Re: [v6ops] new draft: draft-ietf-v6ops-6204bis

[james woodyatt <[e-mail]>]

On Oct 20, 2011, at 9:50 AM, Jared Mauch wrote:
> 
> This is a long war against the firewall culture that we are unlikely to win. 

Section 4.3.1 of RFC 4890 clearly describes Packet Too Big (Type 2) messages as Traffic That Must Not Be Dropped.  For good reason too.  Section 5.6.1 of I-D.ietf-6man-node-req-bis quotes RFC 2460 as follows: 

      It is strongly recommended that IPv6 nodes implement Path MTU
      Discovery [RFC1981], in order to discover and take advantage of
      path MTUs greater than 1280 octets.  However, a minimal IPv6
      implementation (e.g., in a boot ROM) may simply restrict itself to
      sending packets no larger than 1280 octets, and omit
      implementation of Path MTU Discovery.

RFC 4294 goes on to set this requirement:

   The rules in [RFC2460] and [RFC5722] MUST be followed for packet
   fragmentation and reassembly.

And I-D.ietf-6man-node-req-bis currently adds this pedagogical language:

   One operational issue with Path MTU discovery occurs when firewalls
   block ICMP Packet Too Big messages.  Path MTU discovery relies on
   such messages to determine what size messages can be successfully
   sent. [...]

Where RFC 2460 says this about Packet Too Big messages:

   If, after processing a Routing header of a received packet, an
   intermediate node determines that the packet is to be forwarded onto
   a link whose link MTU is less than the size of the packet, the node
   must discard the packet and send an ICMP Packet Too Big message to
   the packet's Source Address.

Note that RFC 2460 doesn't use the normative keyword style, so that "must" above is to be read as a "MUST" if you're looking for the cues that RFC 2119 keywords typically provide.

So, nodes are REQUIRED either to implement Path MTU discovery or constrain their MTU to 1280.  IPv6 forwarding planes are REQUIRED to send ICMP Packet Too Big messages when a packet cannot be forwarded with fragmentation.  Firewall implementations are given clear guidance that Packet Too Big messages are Traffic That MUST NOT Be Dropped.

If this is a conflict with "firewall culture" that IETF cannot reasonably be expected to win, then I have a hard time imagining why IETF should even bother meeting at all.  We should just let "firewall culture" write all the standards.


--
james woodyatt <[e-mail]>
member of technical staff, core os networking