Re: oversized-header-chains: Receipt of illegal first-fragments

Fernando Gont <fgont@si6networks.com> Thu, 19 July 2012 13:59 UTC

Return-Path: <fgont@si6networks.com>
X-Original-To: ipv6@ietfa.amsl.com
Delivered-To: ipv6@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 13F6721F869E for <ipv6@ietfa.amsl.com>; Thu, 19 Jul 2012 06:59:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level:
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nIgeY0MTzHr3 for <ipv6@ietfa.amsl.com>; Thu, 19 Jul 2012 06:59:38 -0700 (PDT)
Received: from web01.jbserver.net (web01.jbserver.net [IPv6:2a00:d10:2000:e::3]) by ietfa.amsl.com (Postfix) with ESMTP id 27D7F21F869D for <ipv6@ietf.org>; Thu, 19 Jul 2012 06:59:38 -0700 (PDT)
Received: from [2001:5c0:1400:a::1a1] by web01.jbserver.net with esmtpsa (TLSv1:CAMELLIA256-SHA:256) (Exim 4.76) (envelope-from <fgont@si6networks.com>) id 1SrrHE-0003Bi-N6; Thu, 19 Jul 2012 16:00:24 +0200
Message-ID: <500812D3.3090000@si6networks.com>
Date: Thu, 19 Jul 2012 14:59:47 +0100
From: Fernando Gont <fgont@si6networks.com>
Organization: SI6 Networks
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:13.0) Gecko/20120615 Thunderbird/13.0.1
MIME-Version: 1.0
To: "Eric Vyncke (evyncke)" <evyncke@cisco.com>
Subject: Re: oversized-header-chains: Receipt of illegal first-fragments
References: <50071E54.30708@si6networks.com> <97EB7536A2B2C549846804BBF3FD47E10519F4@xmb-aln-x02.cisco.com>
In-Reply-To: <97EB7536A2B2C549846804BBF3FD47E10519F4@xmb-aln-x02.cisco.com>
X-Enigmail-Version: 1.4.2
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Cc: "ipv6@ietf.org" <ipv6@ietf.org>
X-BeenThere: ipv6@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "IPv6 Maintenance Working Group \(6man\)" <ipv6.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipv6>, <mailto:ipv6-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ipv6>
List-Post: <mailto:ipv6@ietf.org>
List-Help: <mailto:ipv6-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipv6>, <mailto:ipv6-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 19 Jul 2012 13:59:39 -0000

Hi, Eric,

On 07/19/2012 07:21 AM, Eric Vyncke (evyncke) wrote:
> Two comments: 1) for the transition period (when we could perhaps see
> those packets -- even if I have yet to see one!), 'silently' is
> perhaps too strong, I would suggest at the bare minimum a dropped
> packet counter (else operators would be blind) 

Ok. What about the counter? SHOULD?


> 2) RFC1858 (the IPv4
> equivalent of your I-D) specifies that routers with an ACL must also
> drop those packets and I would think that this should also be the
> case here but with a SHOULD for router implementing layer-4 ACL (not
> for plain forwarding routers or layer-3 ACL)

The caveat here is that it's trivial for a v4 router to figure out
whether the upper layer protocol's header is fragmented, but it may be
not so trivial for a v6 router to do so (i.e., it would require them to
follow the entire IPv6 header chain, which could possibly be a large
number of headers.

That said, I guess that including the aforementioned requirement for
routers, with the granularity you mention ("routers implementing layer-4
ACLs" or some equivalent wording) might work for the wg?

Can others please weigh in?

Thanks!

Best regards,
-- 
Fernando Gont
SI6 Networks
e-mail: fgont@si6networks.com
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492