Re: Fragmentation-related security issues

2012-01-30 Thread Tore Anderson
* Florian Weimer And I see no functional difference between the gateway and the host generating the fragment ID, except that the latter approach seems to require network-wide software updates currently. A stateless translator does not keep track of the PMTU for the IPv4 destinations. That

Re: Fragmentation-related security issues

2012-01-30 Thread Florian Weimer
* Tore Anderson: * Florian Weimer And I see no functional difference between the gateway and the host generating the fragment ID, except that the latter approach seems to require network-wide software updates currently. A stateless translator does not keep track of the PMTU for the IPv4

Re: Fragmentation-related security issues

2012-01-30 Thread Tore Anderson
* Florian Weimer * Tore Anderson: * Florian Weimer And I see no functional difference between the gateway and the host generating the fragment ID, except that the latter approach seems to require network-wide software updates currently. A stateless translator does not keep track of the

Re: Consensus call on adopting: draft-gont-6man-ipv6-atomic-fragments

2012-01-30 Thread Tore Anderson
* Brian Haberman This is a consensus call on adopting: Title : Processing of IPv6 atomic fragments Author(s) : Fernando Gont Filename : draft-gont-6man-ipv6-atomic-fragments-00.txt Pages : 12 Date : 2011-12-15 as a 6MAN working group

Re: Fragmentation-related security issues

2012-01-30 Thread Philip Homburg
In your letter dated Mon, 30 Jan 2012 12:18:21 +0100 you wrote: Because the network ends up second-guessing the host. RFC 2460 allows IPv6 nodes to act on ICMPv6 PTBs w/MTU 1280 by simply lowering the Path MTU for the destination to the indicated value. In other words, an IPv6 node can perform

Re: Fragmentation-related security issues

2012-01-30 Thread Philip Homburg
In your letter dated Sat, 28 Jan 2012 20:41:18 -0300 you wrote: That said, nobody is *introducing* atomic fragments.They should have been supported for more than 15 years, and there is other stuff (mentioned by Dan Wing at others) that would break without this. Currently, atomic fragments are

Re: Fragmentation-related security issues

2012-01-30 Thread Fernando Gont
On 01/30/2012 06:28 PM, Philip Homburg wrote: In your letter dated Sat, 28 Jan 2012 20:41:18 -0300 you wrote: That said, nobody is *introducing* atomic fragments.They should have been supported for more than 15 years, and there is other stuff (mentioned by Dan Wing at others) that would break

Re: Fragmentation-related security issues

2012-01-30 Thread Tore Anderson
* Philip Homburg In your letter dated Mon, 30 Jan 2012 12:18:21 +0100 you wrote: Because the network ends up second-guessing the host. RFC 2460 allows IPv6 nodes to act on ICMPv6 PTBs w/MTU 1280 by simply lowering the Path MTU for the destination to the indicated value. In other words, an