[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [pmtud] updated: Agenda for PMTUD at IETF 60 in San Deigo

On Tue, 3 Aug 2004, Michael Richardson wrote:

"Matt" == Matt Mathis <mathis at psc.edu> writes: 
   >> Indeed, at least one major OS always sets the 'id' field to '0'
   >> when sending IPv4 packets with the 'DF' bit set.

   Matt> This punishes devices that ignore DF.  Does anybody have any
   Matt> experience with this?  I would really like to hear more about
   Matt> it....

 Well, in the case of IPsec on Linux ignoring the DF bit, there is
no punishment. We presently "ignore" the DF bit by not copying it to
the IP/ESP headers. A new ID gets allocated for the ESP packet, which
may get fragmented.
 (We *DO* send ICMPs as well)

Let me make sure that I understand: in this case IPsec is applied first, before fragmentation, and the packet has to be reassembled before the decapsulater can decrypt/check the sig. So the outer fragmentation is *only* between the tunnel endpoints and is protected by more than 16 bits of checksum. This seems to me to be ok, except that it is not portable to IPv6. (This is ok because the fragmentation is totally hidden from the end system, and protected from missassociation by much more than 16 bits.)

The "punishment" I was referring to is this: if you always set the IP ID to zero on non-fragmented packets with DF, then anybody who illegally fragments is sure cause massive corrupted data, and will be rightly blamed for it. John Heffner told me that this was done for some Linux releases but was backed out because it breaks ppp header compression that assumes that the IP ID always advances by small positive integers.

Note that this would not hurt your approach either.

 We will likely implement draft-richardson-ipsec-fragment-* within the
next month or two, depending upon resources.

If you can suggest any ways to put more of ideas from your draft into section 5.5.3, that would be great.

Thanks,
--MM--
-------------------------------------------
Matt Mathis      http://www.psc.edu/~mathis
Work:412.268.3319    Home/Cell:412.654.7529
-------------------------------------------
"My heart is in the work." -- Andrew Carnegie

_______________________________________________
pmtud mailing list
pmtud at ietf.org
https://www1.ietf.org/mailman/listinfo/pmtud