Re: [v6ops] new draft: draft-taylor-v6ops-fragdrop

[Nick Hilliard <[e-mail]>]

On 17/10/2012 00:19, Templin, Fred L wrote:
> Filtering near the edges is where we have stateful filters that
> are good at managing state. "Stateless" filtering near the middle
> has no choice but to pass the fragments always.

I understand, but this opens up an implicit DoS vector if you use iACLs on
your dumb/fast transit boxes to filter out external ipv6 traffic to core
infrastructure, because you will be forced to explicitly allow fragments.

> IPv6 nodes are required to reassemble at least 1500 bytes in
> any event. That is for packets explicitly addressed to the node,
> but also consider (temporary) fragment matching for packets
> passing through the node, e.g. as done by VRF. Plus, when the
> router gets a fragment, chances are very good that its brethren
> are hot on its heels and will arrive or not very quickly. So,
> its not a case of holding onto gobs of fragments indefinitely
> and can be managed by reasonably good hardware. At least, I
> have been informed by individuals working for major network
> equipment vendors that their implementations can handle router
> reassembly.

I'll believe this when I see it.  Not saying that this isn't the case, but
in all networking equipment I've ever dealt with, whenever I've heard about
statements like this, the list of caveats is a long as your arm.

> Dropping fragments violates the end-to end principles, and negates
> path MTU diversity. 1280 is too small of a size for us to lock into
> "the matrix" once and for always.

I agree.  All I'm saying is that most core infrastructure on the internet
does not have clever enough silicon to handle anything other than
fixed-format packet structures, and if we expect it to make sensible
decisions on TLV based packet header decoding, we're fooling ourselves.
This problem may be fixed in future if we move from dumb ASICs to smarter
silicon, but there will be a substantial core network upgrade cost
associated with this, and it will take many years to deal with.  In the
interim, operators will need to choose between passing fragments (i.e.
allowing core infrastructure DoS vectors) or dropping fragments (i.e.
breaking ipv6 in the general case).  Neither option is good.


Nick