Re: [tsvwg] Way forward for UDP option FRAGs with limited router hardwara

[Joe Touch <[e-mail]>]

> On Apr 12, 2022, at 9:18 AM, C. M. Heard <[e-mail]> wrote:
> 
> 2.) There is a concern that packets with UDP trailers -- i.e., where
> the IP Payload Length exceeds the UDP Length -- will be filtered in
> intermediate systems. If I understand correctly, this is the concern
> (or at least one of the concerns) that Christian Huitema has raised.

Right but:

- stripping UDP trailers provides no unique protection vs stripping IP options. Ie, if you think this is an issue, neither is reliable.

- UDP options are the only proposed way that allows fragments to pass through firewalls without flowID state (which is another covert channel, BTW). This *increases* traversal of devices, which should be balanced with concerns of it being stripped. 

- UDP options CAN always be stripped; we’re designing with the assumption that this is what legacy endpoints would do anyway. So users need to verify capabilities they rely upon. This is better than IP option use, which doesn’t tend to force users to make that assumption and check. 

The better way to think of this draft - and, for that matter, the TCP header extensions in TCPM, is “if you want this, here’s a way it can possibly work”. Nobody is being required to implement either extension. That means they’re both a lot more legacy friendly than most other changes to these essential protocols.  

Joe