Re: FWD:: Re: [e2e] Re: Question on "identification" field of IP

[Alan Cox <[e-mail]>]

On Fri, 2002-12-27 at 22:22, Mark Allman wrote:
> The most common scenario in my experience is VPN boxes not 
> copying DF when they encapsulate a TCP packet into an IPSEC header.

There are reasons for doing this. Given an ICMP must fragment response
to an IPSEC frame how do you prove the ICMP frame is valid. DF and IPSEC
don't mix. When you mix them via a magic box in the middle its even
worse because the ICMP may be hostile and the man in the middle box is
hard pushed to tell. Certainly it would have to keep state and handle
rate filtering and issue its own equivalent 'vetted' icmp frames.

> The worst part is that many IPSEC implementations drop ICMPs
> for security reasons when they don't contain the full
> original packet, because it is impossible to authenticate
> it otherwise (and they would be vunerable to a DoS of 
> an attacker forcing an unusable small MTU on them with
> forged ICMPs).

It happens unfortunately. Several years ago people were trying to drop
BGP peering sessions down to 68 byte frames (which really messes things
up).


Rock and a hard place..IPv6 makes it even more fun