Subject: Re: [BEHAVE] How to set the DF and the ID values for IPv4 packets (was Re: Amount of fragmentation resulting from translation

From: Fernando Gont <[email-masked]>
Date: Mon, 02 Nov 2009 17:38:54 -0200

Hello, Marcelo,

Comments in-line....

> So, consider that the translator receives an IPv6 packet without a
> fragment header.
> Those packets without the fragment header do not contain any ID value.
> The stateless document
> defines that the ID value is set to 0 and the DF set to 1. That works
> modulo the following black hole situation:

It actually doesn't, even in v4-only scenarios. See Section 3.5.1 of
http://www.cpni.gov.uk/Docs/InternetProtocol.pdf

> packets and set DF to zero. In order to do that, we should generate
> values for the ID field so that they do not clash
> 
> That would require changing the stateless document or if we don't want
> to keep the seq number state in that document, but we consider the
> problem is real and want to solve it int he stateful case, then take a
> different approach in the stateless and the staefull document.

For *this* is scenario (xlat), my recommendation would be a RFC1948-like
scheme:

ID = counter + F()

Where F() is a hash function that takes src IPv4, Dst IPv4, Protocol,
and secret_key as parameters.

Thanks!

Kind regards,
-- 
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Mon, 2 Nov 2009 21:47:37 +0100

[FYI: my emails to you always bounce, please fix, it is really  
annoying.]

> and secret_key as parameters.

What are the de facto benefits of performing such an expensive  
operation (a hash function) for each packet?

You didn't answer me on a similar question why it would be beneficial  
to introduce the extra state required to rewrite the sequence numbers  
for TCP sessions, by the way.

---

From: marcelo bagnulo braun <[email-masked]>
Date: Mon, 02 Nov 2009 21:51:10 +0100

> http://www.cpni.gov.uk/Docs/InternetProtocol.pdf

Right, Iljitsch mentioned this to me, but it was not obvious to me how 
pervasive that behaviour was
(for those who didn't open the doc, it states that there are middle 
boxes that fragment even if the DF bit is set
> For *this* is scenario (xlat),
mmm, i am confused by this.
You mean that this is your reccoemndation for the stateless trasnlator 
and _not_ for the stateful?
Or that this would be your reccomendation for both of them?

>  my recommendation would be a RFC1948-like
> scheme:
>
> ID = counter + F()
>

mmm, for packets containing a full packet (i.e. not a fragment) i was 
thinking on a simple counter per source IPv4 address... wouldnt' that be 
better? I mean, it would minimize the possibility of having a colision.

I mean, the algorihtm you suggest seems to have higher chance of 
collision, is there a benefit? I mean, i am not sure if the attacks that 
apply to the TCP seq number also apply here....

(for packets contianing a fragment, we need to copy the IPv6 value or 
reassemble before translating)

Regards, marcelo