Subject: Re: [MOBILE-IP] Comment Please: Placement for Home Address option header

From: Richard Draves <[email-masked]>
Date: Mon, 13 Nov 2000 16:33:40 -0800

> Aha, I just got why you want the Home Address before a
> Fragment header for firewalls: so they can see the Home
> Address in every packet even fragments. Duh. And the Fragment
> header has to be before the IPsec headers. Since ESP isn't
> friendly to firewalls anyway, firewall-friendliness is only a
> concern for AH. This means two header orders make sense:
> a) IPv6, Home Address, possible Fragment, AH, Binding Update,
> Transport
> b) IPv6, possible Fragment, ESP (auth and/or encryption),
> Home Address & Binding Update with CoA suboption, Transport

I've been thinking more about this "firewall friendliness" requirement that
is leading to a desire to put the Home Address option before the Fragment
header.

Don't most firewalls also want to look at the transport header, so they can
filter based on the ports? And of course the TCP or UDP header will only be
present in the offset-zero fragment. So I think conservative firewalls will
want to drop all fragments, whether or not the Home Address option is
accessible in the fragments.

On the other hand, suppose a firewall has a policy of dropping all
offset-zero fragments that are too small to contain a full transport header,
filtering offset-zero fragments that are big enough, and letting through all
other fragments. If the offset-zero fragment from a packet is dropped, the
remaining fragments will never be reassembled. At most they can cause a
minor DOS problem, but they can't be a vehicle for a security breakin. So
this liberal firewall actually would be safe, and it would have the
advantage of working with applications that fragment packets and still
allowing policies based on port numbers.

So I think with reasonable firewall design, there is no need to put the Home
Address option before the Fragment header. Either with conservative (drop
all fragments) firewalls, or liberal (let fragments through) firewalls,
having the Home Address available on non-offset-zero fragments doesn't
actually buy any added functionality.

Rich

---

From: Charlie Perkins <[email-masked]>
Date: Mon, 13 Nov 2000 18:33:24 -0800

Hello Rich,

The sense I had gotten from previous discussion was that it
did in fact make sense for firewalls to exert some filtering
capability based on the home address.  This does make sense
to me.  I can well imagine that a firewall would have a hole
poked in it for a particular mobile node for a certain amount
of time.  I also understand that firewalls can be configured to
filter on more complicated rulesets, but that doesn't mean we
should disable abilities to use simpler rules.

However, I admit that I'm just following the conversation which
other people have been having.  I'm willing to follow whatever
consensus emerges.

More comments below...

> allowing policies based on port numbers.

This would be bad.  An implementation of a rogue IPv6 could use
data from pretend fragments, and the firewall would not be performing
its filtering function.

> actually buy any added functionality.

Isn't fragmentation considered to be a useful piece of functionality?
I'm not comfortable just declaring by fiat that we should declare
fragments to be unimportant.  I'd rather make it possible to do the
right thing, so that firewall vendors can give it a try if the need is felt.

Regards,
Charlie P.