RE: Validation of Packet Too Big Payload using Echo Request

["Jakob Heitz (jheitz)" <[e-mail]>]

Don't associate the PMTU with a socket.
Associate it with the destination IP.
That is, of course, a DOS vector, so apply the appropriate caching strategies.

For example, if two sockets from different apps go to the same destination IP,
then a PTB from that IP should apply to both sockets.

Regards,
Jakob.

From: ipv6 <[e-mail]> On Behalf Of Lorenzo Colitti
Sent: Wednesday, July 29, 2020 5:03 AM
To: Timothy Winters <[e-mail]>
Cc: 6MAN <[e-mail]>; Shawn Zhang <yuanshan_zhang=[e-mail]>; Timothy Winters <[e-mail]>; [e-mail]
Subject: Re: Validation of Packet Too Big Payload using Echo Request

I'm not sure that the desired behaviour is reasonably implementable. Wouldn't it require the sending node to keep state on all packets it had ever sent? For how long?

The implementation can relatively easily check if a PTB matches an *existing* socket. But what if the following happens?

1. App opens UDP socket, sends packet.
2. App closes socket.
3. PTB arrives for packet in step #1.
4. App opens socket on same port again, sends identical packet again.

If the stack rejects the packet in #3, arguably it makes things worse. But accepting it is difficult without keeping state on sockets after they are closed, which is both ill-defined (how long do you need to keep the state?) and potentially expensive / exposing a DoS vector.

On Tue, Jul 28, 2020, 21:00 Timothy Winters <[e-mail]<mailto:[e-mail]>> wrote:
Hi Shawn,

If you are referring to the IPv6 Ready Logo Core Test Specification for this, we have a possible problem for this validation test case for devices that don't track ICMPv6 connections.


"Possible Problems:  If the device under test does not support tracking connections for ICMPv6 this test case may be omitted."



If you have other questions about IPv6 Ready please feel free to take this to the [e-mail]<mailto:[e-mail]>.



~Tim

On Tue, Jul 28, 2020 at 7:48 AM Shawn Zhang <yuanshan_zhang=[e-mail]<mailto:[e-mail]>> wrote:
Hi Ole,

I am reviving this thread.

>> Frankly, I think for compliance this should be treated as a *SHOULD* and not as a MUST.

> Yes, I think that's a correct interpretation.
> That's what 8201 says too. "Nodes should appropriately validate..."

Since RFC8201 says “SHOULD” instead of “MUST”, should this test be removed from the compliance test as it is not a mandatory behavior?

IMHO, since the smallest packet size is capped at 1280, it won't cause too much risk  even if we don't verify it using Echo Request here.

Bests,
Shawn

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[e-mail]<mailto:[e-mail]>
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------
--------------------------------------------------------------------
IETF IPv6 working group mailing list
[e-mail]<mailto:[e-mail]>
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------