Re: [v6ops] new draft: draft-taylor-v6ops-fragdrop

[Lorenzo Colitti <[e-mail]>]

On Thu, Nov 1, 2012 at 5:56 AM, Joe Touch <[e-mail]> wrote:

> I'm wondering whether routers that drop fragments do so only when that's
> the first option, or do they just drop packets with *any* options?
>

Routers just do what operators configure them to do.

Operators who want to have their routers do things like:

- Attack (e.g., SYN flood) rate-limiting
- Stateless ACL processing for security purposes
- QoS classification
- ... and so on

configure their routers to look at upper-layer headers. If the routers
cannot parse the extension header chain but only look at the next header
value in the IPv6 header, then the operators have a choice:

1. Give up the above functionality.
2. Drop all packets with extension headers.

It's not just the fragment header, it's all extension headers. The fragment
header is just the most important one.

In general: I'm not an expert, but I think the situation where processing
an IPv6 packet may require 8 or 10 lookups, arbitrarily spaced within a
1500-byte packet, is not easy to implement in hardware. It doesn't work on
today's architectures, and I suspect supporting it might increase the cost
of forwarding hardware

Supporting extension header chain parsing at anything other than wire speed
exposes operators to a resource exhaustion attacks where attackers can
increase load on routers (e.g., force packets to be software switched)
simply by sending legitimate packets with lots of extension headers. So
really it's not practical to say that you can simply provision / build for
partial load since "packets with lots of extension headers are rare".