Re: [v6ops] new draft: draft-taylor-v6ops-fragdrop

["Templin, Fred L" <[e-mail]>]

> -----Original Message-----
> From: Nick Hilliard [mailto:[e-mail]]
> Sent: Wednesday, October 17, 2012 2:43 PM
> To: Templin, Fred L
> Cc: [e-mail]; [e-mail]
> Subject: Re: [v6ops] new draft: draft-taylor-v6ops-fragdrop
> 
> On 17/10/2012 16:39, Templin, Fred L wrote:
> > You know, all of this discussion is moot. RFC2460, Section 5 says:
> [...]
> > the law until someone writes a different one. Middleboxes therefore
> > have no basis for dropping fragments, unless they can through some
> > means be determined as malicious (e.g., VFR).
> 
> We're all agreed that legitimate fragments should get through.  But there
> is a large body of installed hardware out there in the core of the
> Internet
> which has exactly the following options for dealing with ipv6 fragments:
> 
> > 1. forward them to the RP for software processing, which will cause a
> > management plane DoS
> 
> > 2. drop them unilaterally, implicitly overriding all v6 ACLs, breaking
> > IPv6 fragmentation
> 
> > 3. forward them unilaterally, implicitly overriding all ACLs, opening up
> > an infrastructure DoS vector
> 
> None of these are pleasant options.
> 
> It's not a moot point: it's just a matter of the equipment not matching up
> with the requirements of the RFCs and is a serious practical problem for
> operators which use older equipment.  So how do we deal with it?  Does it
> deserve a mention in the draft, with recommendations on what to do, or
> would it be better to ignore the problem as it's a vendor/device specific
> issue?

In order to correctly observe the standards, core routers have no
option other than to simply forward any IPv6 fragments that are
"just passing through" - regardless of any configurable options
available on certain vendor products.

IPv6 fragmentation and reassembly is an end-to-end function, and
according to the end-to-end principles the function is best
implemented either within the end system or as close to the end
system as possible. The core needs to let the edge devices and
end systems deal with fragments, and even if fragments are passed
all the way through to the end system without prior examination
end systems nowadays have host-based firewalls.

I think we may be over-thinking this. Vendor equipment needs
to observe the standards in order to claim compliance. Broken
equipment should be identified and reported when it does not.

Fred
[e-mail] 
 
> Nick