Re: oversized-header-chains: Receipt of illegal first-fragments

Fernando Gont <> Thu, 19 July 2012 13:59 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 13F6721F869E for <>; Thu, 19 Jul 2012 06:59:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id nIgeY0MTzHr3 for <>; Thu, 19 Jul 2012 06:59:38 -0700 (PDT)
Received: from ( [IPv6:2a00:d10:2000:e::3]) by (Postfix) with ESMTP id 27D7F21F869D for <>; Thu, 19 Jul 2012 06:59:38 -0700 (PDT)
Received: from [2001:5c0:1400:a::1a1] by with esmtpsa (TLSv1:CAMELLIA256-SHA:256) (Exim 4.76) (envelope-from <>) id 1SrrHE-0003Bi-N6; Thu, 19 Jul 2012 16:00:24 +0200
Message-ID: <>
Date: Thu, 19 Jul 2012 14:59:47 +0100
From: Fernando Gont <>
Organization: SI6 Networks
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:13.0) Gecko/20120615 Thunderbird/13.0.1
MIME-Version: 1.0
To: "Eric Vyncke (evyncke)" <>
Subject: Re: oversized-header-chains: Receipt of illegal first-fragments
References: <> <>
In-Reply-To: <>
X-Enigmail-Version: 1.4.2
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Cc: "" <>
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "IPv6 Maintenance Working Group \(6man\)" <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 19 Jul 2012 13:59:39 -0000

Hi, Eric,

On 07/19/2012 07:21 AM, Eric Vyncke (evyncke) wrote:
> Two comments: 1) for the transition period (when we could perhaps see
> those packets -- even if I have yet to see one!), 'silently' is
> perhaps too strong, I would suggest at the bare minimum a dropped
> packet counter (else operators would be blind) 

Ok. What about the counter? SHOULD?

> 2) RFC1858 (the IPv4
> equivalent of your I-D) specifies that routers with an ACL must also
> drop those packets and I would think that this should also be the
> case here but with a SHOULD for router implementing layer-4 ACL (not
> for plain forwarding routers or layer-3 ACL)

The caveat here is that it's trivial for a v4 router to figure out
whether the upper layer protocol's header is fragmented, but it may be
not so trivial for a v6 router to do so (i.e., it would require them to
follow the entire IPv6 header chain, which could possibly be a large
number of headers.

That said, I guess that including the aforementioned requirement for
routers, with the granularity you mention ("routers implementing layer-4
ACLs" or some equivalent wording) might work for the wg?

Can others please weigh in?


Best regards,
Fernando Gont
SI6 Networks
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492