Re: [Int-area] WGLC on draft-ietf-intarea-frag-fragile-05 (Tom Herbert)

[Fernando Gont <[e-mail]>]

On 16/1/19 16:26, Tom Herbert wrote:
> Ron,
> 
> A stateless firewall that maintains state is no longer a stateless
> firewall. Introducing state requires memory and additional logic that
> are at odds with the goal of cheap low end devices..
> 
> A stateless firewall could just drop the first fragment that contains
> the transport layer header and allow non first fragments to past. This
> achieves the filtering goal to prevent delivery of the reassmbled
> packet. It does mean fragments that can't possibly be reassembled make
> it to the destination. Whether or not that is a mere nuisance or causes
> real problems that creates a DOS vector depends on other factors in
> deployment.

This assumes the node to be firewalled implements RFC8200/RFC5722 -- if
it doesn't, the filtering policy could be circumvented.

You may or may not be able to make such assumption. Where you can't, you
may have to do stateful firewalling.

-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492