Re: [v6ops] new draft: draft-taylor-v6ops-fragdrop

[Nick Hilliard <[e-mail]>]

On 17/10/2012 16:39, Templin, Fred L wrote:
> You know, all of this discussion is moot. RFC2460, Section 5 says:
[...]
> the law until someone writes a different one. Middleboxes therefore
> have no basis for dropping fragments, unless they can through some
> means be determined as malicious (e.g., VFR).

We're all agreed that legitimate fragments should get through.  But there
is a large body of installed hardware out there in the core of the Internet
which has exactly the following options for dealing with ipv6 fragments:

> 1. forward them to the RP for software processing, which will cause a
> management plane DoS

> 2. drop them unilaterally, implicitly overriding all v6 ACLs, breaking
> IPv6 fragmentation

> 3. forward them unilaterally, implicitly overriding all ACLs, opening up
> an infrastructure DoS vector

None of these are pleasant options.

It's not a moot point: it's just a matter of the equipment not matching up
with the requirements of the RFCs and is a serious practical problem for
operators which use older equipment.  So how do we deal with it?  Does it
deserve a mention in the draft, with recommendations on what to do, or
would it be better to ignore the problem as it's a vendor/device specific
issue?

Nick