Subject: Correct middlebox behavior

From: "Fleischman, Eric" <[email-masked]>
Date: Wed, 28 Sep 2005 15:50:02 -0700

Friends,

I believe that Keith's first paragraph below is widely accepted by the
IETF. However, after re-reading RFC 3234, RFC 3303, and others I did not
find any text within any RFC to explain our consensus opinion concerning
correct middlebox behavior to be used to guide those outside of our
community. Specifically, can anyone point me to text within any RFC that
states the ideas contained within Keith's first paragraph below?

--Eric

-----Original Message-----
From: Keith Moore [mailto:[email-masked]] 
Subject: Re: Question about the normative nature of IETF RFCs

>Most protocols weren't designed to operate with middleboxes. 
>In the absence of a provision in a protocol specification for 
>a middlebox, any middlebox that interferes with the 
>interoperation of a protocol is inherently violating the 
>protocol standards.

>In general, protocol specifications don't (and shouldn't)
> try to explicitly enumerate "don't do X" for every possible 
>"X" that is harmful.  And middleboxes are generally harmful.

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Ned Freed <[email-masked]>
Date: Wed, 28 Sep 2005 16:04:43 -0700 (PDT)

> states the ideas contained within Keith's first paragraph below?

How about RFC 2979 section 3? It's specific to firewalls but of course
the concept generalizes to other sorts of middleboxes.

				Ned

---

From: Melinda Shore <[email-masked]>
Date: Thu, 29 Sep 2005 08:32:13 -0400

On 9/28/05 6:50 PM, "Fleischman, Eric" <[email-masked]> wrote:
> community.

Well, there is no IETF consensus on correct middlebox behavior.
The behave working group is putting together documents that
I think are probably pretty close to what you're asking for.
RFC 3424 describes IAB concerns about some NAT workaround
techniques but in that case the burden is on the workaround,
not the middlebox.

Melinda

---

From: Joe Touch <[email-masked]>
Date: Thu, 29 Sep 2005 11:14:40 -0700

This doesn't cover all of what middleboxes do, but the part about them
faking responses (e.g., to splice connections), hijacking, or NATing are
covered in RFC1122 sec 3.2.1.3:

            When a host sends any datagram, the IP source address MUST
            be one of its own IP addresses (but not a broadcast or
            multicast address).

I don't see anything in 1812 that prohibits routers from modifying the
contents of an IP datagram, but the term 'forwarding' never permits
modification of the IP payload either.

Joe