Subject: [BEHAVE] IPv4 packet with DF=1 and already fragmented (xlate-19)

From: Kentaro Ebisawa <[email-masked]>
Date: Wed, 21 Apr 2010 09:56:22 +0900

Hi,

In draft-ietf-behave-v6v4-xlate-19.txt Section 3. Page 6, it says:

   When an IPv4 node performs path MTU discovery (by setting the Don't
   Fragment (DF) bit in the header), path MTU discovery can operate end-
  ... snip ...
   As a
   result, an IPv6 fragment header is only included if the IPv4 packet
   is already fragmented.

How should we handle fragmented IPv4 packet with DF=1 ?
Since it's fragmented you need to add fragment hdr when translating
to IPv6. But if you do so, it will imply you can fragment which means
DF was 0...

Or can we assume there are no valid IPv4 packet with DF=1 and already
fragmented, and simply drop it ?

It's little confusing since this sentence is written in the paragraph
describing DF=1 case.

Thanks,
-- 
Kentaro Ebisawa <[email-masked]>

---

From: "Ramji Vaithianathan (rvaithia)" <[email-masked]>
Date: Tue, 20 Apr 2010 21:16:52 -0700

>From what I see there should be NO fragmented pkts with DF bit set, so
such packets should be dropped as invalid.

I had asked a similar question sometime back and we had requested input
from the group on this, I don't think there was specific reply on this.

Thanks,

Ramji

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Kentaro Ebisawa
Sent: Wednesday, April 21, 2010 6:26 AM
To: [email-masked]
Subject: [BEHAVE] IPv4 packet with DF=1 and already fragmented
(xlate-19)

Hi,

How should we handle fragmented IPv4 packet with DF=1 ?
Since it's fragmented you need to add fragment hdr when translating to
IPv6. But if you do so, it will imply you can fragment which means DF
was 0...

Thanks,

_______________________________________________
Behave mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/behave

---

From: Erik Nordmark <[email-masked]>
Date: Wed, 21 Apr 2010 11:36:17 -0700

> such packets should be dropped as invalid.

In which RFC does it say that they are invalid?

I certainly haven't seen a prohibition on sending IPv4 packets with both 
DF and MF set, and this is used by at least some implementations. (The 
usage I know of comes from wanting to do optimal source fragmentation 
for NFS over UDP.)

    Erik

> Kentaro Ebisawa<[email-masked]>
>

---

From: Mark Andrews <[email-masked]>
Date: Thu, 22 Apr 2010 09:30:16 +1000

> usage I know of comes from wanting to do optimal source fragmentation 

As far as I know it is not prohibited but there are some kernel
developers that believe it is and clear/don't set DF if they are
sending packet that is fragmented at the source.

This behaviour has been useful as far as DNS/UDP is concerned as
only those EDNS packets in the 1481-1500 octet range get hit by
IP-in-IP tunnels if DF is incorrectly set by the kernel on UDP
packets without the application requesting it.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: "Ramji Vaithianathan (rvaithia)" <[email-masked]>
Date: Wed, 21 Apr 2010 18:39:02 -0700

Thanks for the clarification on this.

So as far as the original question is concerned, what draft says
currently:

3.1. Translating IPv4 Headers into IPv6 Headers
...
...
   If the DF bit is set and the packet is not a fragment (i.e., the MF
   flag is not set and the Fragment Offset is equal to zero) then the
   translator SHOULD NOT add a Fragment header to the resulting packet.
   The IPv6 header fields are set as follows:

 seems to answer the question.

Basically if 
   DF bit is set to 1 and packet is a Fragment - we still add a Fragment
Header.

Ramji

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Thursday, April 22, 2010 5:00 AM
To: Erik Nordmark
Cc: Ramji Vaithianathan (rvaithia); Kentaro Ebisawa; [email-masked]
Subject: Re: [BEHAVE] IPv4 packet with DF=1 and already fragmented
(xlate-19) 

In message <[email-masked]>, Erik Nordmark writes:
> >  From what I see there should be NO fragmented pkts with DF bit set,

> > so such packets should be dropped as invalid.
> 
> I certainly haven't seen a prohibition on sending IPv4 packets with 
> both DF and MF set, and this is used by at least some implementations.

> (The usage I know of comes from wanting to do optimal source 
> fragmentation for NFS over UDP.)
> 
>     Erik

As far as I know it is not prohibited but there are some kernel
developers that believe it is and clear/don't set DF if they are sending
packet that is fragmented at the source.

This behaviour has been useful as far as DNS/UDP is concerned as only
those EDNS packets in the 1481-1500 octet range get hit by IP-in-IP
tunnels if DF is incorrectly set by the kernel on UDP packets without
the application requesting it.

Mark

---

From: Kentaro Ebisawa <[email-masked]>
Date: Thu, 22 Apr 2010 12:08:32 +0900

Thanks for the comments.

So we add Fragment header if the packet is fragment(MF!=0 or offset=!0)
but would not fragment it on translator if DF=1.

On Wed, 21 Apr 2010 18:39:02 -0700

---

From: "Ramji Vaithianathan (rvaithia)" <[email-masked]>
Date: Wed, 21 Apr 2010 21:22:49 -0700

Yes, that is my understanding as well.

Also, if the fragment size (IPv4 packet length) is greater than 1252
bytes, the translated IPv6 packet (which will have a fragment header)
will be greater than 1280 bytes.  So we will need to drop the fragment
and generate ICMP PTB message??

So from what I see:
  some fragments (assuming they are <= 1252 bytes) will get translated
with Frag Header
and 
  some fragments (assuming they are > 1252 bytes) will get dropped.

Thanks,

Ramji

-----Original Message-----
From: Kentaro Ebisawa [mailto:[email-masked]] 
Sent: Thursday, April 22, 2010 8:39 AM
To: Ramji Vaithianathan (rvaithia)
Cc: [email-masked]; Erik Nordmark; [email-masked]
Subject: Re: [BEHAVE] IPv4 packet with DF=1 and already fragmented
(xlate-19)

Thanks for the comments.

> developers that believe it is and clear/don't set DF if they are
sending