Subject: Re: Non-Last Small IPv6 Fragments
From: Tom Herbert <[email-masked]>
To: Nick Hilliard <[email-masked]>
Cc: Brian E Carpenter <[email-masked]>, IPv6 List <[email-masked]>, Bob Hinden <[email-masked]>
Date: Sun, 13 Jan 2019 12:29:15 -0800
List-Id: "IPv6 Maintenance Working Group \(6man\)" <ipv6.ietf.org>

On Sun, Jan 13, 2019 at 12:12 PM Nick Hilliard <[email-masked]> wrote:
>
> Tom Herbert wrote on 13/01/2019 19:48:
> > Yes, but then what are the rules? AFAICT from RFC8200 the minimum
> > fragment data is eight bytes. I think it's going to be a hard sell to
> > convince OS developers that they should accept such packets just
> > because the spec requires it-- the DOS attack vector in this is too
> > obvious.
> No intermediate node is going to fragment anything other than the last
> frame to 8 bytes, or at least if it does, the network is so severely
> crippled that fragmentation is the least of its problems.  It would be
> fair to assume that if host B receives a stream of fragments where the
> fragment size is unfeasibly small, then the fragmentation was done by
> host A.
>
No legitimate host implementation would send this either. If B is
receiving these packets, the logical conclusion is that it's under DOS
attack and someone is spoofing A's address.

> This is not a good DOS vector, to be honest.  There's nothing to stop
> random small packets being streamed from A to B and it doesn't matter
> much whether they are fragments of a larger packet or not.
>
As I mentioned fragments require much work work that simply processing
an IP packet, so it's a pretty good attack since it potentially
attacks memory, CPU utlization, and has is also a tuple attack on
paritcular CPUs. The flaw from the attackers point of view is that the
signature of the attack is obvious, small non-first fragments, and
therefore easily mitigated with a limit.

> There doesn't seem to be a compelling case to change the protocol to
> accommodate this particular corner case.  It ranks as annoyance rather
> than a serious threat.

Maybe not changing the protocols, but I still don't see a compelling
case to knowingly accept packets that are highly likely to be a part
of a DOS attack.

Tom

>
> Nick