Re: [Int-area] WG Adoption Call: IP Fragmentation Considered Fragile

[Ole Troan <[e-mail]>]

Joe,

>> However much money you throw at it, you can't reassemble fragments travelling on different paths, nor can you trivially make network layer reassembly not be an attack vector on those boxes.
> 
> Agreed, but here’s the other point:
> 
> 	Any device that inspects L4 content can do so ONLY as a proxy for the destination endpoint.
> 
> I.e., I know vendors WANT to sell devices they say can be deployed anywhere in the network, and operators believe that, but it’s wrong.
> 
> Basically, if you’re not at a place in the network where you represent that endpoint, you have no business acting as that endpoint - “full stop”.

I understand you want it to fit in your model, but it doesn't.
Take A+P (RFC6346), and it's instantiations through e.g. MAP-E (RFC7597). That's essentially normal longest match forwarding on addresses and ports.

With regards to your point about reassembly at higher layers, crypto is the answer to that.

Ole