtually undeployable today.
> 
> Reality is that existing middleboxes tend to process what they
> understand and have been explicitely coded to deal with. They just
> punt on anything else because that is the easiest/safest thing to do.
> 
> I see little that we can do to change that.

I think we still have a chance with IPv6; of course the game is
over for IPv4. That's why I worked on RFC 7045, and why I think
it's worth trying to knock off this problem too. The current situation
described in Fernando's draft is guaranteed to produce opaque
middleboxes; we can at least make it possible to do better.

    Brian