Joe, >> However much money you throw at it, you can't reassemble fragments >> travelling on different paths, nor can you trivially make network layer >> reassembly not be an attack vector on those boxes. > > Agreed, but here’s the other point: > > Any device that inspects L4 content can do so ONLY as a proxy for the > destination endpoint. > > I.e., I know vendors WANT to sell devices they say can be deployed anywhere > in the network, and operators believe that, but it’s wrong. > > Basically, if you’re not at a place in the network where you represent that > endpoint, you have no business acting as that endpoint - “full stop”.
I understand you want it to fit in your model, but it doesn't. Take A+P (RFC6346), and it's instantiations through e.g. MAP-E (RFC7597). That's essentially normal longest match forwarding on addresses and ports. With regards to your point about reassembly at higher layers, crypto is the answer to that. Ole
signature.asc
Description: Message signed with OpenPGP
_______________________________________________ Int-area mailing list [email protected] https://www.ietf.org/mailman/listinfo/int-area
