Subject: Re: [mpls] Last Call: <draft-ietf-mpls-in-udp-04.txt> (Encapsulating MPLS in UDP) to Proposed Standard
From: <[email-masked]>
To: <[email-masked]>, <[email-masked]>
Cc: [email-masked], [email-masked]
Date: Tue, 21 Jan 2014 17:56:32 +0000
List-Id: Multi-Protocol Label Switching WG <mpls.ietf.org>

Stewart

the IP header check is not the UDP pseudoheader check - and IPv6 has neither.

If a NAT gets a corrupted header, won't it open up new state and attempt to translate for that header? Remember, this is UDP, not TCP - it's not on an existing connection that must have already been opened by SYN/ACK, where the NAT is more likely to reject it as unknown.

'NATs, which rewrite and can trash headers, demonstrate and validate the integrity of the Internet' is not a good argument imo.

I'd like to see some evidence for '"obscure" IP protocol numbers will get dropped by default at NATs and firewalls.'. IP/GRE is relatively state-free, nothing much to translate at transport there - it's not SCTP. I've spent a couple of years running an ISP, and the 'oh, that protocol won't go through your NAT' has not come up.

Lloyd Wood
http://about.me/lloydwood
________________________________________
From: Stewart Bryant [[email-masked]]
Sent: 21 January 2014 12:29
To: Eggert, Lars
Cc: Wood L  Dr (Electronic Eng); [email-masked]; Joel Jaeggli; [email-masked]
Subject: Re: [mpls] Last Call: <draft-ietf-mpls-in-udp-04.txt> (Encapsulating MPLS in UDP) to Proposed Standard

On 21/01/2014 12:07, Eggert, Lars wrote:
> Hi,
>
> On 2014-1-21, at 12:50, Stewart Bryant <[email-masked]> wrote:
>> In terms of congestion and misdelivery it is interesting looking
>> at the number of horses that are already bounding around
>> in the paddock outside the stable:
>>
>> IP types: 47 (GRE) and 137 (MPLS-in-IP) for example.
> there is a big difference between encapsulation in IP and encapsulation in UDP. Everything encapsulated with "obscure" IP protocol numbers will get dropped by default at NATs and firewalls, whereas UDO traffic happily traverses them. The reach of UDP traffic is much broader.
>
> Lars
So we have established that it's not the load on the NATs and Firewalls
we are worried about.

Seemingly from the above congestion is off the table as well.

Now surely those same NATs and firewalls will be looking for an SA, DA,
Type, SP, DP match
and that is a lot of things that have to be right for a header
corruption misdelivery to get
through.

- Stewart