3 ms·
While a very good story, I suspect the offending firewalls might drop traffic with any of the reserved bits set, not just the "evil" bit. Very fun exercise thou
by xorcist 11y ago
While a very good story, I suspect the offending firewalls might drop traffic with any of the reserved bits set, not just the "evil" bit. Very fun exercise though!
- nly 11y agoThis seems like a really bad thing to do. If any of those reserved bits get used for a legitimate purpose in the future then none of these networks will be accessible. Reserved should mean "set to 0 when you send, ignore on when you receive". It's not like these bits actually cost any additional processing. There's literally no benefit to dropping these packets, and it's shenanigans like this that mean we can't improve protocols easily in the future. I wonder how many routers are filtering IPv4 packets with fragment offsets of 8190 and 8191?
- fulafel 11y agoFirewalls and other middleboxes are notorious about doing very bad things like this to the detriment of the internet as a whole. See PMTU discovery, why it was impossible to deploy TCP RED or SCTP, etc.
- technion 11y ago"Windows DNS is broken" was a meme for about five years due to Cisco ASA's blocking EDNS traffic.
- arielb1 11y agoThis may be better than allowing the bit to desynchronise your firewall's state machine. However, if you want to be nazi like that you may actually prefer not to route your network to the Internet at the IP layer but rather provide application-level proxies (IIRC Check Point products can be configured like this).
- lmm 11y agoThe evil bit is the only reserved bit left in the IPv4 header, IIRC.
- jon-wood 11y agoIt looks like they're performing exactly to spec, which states packets with the evil bit set MUST be dropped.