Re: [Int-area] WG Adoption Call: IP Fragmentation Considered Fragile
Joe Touch <touch@strayalpha.com> Mon, 30 July 2018 18:50 UTC
Return-Path: <touch@strayalpha.com>
X-Original-To: int-area@ietfa.amsl.com
Delivered-To: int-area@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 48009130DF3; Mon, 30 Jul 2018 11:50:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.988
X-Spam-Level:
X-Spam-Status: No, score=-1.988 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=strayalpha.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UjPfZn9j9-US; Mon, 30 Jul 2018 11:50:37 -0700 (PDT)
Received: from server217-3.web-hosting.com (server217-3.web-hosting.com [198.54.115.226]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F8B0130DE9; Mon, 30 Jul 2018 11:50:37 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=strayalpha.com; s=default; h=Message-ID:References:In-Reply-To:Subject:Cc: To:From:Date:Content-Type:MIME-Version:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=LsUMtyhkuHvSMzf1FJQoSb9nKQROtTgQUqzfYGxZffY=; b=q4Ux83YYqBUeSZkohSBWozd/m lW2GJ6czzEQ1bxU0Xcfid7wtaq85tNbJPCNLorJFAtoJoe0KFUye2RBvou0UE1evB872dQx3vlxTR WgHB/W3+ZkgJmoGlSqN/Cc1by05twdCDyCJeMaEpKFlqg73cQuyNY0XR+I5VDh99QxwS/XE7zcsgR BNo+AfPkv+ZDtouLAx2S5vZ59HECbN9UYEzVbyMgvbDk5bKm8HX19iHgbR1+xKQS/fNQXT5W5lkPp 9mFRZcSybB2ArGYRatPdzsXTccUnFWXeywgZcEnX/bfGkidU1aVEW1Jc2mNPbiwFDutsjwRTfc5b1 pO2EqGL7g==;
Received: from [::1] (port=55040 helo=server217.web-hosting.com) by server217.web-hosting.com with esmtpa (Exim 4.91) (envelope-from <touch@strayalpha.com>) id 1fkDFa-002nqC-MC; Mon, 30 Jul 2018 14:50:35 -0400
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="=_f796af4b5c7926ca535c389015f58f39"
Date: Mon, 30 Jul 2018 11:50:34 -0700
From: Joe Touch <touch@strayalpha.com>
To: Tom Herbert <tom@herbertland.com>
Cc: Ole Troan <otroan@employees.org>, "internet-area@ietf.org" <int-area@ietf.org>, intarea-chairs@ietf.org
In-Reply-To: <CALx6S348jLsnHG3gp-mh9d4KJ1bROT3OcVz=XjwVgpv1aSsi_w@mail.gmail.com>
References: <F227637E-B12D-45AA-AD69-74C947409012@ericsson.com> <0466770D-C8CA-49BB-AC10-5805CFDFB165@strayalpha.com> <6EDF0F79-C8F3-4F05-8442-FF55576ADDD0@employees.org> <alpine.DEB.2.20.1807271530280.14354@uplift.swm.pp.se> <CALx6S35LthDLRry7k-pF8KSoX4BXBA8kyArOpDUAcJMDCoLQpQ@mail.gmail.com> <alpine.DEB.2.20.1807280811540.14354@uplift.swm.pp.se> <8640DCF6-A525-4CF7-A89D-2DEDBF0FADC8@strayalpha.com> <FFF1C23B-7A24-46BC-929E-DD56C77D69A2@employees.org> <A248CA44-B568-4CB9-B450-067B1845AF9B@strayalpha.com> <CALx6S36w=5J0-=JQqrX0_PR7254V0HrhJct7oomPKdxSOSU43w@mail.gmail.com> <2872BF43-20AA-4179-9269-9C4FE6F5986B@strayalpha.com> <CALx6S35VidDr1uTGCHeb3Dcc0qF3O8Lz0vvV-XKPfbY057n6XA@mail.gmail.com> <cd34a1e8da6ff4bbf5b20875827d2a09@strayalpha.com> <CALx6S348jLsnHG3gp-mh9d4KJ1bROT3OcVz=XjwVgpv1aSsi_w@mail.gmail.com>
Message-ID: <c271e9501b381c9be6ac1f3a0095a1d9@strayalpha.com>
X-Sender: touch@strayalpha.com
User-Agent: Roundcube Webmail/1.3.3
X-OutGoing-Spam-Status: No, score=-1.0
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server217.web-hosting.com
X-AntiAbuse: Original Domain - ietf.org
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - strayalpha.com
X-Get-Message-Sender-Via: server217.web-hosting.com: authenticated_id: touch@strayalpha.com
X-Authenticated-Sender: server217.web-hosting.com: touch@strayalpha.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-From-Rewrite: unmodified, already matched
Archived-At: <https://mailarchive.ietf.org/arch/msg/int-area/agJxOPSCxcyIsTJzUK9SLfTRvao>
Subject: Re: [Int-area] WG Adoption Call: IP Fragmentation Considered Fragile
X-BeenThere: int-area@ietf.org
X-Mailman-Version: 2.1.27
Precedence: list
List-Id: IETF Internet Area Mailing List <int-area.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/int-area>, <mailto:int-area-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/int-area/>
List-Post: <mailto:int-area@ietf.org>
List-Help: <mailto:int-area-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/int-area>, <mailto:int-area-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 30 Jul 2018 18:50:39 -0000
On 2018-07-30 11:16, Tom Herbert wrote: > On Mon, Jul 30, 2018 at 10:34 AM, Joe Touch <touch@strayalpha.com> wrote: > >> On 2018-07-30 08:11, Tom Herbert wrote: >> >> On Sun, Jul 29, 2018 at 9:22 AM, Joe Touch <touch@strayalpha.com> wrote: >> >> On Jul 29, 2018, at 9:11 AM, Tom Herbert <tom@herbertland.com> wrote: >> >> ... >> >> That said, there's no real problem with a NAT *IF* it acts as a host on the >> Internet >> (see ouch, J: Middlebox Models Compatible with the Internet. USC/ISI >> (ISI-TR-711), 2016.) >> >> Joe, >> >> It's still a problem though. A NAT (or any stateful device in the >> network) forces the requirement in network architecture that all >> packets of a flow are routed through the same device. >> >> I didn't make that requirement. The Internet does - it's what it *means* to >> have an IP address. >> >> It's not a requirement of the Internet and certainly not a core IETF >> requirement that packets always follow the same path. It's an ad hoc >> requirement imposed by _some_ solutions that have been deployed. >> >> 1122 requires that devices shouldn't be sourcing IP addresses they don't >> own. >> >> And any device behind a NAT would have a similar requirement - that the >> private side is setup such that any translation appears as a single device >> -- which means either that each host on the private side forwards all its >> traffic to one egress (as a stub net) or that the multiple egresses >> coordinate state to look like one egress on the private side and one host on >> the public side. >> >> I.e., the Internet architecture imposes exactly the restrictions you note - >> these aren't ad-hoc, they're derived from the Internet requirements. > IP is packet switched not circuit switched. Other than the source and > destination nodes, no two packets sent on a flow are required to > traverse the same nodes, nor does there need to be any symmetry in the > path between two directions of communication. If this is an incorrect > interpretation of the requirements then please reference the RFC that > states otherwise. RFC1122 says that an address belongs to one interface. So if you have a system that treats internet addresses as belonging to more than one device, that's on you to make sure they ACT like one device. You can have a host on the private side