Re: [Int-area] WG Adoption Call: IP Fragmentation Considered Fragile

tom <> Wed, 29 August 2018 16:53 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id A80BF130E91 for <>; Wed, 29 Aug 2018 09:53:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.91
X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01] autolearn=unavailable autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id oinlLty9VKFK for <>; Wed, 29 Aug 2018 09:53:54 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:400d:c09::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id E109A130DFD for <>; Wed, 29 Aug 2018 09:53:52 -0700 (PDT)
Received: by with SMTP id b19-v6so3804315qkc.6 for <>; Wed, 29 Aug 2018 09:53:52 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=pRA17iiZHYJACwliFJjeS/3gSSJcqWSrNLkmujQTY7U=; b=MVEndb8ArHA5vq5g2J1jP1VpSQZyEOEE7qKWANcR5w7owxXWkbx+vA0rWDt6H/rdoW kyh771bjrI8Y6Ki6jTdLfUGhm73JCoQwgwOskeE6mZQucRWU77Vpx6KBQws6kNK2ZN54 d5BtQi62sQGq7PiH/K4hSuMbMioGJRRzmXRJ7lIZZ5LoQC8+CKIt4sdc38D2o2Cpe6Lw /Xkw1KuuKz8CrR9OGDYBUgaM0W6OaIUV2hPGc3HWcOrsG5qGTDS03S1vQOk9FmjpCtwH nbqzcTvao/soNJI0i0W69c3WlRA4D0Y/j5hPec+yZcnoQlHBbP18DAX7IVasUYKHEp7y X0YQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=pRA17iiZHYJACwliFJjeS/3gSSJcqWSrNLkmujQTY7U=; b=MCo67qKyAwOYq4haJI/6yCv6bfvAPtojt0uOs8gJ+D9eHgFoYtMuNBMRkKHDKp424o dDzlpedvWJCWlGn/JaRoOyd5S+qetPhrrLGe3LWW1gzrCtk2Xr6j97Zm3ppYBC9n1Ear fZ3zRa2CinmS84tl2yT2i2Fgg0vDGq2o8xaUhAAwCDNrdJlUKkIpM4R2gtv5qHza48+s Y46xs14bpi0eTD7GI/JsBUpLdZK/grxe9rlHA2WExIUxcWWHWl3MXfuv4UuW++R4Fe3R cXzH5ZFyqDtDue0gp4i+mQuiKpgKWGdI1M2WHY/KixHkVlARMbihjZ/5Jw4n5yot+8TU qd7g==
X-Gm-Message-State: APzg51C5FMxxHg09piH5HJDyGYdOb2C4Xrm2quCZ4ldktOyZhoPxSH8U CgnjVLIqgOdtCwYbYbUFHmPoYB6xjGppZawLG+Pg7Q==
X-Google-Smtp-Source: ANB0VdbtN7fqbw+xkIjxb5016YYBs7/Qapx5sEF/NWbcM1xCqkyuI4X6+4Ch8w+nm7Rf6OfL8ezBxTz7piQ7XeRfGD8=
X-Received: by 2002:a37:168e:: with SMTP id 14-v6mr7262382qkw.168.1535561631925; Wed, 29 Aug 2018 09:53:51 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:ac8:3312:0:0:0:0:0 with HTTP; Wed, 29 Aug 2018 09:53:50 -0700 (PDT)
In-Reply-To: <>
References: <> <> <> <> <> <> <> <> <> <> <> <>
From: tom <>
Date: Wed, 29 Aug 2018 09:53:50 -0700
Message-ID: <>
To: Joe Touch <>
Cc: Toerless Eckert <>, Christian Huitema <>, int-area <>,
Content-Type: text/plain; charset="UTF-8"
Archived-At: <>
Subject: Re: [Int-area] WG Adoption Call: IP Fragmentation Considered Fragile
X-Mailman-Version: 2.1.27
Precedence: list
List-Id: IETF Internet Area Mailing List <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 29 Aug 2018 16:53:56 -0000

On Wed, Aug 29, 2018 at 8:11 AM, Joe Touch <> wrote:
> On 2018-08-28 17:24, Toerless Eckert wrote:
> ...Sure, i meant to imply that port-numbers are useful pragmatically,
> but other context identifiers would long term be better.
> Demux-Identifiers at the granualarity of a subscriber or
> application wold be a lot more scalable than flow identifiers.
> There are many problems with this issue.
> First, the reason that port numbers would be needed is that they are
> *currently* how NATs demux, firewalls enforce policy, and routers manage

There is no requirement in IP that all packets have a transport layer
header that with port numbers. In fact, there are several that don't
have them like IPsec, fragmented packets, or ICMP. Firewalls that drop
anything but UDP and TCP are doing nothing more that ossifying the
Internet. Besides that, there are now better alternatives anyway.
Reassembly for NAT doesn't require any knowledge or port numbers or
even what the transport protocol is. Routers can now use the IPv6 flow
label instead of expensive DPI to get transport ports for ECMP as all
major OSes now set non-zero flow labels.

> flows. For each of these, a different identifier could be developed, but
> they would not then reduce the need for ALL of these at the IP level at some
> boxes. E.g., see draft-touch-tcpm-sno
> Ultimately, we have to admit that a device that acts on behalf of a host IS
> a host and costs what a host costs.

That in turn breaks the the end-to-end model. Middleboxes that attempt
to participate transport protocols, like a host, inevitably break
things and hence is another source of ossification. This is readily
evident apparent in that they can't participate in end-to-end crypto.
Of course they have tried to insert themselves into that realm, but
then we get abominations such as the forced MITM attacks of SSL
inspection. IMO, real end-to-end security is a core requirement that
outweighs any tradeoffs we might make for the security benefits of

> We can't keep believing there is magic dust that can establish a solution
> otherwise.
As they say, the answer to ossification is encryption. It does a long
way to at least force the issue. First TLS negated payload inspection
at middelboxes. QUIC's encryption of transport layer header
subsequently negated intermediate devices ability to peruse the
transport layer. But, crypto isn't magic dust either. There is only so
much of the packet we can encrypt, and a host at its discretion MAY
want to share to share transport layer information in the network to
get better service. So we need to keep working on solutions.


> Joe