RE: Fun and surprises with IPv6 fragmentation

["Lubashev, Igor" <[e-mail]>]

Depends on what you mean by raw socket. A raw IP socket will have sender kernel send IP fragments per its interface MTU or destination MTU cache, if available. A raw Packet socket will error out, if you try to send larger than interface MTU.

-----Original Message-----
From: Mikkel Fahnøe Jørgensen [[e-mail]]
Received: Sunday, 04 Mar 2018, 9:56AM
To: Erik Kline [ek=[e-mail]]; Christian Huitema [[e-mail]]
CC: [e-mail] [[e-mail]]
Subject: Re: Fun and surprises with IPv6 fragmentation

It would be interesting to see what a raw socket interface would do, sender side.

I'm also wondering if the hypervisor might be interfering, though it should act as middleware.



On 4 March 2018 at 13.00.29, Erik Kline (ek=[e-mail]<mailto:ek=[e-mail]>) wrote:

> I tried to work around the issue by setting the "don't fragment" bit on the
> socket, but somehow that doesn't work.

I don't see how an app can do any sort of PathMTU on its own without following:

https://tools.ietf.org/html/rfc3542#section-11.2<https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_rfc3542-23section-2D11.2&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=Djn3bQ5uNJDPM_2skfL3rW1tzcIxyjUZdn_m55KPmlo&m=0_EwNIr1oLcj1zLJnxR98mB2q-UQbuPwlhQ6wAvsvqk&s=gLmtYGMeHbWnHwRmuTzdlBs7j3QbbtXjcHhmU9evKeI&e=>

Without this, the sender OS can (by default) generate fragments if it
receives an ICMPv6 PTB. I.e. IPV6_DONTFRAG seems to me like a
requirement for MTU detection.

Put another way, I think you probably /always/ want to perform the
step you describe, whenever probing for MTU.


You said (elsewhere) you had a pcap showing fragments arriving at the
client, but have you checked that the sender isn't receiving PTBs and
reacting accordingly?

If PTBs are being received and the fact fragments are still being
generated with IPV6_DONTFRAG, that could point to a bug in the sender
OS.

If something in the Amazon infrastructure or along the path is doing
IPv6 fragmentation of its own accord it's violating the text at the
top of:

https://tools.ietf.org/html/rfc8200#section-4.5<https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_rfc8200-23section-2D4.5&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=Djn3bQ5uNJDPM_2skfL3rW1tzcIxyjUZdn_m55KPmlo&m=0_EwNIr1oLcj1zLJnxR98mB2q-UQbuPwlhQ6wAvsvqk&s=TEunT0TN8uqVxX5LC9IAIH7dkUkHZZ3EJ2i6NY-0NRY&e=>

even that text isn't particularly strongly worded. (I looked for a
MUST or MUST NOT elsewhere, but haven't found such text yet.) Devices
doing this should probably be identified and expurgated from the
network.