Subject: [Hipsec] Segmentation within HIP

From: Derek Fawcus <[email-masked]>
Date: Fri, 25 Mar 2016 23:49:21 +0100

Recently I've been working on middlebox s/w:  Firewalls and NAT.

One thing this has brought home to me is just how unreliable
fragmentation is on the current Internet.  NAT will often
simply break it (such that they can not be reassembled) or
just discard them,  and firewalls are often set up to block them.

As such,  almost every protocol now would seem to need protocol
level segmentation/fragmentation,  rather than depend up IP
level fragmentation.

It struck me that it should be quite simple to extend HIP to
support such.

1) Add a Controls bit which advertises that the sender supports
   segmentation.
2) Define a new parameter,  numbered 1 such that it is first in
   the parameters,  and is critical.
   Within the parameter have a seqno/identifier, offset and
   more segments / final segment bit, possibly also a total
   size field.  Define some simple reassembly rules,  similar
   to those for IP fragments, such that one could reassemble
   a HIP packet larger than 2008 bytes if desired (how big?).
3) Possibly also define a none critical parameter within the
   non signed,  non MACed range which advertises the max size
   packet the sender is willing to reassemble.  In fact I guess
   this might remove the need to use a Controls bit,  since it
   would imply the sender can reassemble.

Then have a rule that once one party has seen the other party
advertise the segmentation capability within the current BEX
session, it is free to make use of segmentation towards that peer.

Thoughts?

DF

---

From: Robert Moskowitz <[email-masked]>
Date: Mon, 28 Mar 2016 20:46:09 -0400

Please see:

draft-hares-i2nsf-ssls-00-02.txt

Sue Hares and I are working on a whole session layer architecture where 
chunking and frag/reassem are parts of the session layer.  The work we 
are doing there, definitely would easily apply to HIP. Actually you need 
more that a bit.  Really 7 (this is what I did in IEEE 802.15.9), but 6 
work.

I would be interested in sitting down with you at IETF on this.

This week I am busy with my youngest son's wedding (tomorrow night).

On 03/25/2016 06:49 PM, Derek Fawcus wrote:
> _______________________________________________
> Hipsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hipsec
>

---

From: Gonzalo Camarillo <[email-masked]>
Date: Thu, 31 Mar 2016 18:12:00 +0300

Hi,

when specified the HIP_DATA packets we noted the fragmentation problem
but simply advised against sending large packets, which sure is not a
great solution ;-)

https://tools.ietf.org/html/rfc6078#section-6

Cheers,

Gonzalo

---

From: Robert Moskowitz <[email-masked]>
Date: Thu, 31 Mar 2016 17:53:48 -0400

As I said, I am seeing this as part of a larger problem.  And am working 
on some ideas.