use multiple egress NATs for different connections, but the reverse traffic has to treat the two as if they were one device. If putting those devices in the middle of the network means you can't see the traffic to make that happen, then you've deployed the devices incorrectly or insufficiently configured them to act as a single unit. > ... > The mechanism (specifically the requirement that packets traverse > intermediate nodes that are not addressed) breaks multi-homing. All > the hacks and hoops we've had to jump through over the years to make > NAT, stateful firewalls, and L4 load balancers work attest to this > being a real problem. *traversing* intermediate nodes is not an issue. It's changing addresses and ports that is. Once you do either thing, you're a host - ONE logical host for every IP address you do this with. If you deploy a device that intends to act this way that can't see all the traffic it should be receiving - or deploy a device behind it that isn't represented by exactly one such device - then it is your device and/or its deployment that is broken. Oh, and I have no debate that people deploying badly designed devices and/or doing so in incorrect ways is a real problem. It's just not MY problem, nor do I think it should be the IETF's. Joe
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Brian E Carpenter
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Ole Troan
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Ole Troan
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- [Int-area] WG Adoption Call: IP Fragmentation Con… Wassim Haddad
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Black, David
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Templin (US), Fred L
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Brian E Carpenter
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Brian E Carpenter
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Eric Vyncke (evyncke)
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Templin (US), Fred L
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Ron Bonica
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Ron Bonica
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Mikael Abrahamsson
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Mikael Abrahamsson
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Black, David
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Ron Bonica
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Templin (US), Fred L
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Templin (US), Fred L
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Mikael Abrahamsson
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Ole Troan
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Fernando Gont
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Mikael Abrahamsson
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Templin (US), Fred L
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Fernando Gont
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Ole Troan
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Brian E Carpenter
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Ole Troan
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Brian E Carpenter
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Fernando Gont
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Fernando Gont
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Ole Troan
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Brian E Carpenter
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Mikael Abrahamsson
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Ole Troan
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Ole Troan
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Mikael Abrahamsson
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Mikael Abrahamsson
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Ole Troan
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Ole Troan
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Ole Troan
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Mikael Abrahamsson
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Ole Troan
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Mikael Abrahamsson
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Ole Troan
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Ole Troan
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Mikael Abrahamsson
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Ole Troan
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Ole Troan
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Mikael Abrahamsson
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Wassim Haddad
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Toerless Eckert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Mikael Abrahamsson
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joel Jaeggli
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Christian Huitema
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Ole Troan
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Toerless Eckert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Toerless Eckert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Toerless Eckert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Toerless Eckert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Toerless Eckert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Toerless Eckert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Toerless Eckert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Toerless Eckert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Toerless Eckert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Ole Troan
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Ole Troan
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Toerless Eckert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Toerless Eckert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Toerless Eckert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… tom
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Christian Huitema
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Christian Huitema
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Templin (US), Fred L
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Tom Herbert
- Re: [Int-area] WG Adoption Call: IP Fragmentation… Joe Touch