Re: [BEHAVE] How to set the DF and the ID values for IPv4 packets (was Re: Amount of fragmentation resulting from translation

[marcelo bagnulo braun <marcelo at it.uc3m.es>]

Fernando Gont escribió:
> Hello, Marcelo,
>
> Comments in-line....
>
>   
> > So, consider that the translator receives an IPv6 packet without a
> > fragment header.
> > Those packets without the fragment header do not contain any ID value.
> > The stateless document
> > defines that the ID value is set to 0 and the DF set to 1. That works
> > modulo the following black hole situation:
> >     
>
> It actually doesn't, even in v4-only scenarios. See Section 3.5.1 of
> http://www.cpni.gov.uk/Docs/InternetProtocol.pdf
>   

Right, Iljitsch mentioned this to me, but it was not obvious to me how 
pervasive that behaviour was
(for those who didn't open the doc, it states that there are middle 
boxes that fragment even if the DF bit is set
>   
> > packets and set DF to zero. In order to do that, we should generate
> > values for the ID field so that they do not clash
> >
> > That would require changing the stateless document or if we don't want
> > to keep the seq number state in that document, but we consider the
> > problem is real and want to solve it int he stateful case, then take a
> > different approach in the stateless and the staefull document.
> >     
>
> For *this* is scenario (xlat),
mmm, i am confused by this.
You mean that this is your reccoemndation for the stateless trasnlator 
and _not_ for the stateful?
Or that this would be your reccomendation for both of them?

>  my recommendation would be a RFC1948-like
> scheme:
>
> ID = counter + F()
>
> Where F() is a hash function that takes src IPv4, Dst IPv4, Protocol,
> and secret_key as parameters.
>
>   

mmm, for packets containing a full packet (i.e. not a fragment) i was 
thinking on a simple counter per source IPv4 address... wouldnt' that be 
better? I mean, it would minimize the possibility of having a colision.

I mean, the algorihtm you suggest seems to have higher chance of 
collision, is there a benefit? I mean, i am not sure if the attacks that 
apply to the TCP seq number also apply here....


(for packets contianing a fragment, we need to copy the IPv6 value or 
reassemble before translating)

Regards, marcelo

> Thanks!
>
> Kind regards,
>