Re: [v6ops] new draft: draft-taylor-v6ops-fragdrop

[Philipp Kern <[e-mail]>]

On Thu, Nov 01, 2012 at 09:35:07AM +0900, Lorenzo Colitti wrote:
> Operators who want to have their routers do things like:
[…]
> - Stateless ACL processing for security purposes
[…]
> configure their routers to look at upper-layer headers. If the routers
> cannot parse the extension header chain but only look at the next header
> value in the IPv6 header, then the operators have a choice:
> 
> 1. Give up the above functionality.
> 2. Drop all packets with extension headers.
> 
> It's not just the fragment header, it's all extension headers. The fragment
> header is just the most important one.

Isn't the point that another packet will arrive later that doesn't bear
the information anymore that's needed to do the filtering decision?
Hence the fragmentation being the only concept that pushes information
away from a per-packet point of view to one where you'd require state?

(Also: To say that it wasn't forseen what would be possible in hardware
today a decade ago and then argue based on the current state of
technology to remove a feature does sound a tad wrong to me. Hardware
does evolve.)

Kind regards
Philipp Kern