Re: Who does source address validation? (was Re: what's that smell?)

9 Oct 2002

...
Loss of ICMP packets generated by links with endpoints numbered in RFC1918 
space. Holes in traceroutes, broken PMTU detection.
Sherman, set the Way-Back Machine for August:

    To: David Schwartz <davids@webmaster.com>
    Cc: nanog@merit.edu
    Subject: Re: NSPs filter? 
    In-reply-to: Your message of "Thu, 08 Aug 2002 17:57:35 PDT."
             <20020809005740.AAA18472@shell.webmaster.com@whenever> 
    Date: Thu, 08 Aug 2002 18:45:17 -0700
    From: Stephen Stuart <stuart@tech.org>

In August you said it this way:
...
One thing that sometimes comes up is that people do number links using 
RFC1918 address space which occasionally results in an ICMP 'fragmentation 
needed but DF bit set' packet with an RFC1918 source address. Filtering out 
this packet could result in TCP breaking.
I still say this:

That can be accomodated; behold, all the joy of PMTUD, with none of
the other crap from designated special-use address space:

firewall {
    family inet {
        filter external-filter {
            term allow-icmp-unreach {
                from {
		    protocol icmp;
		    icmp-type unreachable;
                    icmp-code fragmentation-needed;
                }
                then {
                    count allow-icmp-need-frag;
                    accept;
                }
            }
            term allow-icmp-timxceed {
                from {
		    protocol icmp;
		    icmp-type time-exceeded;
                    icmp-code [ ttl-eq-zero-during-transit ttl-eq-zero-during-reassembly ];
                }
                then {
                    count allow-icmp-timxceed;
                    accept;
                }
            }
            term deny-rfc1918 {
                from {
                    source-address {
                        10.0.0.0/8;
                        172.16.0.0/12;
                        192.168.0.0/16;
                    }
                }
                then {
                    count deny-rfc1918;
                    discard;
                }
            }
            term deny-test {
                from {
                    source-address {
                        192.0.2.0/24;
                    }
                }
                then {
                    count deny-test-net;
                    discard;
                }
            }
            term deny-autoconfig {
                from {
                    source-address {
                        169.254.0.0/16;
                    }
                }
                then {
                    count deny-autoconfig;
                    discard;
                }
            }
	    term LAST {
                then accept;
            }
        }
    }
}

Application is left as an exercise to the reader.

Stephen