Re: [Int-area] WG Adoption Call: IP Fragmentation Considered Fragile

[Toerless Eckert <[e-mail]>]

On Sun, Aug 26, 2018 at 03:50:18PM -0700, Joe Touch wrote:
> > Reassmbly/refragment and MTU discovery puts NAT out of the realm of many
> > cost effective HW acceleration methods. Simple address rewrite does not.
> 
> And crumple zones and airbags get in the way of cars running fast and being inexpensive.
> I.e., you???re right - doing NATs properly is more expensive than lying that you have a functioning NAT that doesn???t.

Sometimes it helps designing solutions against what can actually be
achieved instead of wishfull thinking. The way we operate
against expectations on network devices today just creates a lot
of half-baked solutions.

> >> Firewalls are just delusions; [1]
> >> the context they think they???re enforcing has no meaning except at the endpoints; it never did. [2]
> > 
> > I completely agree with [2], but my conclusion is not [1], but
> > rathat its highly valuable and necessary.
> 
> Good. Continue to run them and tell your customers that they actually stop email when they block ports 23 and 110, etc.
> The rest of us then will tunnel one port over another (VPN) and walk right through that device (like we all dll all the time in hotels).

You can always prove the existance of wishfull thinking by
assuming all type of stupid advertisements or misunderstanding of
achievable functionality. But that does not disprove the
existance of useful or necessary functions.

> > The ability of firewalls to open 5-tuple bidirectional pinholes because
> > of trigger traffic from the inside is IMHO the most important feature
> > to keep Internet hosts protected.
> 
> A firewall hsa to be close enough to the endpoint to act as its proxy; at that point, provided it does act as its proxy, then that sort of 5-tuple filtering works fine. You???re offloading work of the host elsewhere - but that firewall needs to act as a true host proxy, which includes reassembly, or it won???t work properly (nor can it ever).

If a host stack should do fragementation (as IPv6 mandates now).
If we think fragmentation is only something that needs to happen
for tunneling within the network stack then maybe not so much.

If i wouldn't have to worry about such proxy forwarding plane capabilities,
i definitely would prefer models like SOCKS. If i have to think about them
it becomes certainly difficult to even model this well.

> > I wish host stacks would be built securely,
> > but after a few decdaces i have given up on that for most hosts. Which is
> > why its so irritating when host stack pundits continue telling network device
> > stack builders what they should and should not do.
> 
> No argument there - but again, pushing the work of that host to another device MAKES THAT DEVICE A HOST.

Can i re-apply your argument about fragmentation: 

You said something like IP can not be self-sufficient enough if
it wouldn't support fragmentation because then you would have
to rely too much on the higher layers.

Your claim of requiring NAT to be hosts is because we do not permit
IP to be self-sufficient for address translation between different
domains. Aka: yes, logically today, NAT need to go up to
transport layer, which is bad. See Christians suggestion.

> Hosts receiving packets reassemble. Period. Or they won???t work. Period. And those that don???t, don???t work.

Hosts must have transport layer. Transport layer can do PLMTUD/transport layer
segmentation. No need for hosts to do IP layer fragementation.

> > Firewalls inspecting unencrypted higher layer message elements where a fairly
> > well working security model based on having a separate security administration
> > from the application administration.
> 
> No better, FWIW, than would be managed software inside the end system. There???s no strict rule these need to be separate devices, but - as per above - they work fine when they act as they actually need to.

Microsoft provides some good enterprise system management to
separate application security management from application management
itself, but i am pretty sure there is no chance in hell to expand
that model across all type of hosts in a standardized fashion.
Hence its certainly very viable to figure out what the best is we
can do with firewall and other seucurity techniques on
"proxy" devices. See also MUD and the like.

> > Now the applications promise to
> > provide all the security themselves, but they primarily just prohibit visibility
> > of what they do, so its a lot harder to figure out when they are insecure.
> > 
> > Would you ever put all type of in-home "iot" gear thats not a Windows/MacOS
> > system with a GUI you can control on the Internet without a firewall ?
> 
> Without firewall functions somewhere? No - I agree. But I also wouldn???t put that firewall inside the network where it couldn???t see the fragments to reassemble - because it will never work properly.

Which circles us back to me questioning the need for fragement at
the IP layer (as opposed transport layer) in hosts that MUST have transport stack. vs. some
other type of devices that do e.g. not have transport stacks but want
to do tunneling IP in IP tunneling.

> I.e., I agree that ???it hurts when we do that???, but not that we have to do it the wrong way (even though it???s cheaper).

Cheers
    Toerless

> 
> Joe

-- 
---
[e-mail]