Re: [v6ops] new draft: draft-taylor-v6ops-fragdrop

[Brian E Carpenter <[e-mail]>]

On 01/11/2012 11:16, Ole Trøan wrote:
>>>>> Yes, but the whole point of the IPv6 option architecture was to avoid
>>>>> the issues seen with IPv4 options.
>>>> The only thing in that IPv6 would avoid is requiring routers to parse
>>>> *all* options, just to find the ones that need to be processed by
>>>> routers.
>>> Yes.
>> No. The only extension header that *needs* to be parsed by intermediate
>> routers is the hop-by-hop options header, and that is the first one (if
>> present).
>>
>> (You can legitimately argue that the hbh header and the routing header
>> are effectively useless, but that doesn't break fundamental connectivity.)
>>
>> IPv6 routers should have nothing to do with fragmentation.
>>
>> The problem is due to middleboxes that break the IPv6 spec by inspecting
>> any part of the packet beyond the hop-by-hop header and discarding what
>> they don't understand.
> 
> 
> quite.
> what stops these boxes from filtering IPsec, TLS, or anything that isn't HTTP with a
> whitewashed URL?
> 
> I don't see how we can build protocols to accommodate middle boxes, and
> we have already done RFC3514.

We can't; it's an arms race, because however we try to hide the good stuff,
those boxes will eventually be "improved" to find it.

All we can do is understand and document the harm.

    Brian