Subject: Re: [MOBILE-IP] Comment Please: Placement for Home Address option header

From: Richard Draves <[email-masked]>
Date: Mon, 13 Nov 2000 21:16:57 -0800

> > On the other hand, suppose a firewall has a policy of dropping all
> > offset-zero fragments that are too small to contain a full
> transport header,
> > filtering offset-zero fragments that are big enough, and
> letting through all
> > other fragments. If the offset-zero fragment from a packet
> is dropped, the
> > remaining fragments will never be reassembled. At most they
> can cause a
> > minor DOS problem, but they can't be a vehicle for a
> security breakin. So
> > this liberal firewall actually would be safe, and it would have the
> > advantage of working with applications that fragment
> packets and still
> > allowing policies based on port numbers.
>
> This would be bad.  An implementation of a rogue IPv6 could use
> data from pretend fragments, and the firewall would not be performing
> its filtering function.

I don't understand. Are you supposing a rogue node *behind* the firewall?
Firewalls won't protect against that. Or are you supposing a node behind the
firewall is running a buggy IPv6 implementation, that manages to reassemble
& process a packet lacking the offset-zero fragment?

> > So I think with reasonable firewall design, there is no
> need to put the Home
> > Address option before the Fragment header. Either with
> conservative (drop
> > all fragments) firewalls, or liberal (let fragments
> through) firewalls,
> > having the Home Address available on non-offset-zero
> fragments doesn't
> > actually buy any added functionality.
>
> Isn't fragmentation considered to be a useful piece of functionality?
> I'm not comfortable just declaring by fiat that we should declare
> fragments to be unimportant.  I'd rather make it possible to do the
> right thing, so that firewall vendors can give it a try if
> the need is felt.

I wasn't saying that fragments are unimportant. I'm saying that you can be a
reasonable firewall and properly filter fragmented packets, without having
the Home Address (and transport header) in every fragment.

Rich

---

From: Francis Dupont <[email-masked]>
Date: Tue, 14 Nov 2000 13:50:05 +0100

In your previous mail you wrote:

=> I am not a firewall person (in fact, I don't like firewalls) but
this (the before fragment) was asked by firewall people and it is
cheap to give to them then IMHO we should do what firewall people want.

Regards

[email-masked]

PS: tunnel encapsulation limit is different because it is useful
(ie. it makes sense) only if it is carried by every fragments.
This is a stronger argument in favor of the "before fragment" placement.