Re: Validation of Packet Too Big Payload using Echo Request

[Prabhakar Lakhera <[e-mail]>]

Specially, given the proposed test expects node to be stateful with ICMPv6 Echo Replies.
That just opens up another window of exploit.

It is also not great that one can only provide “best effort” checks. That is do one thing for ICMPv6, check for tuple for UDP, additionally check for  sequence numbers for TCP.

Given the MTU has lower bound of 1280, the requirement should *not* be part of IPv6 ready logo as a must. The spec says it is a should, and that’s how it needs to be read.

Thanks! 

> On Jul 29, 2020, at 5:02 AM, Lorenzo Colitti <[e-mail]> wrote:
> 
> I'm not sure that the desired behaviour is reasonably implementable. Wouldn't it require the sending node to keep state on all packets it had ever sent? For how long?
> 
> The implementation can relatively easily check if a PTB matches an *existing* socket. But what if the following happens?
> 
> 1. App opens UDP socket, sends packet.
> 2. App closes socket.
> 3. PTB arrives for packet in step #1.
> 4. App opens socket on same port again, sends identical packet again.
> 
> If the stack rejects the packet in #3, arguably it makes things worse. But accepting it is difficult without keeping state on sockets after they are closed, which is both ill-defined (how long do you need to keep the state?) and potentially expensive / exposing a DoS vector.
> 
> On Tue, Jul 28, 2020, 21:00 Timothy Winters <[e-mail] <mailto:[e-mail]>> wrote:
> Hi Shawn,
> 
> If you are referring to the IPv6 Ready Logo Core Test Specification for this, we have a possible problem for this validation test case for devices that don't track ICMPv6 connections.
> 
> "Possible Problems:  If the device under test does not support tracking connections for ICMPv6 this test case may be omitted."
> 
> If you have other questions about IPv6 Ready please feel free to take this to the [e-mail] <mailto:[e-mail]>.
> 
> ~Tim
> 
> On Tue, Jul 28, 2020 at 7:48 AM Shawn Zhang <yuanshan_zhang=[e-mail] <mailto:[e-mail]>> wrote:
> Hi Ole,
> 
> I am reviving this thread. 
> 
> >> Frankly, I think for compliance this should be treated as a *SHOULD* and not as a MUST.
> 
> > Yes, I think that's a correct interpretation.
> > That's what 8201 says too. "Nodes should appropriately validate..."
> 
> Since RFC8201 says “SHOULD” instead of “MUST”, should this test be removed from the compliance test as it is not a mandatory behavior?
> 
> IMHO, since the smallest packet size is capped at 1280, it won't cause too much risk  even if we don't verify it using Echo Request here.
> 
> Bests,
> Shawn
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail] <mailto:[e-mail]>
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6 <https://www.ietf.org/mailman/listinfo/ipv6>
> --------------------------------------------------------------------
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail] <mailto:[e-mail]>
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6 <https://www.ietf.org/mailman/listinfo/ipv6>
> --------------------------------------------------------------------