Subject: Re: IPv6 Fragment Retransmission

From: Fernando Gont <[email-masked]>
Date: Tue, 18 Jan 2022 04:49:48 -0300

Hi, Mark,

On 27/10/21 07:52, Mark Smith wrote:
[....]
>
> I've been thinking about the observation that fragments are blocked by
> many networks, and I think in a lot of cases it is by accident. When
> being taught packet filtering I don't remember ever being taught to
> allow fragments, and the implicit or explicit deny all at the end drops
> them. I don't remember being at any ISP networks where people explicitly
> said "we should block fragments".
>
> Infosec people are known to actively drop them because they don't have
> transport layer port information in them.

If you look at the number of advisories that have been published
regarding fragmentation (and IPv6 EHs in general), there's no wonder why
security people opt to block them: source for problems, and for the most
part you do not or cannot rely on them anyway.

Thanks,
Fernando

--
Fernando Gont
Director of Information Security
EdgeUno
PGP Fingerprint: DFBD 63E3 B248 AE79 C598 AF23 EBAE DA03 0644 1531

“This communication is the property of EdgeUno or one of its group companies and/or affiliates. This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and if you are not the intended recipient be aware that any non-explicitly authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, and will be considered a criminal offense. Please notify [email-masked] about the unintended receipt of this electronic message and delete it.”

---

From: Tom Herbert <[email-masked]>
Date: Tue, 18 Jan 2022 08:00:41 -0800

> part you do not or cannot rely on them anyway.

Fernando,

I disagree that you cannot rely on them as IP fragmentation and EHs
are productively used in some real world deployments; IETF can't just
arbitrarily obsolete them. Grant it, most of these deployments are in
some sort of limited domain. A good example is IP encapsulation which
seems to be a primary use case in Fred's draft. There are several UDP
encapsulation protocols as well as UDP options that also define
fragmentation which leads me to ask if it might be better to introduce
reliable fragments there instead of at IP level since reliability is
canonically more of a transport layer construct.

Tom

> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------