Re: [v6ops] new draft: draft-taylor-v6ops-fragdrop

On Oct 17, 2012, at 4:58 PM, C. M. Heard <heard@pobox.com> wrote:

> On Wed, 17 Oct 2012, Warren Kumari wrote:
>> On Oct 16, 2012, at 7:19 PM, "Templin, Fred L" <Fred.L.Templin@boeing.com> wrote:
>>> I have been informed by individuals working for major network 
>>> equipment vendors that their implementations can handle router 
>>> reassembly.
>> 
>> "can handle router reassembly" != "can handle router reassembly at 
>> line rate on multiple interfaces".
>> 
>> You really need this to be line rate on all interfaces, otherwise 
>> there is (obviously) a DoS vector here.  Reassembly at 10G (or 
>> 100G) is distinctly non-trivial and requires A: large buffers, B: 
>> short timeouts, C: gets sad if not all bits go through the same 
>> device, D: state and E: hardware designed specifically for this. 
>> This is much more than packet comes in, packet goes out...
> 
> Excuse me, maybe I'm as dumb as a post, but .... why in the world 
> are participants in this thread posing this as problem for the core?

Er, we are not necessarily talking about problems for the core -- a number of folk have 10G at the "edge" / security boundary of the network, and this is where filtering type decisions happen.

Even if you are not anywhere near approaching line-rate, you need to be sure that the device can manage to do this work *at* line rate.  If you usually only push 1Mbps through your e.g 1Gbps interface, if the device can only of reassembly with small fragments at 100Mbps, you have dropped your DoS ability to 100Mbps.

> 
> Except for packets specifically destined for core infrastructure 
> itself --- and those, surely, are not arriving at line rate 

Yes, and part of the reason that packets are not reaching the core infrastructure at line rate is because operators have the ability to examine traffic destined for the core infrastructure and filter / rate-limit it to something reasonable. I may want to allow e.g traceroute to "core" stuff and toss that in one rate-limit bucket, but never allow SSH towards my core.  If I have fragments I have no way of knowing what they are supposed to be part of, and so, er… 

> -- the 
> core has no reason to do anything other than just pass the fragments 
> on and let edge devices deal with them.

Ah, but these are edge devices….

> 
> Indeed, the draft itself states that "IPv6 datagrams with 
> fragmentation headers are a non-issue in the core of the internet, 
> where fragments are routed just like any other IPv6 datagram.  
> However, fragmentation creates operational ssues at the edge of the 
> network that may lead to administratively imposed filtering or 
> inadvertent failure to deliver the fragment to the application."

Yup.
W
> 
> //cmh
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops
> 

--
"Working the ICANN process is like being nibbled to death by ducks,
it takes forever, it doesn't make sense, and in the end we're still dead in the water." 
    -- Tom Galvin, VeriSign's vice president for government relations.