Re: [DNSOP] draft-fujiwara-dnsop-fragment-attack-01.txt

Daisuke HIGASHI <daisuke.higashi@gmail.com> Sat, 09 March 2019 08:18 UTC

MIME-Version: 1.0
From: Daisuke HIGASHI <daisuke.higashi@gmail.com>
Date: Sat, 09 Mar 2019 17:18:18 +0900
Message-ID: <CAO-L_V90W2=m0KKMdnu7gcgaUaKReCa_8C+kp37zwSLxwKH9hA@mail.gmail.com>
To: dnsop@ietf.org
Content-Type: text/plain; charset="UTF-8"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/oMh465HH3XhTE7D9RVJjUypepGc>
Subject: Re: [DNSOP] draft-fujiwara-dnsop-fragment-attack-01.txt
Precedence: list

draft-fujiwara-dnsop-fragment-attack-01:

> 3.  Current status
>
>   [Brandt2018] showed that Linux version 3.13 and older versions are
>   vulnerable to crafted ICMP fragmentation needed and DF set packet and
>   off-path attackers can set some of authoritative servers' path MTU
>   size to 296.
>
>   The author tested Linux version 2.6.32, 4.18.20 and FreeBSD 12.0.
>   Linux 2.6.32 accepts crafted "ICMP Need Fragmentation and DF set"
>   packet and path MTU decreased to 552.  Linux 2.6.32, Linux 4.18.20
>   and FreeBSD 12.0 accept crafted "ICMPv6 Packet Too Big" packet and
>   path MTU decreased to 1280.
>
>  Linux version 4.18.20 may ignore crafted ICMP packet.

   I confirmed that Linux 4.18 (Ubuntu 18.10) accepts crafted ICMP
on "plain" UDP socket. And if sockopt IP_PMTUDISC_DONT is set to sockets
(many DNS implements do this) sender host generates fragmented packets
caused by crafted ICMP.

   Determining whether a DNS implementation on Linux accepts
crafted ICMPv4 or not is somewhat confusing and need to investigate
with caution:

 - Latest Linux seems to still accept crafted ICMPv4 by default.
   Linux 3.15 introduced a new socket option IP_PMTUDISC_OMIT
   which makes sockets ignore PMTU information and send packet with DF=0.
   With this option sending socket never honor PMTU information and
fragmentation
   is done if and only if the packet size exceeds outgoing interface MTU.

- Some DNS implementation (BIND 9.9.10 / Unbound 1.5.0 and later) utilize
  IP_PMTUDISC_OMIT option if available. So these DNS implementation on
Linux 3.15 (or later)
  won't accept crafted ICMP.
  (I submitted a patch to NSD for enabling this feature.
    https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=4235 )

- Some Linux distribution is based on older version (like Linux 3.10)
  but has IP_PMTUDISC_OMIT feature by backporting.

  I found that IP_PMTUDISC_OMIT feature is backported to Red Hat
Enterprise Linux 7
  (it's Linux 3.10 based) but they didn't backport corresponding macro
definition to glibc header.
  So BIND9's / Unbound's IP_PMTUDISC_OMIT feature on current RHEL7
won't be enabled
  regardless of kernel feature.
  (Bug report:  https://bugzilla.redhat.com/show_bug.cgi?id=1684874 )

Regards,
--
 Daisuke Higashi

[DNSOP] draft-fujiwara-dnsop-fragment-attack-01.t… fujiwara
Re: [DNSOP] draft-fujiwara-dnsop-fragment-attack-… Mark Andrews
Re: [DNSOP] draft-fujiwara-dnsop-fragment-attack-… 神明達哉
Re: [DNSOP] draft-fujiwara-dnsop-fragment-attack-… Paul Vixie
Re: [DNSOP] draft-fujiwara-dnsop-fragment-attack-… fujiwara
Re: [DNSOP] draft-fujiwara-dnsop-fragment-attack-… fujiwara
Re: [DNSOP] draft-fujiwara-dnsop-fragment-attack-… 神明達哉
Re: [DNSOP] draft-fujiwara-dnsop-fragment-attack-… Mark Andrews
Re: [DNSOP] draft-fujiwara-dnsop-fragment-attack-… Daisuke HIGASHI
Re: [DNSOP] draft-fujiwara-dnsop-fragment-attack-… Florian Weimer