[tsvwg] Re: Controlling IP Fragmentation on Common Platforms

["C. M. Heard" <[e-mail]>]

Hello Marten,

I read your draft with interest and see that it confirms the following
point about Linux that was raised during the discussion of
draft-ietf-dnsop-avoid-fragmentation:

E.g. on Linux socket API does not expose DF bit directly. Application
can request DF bit to be turned on in outgoing packets but at the same
time this implicitly enables receipt and processing of unauthenticated
ICMP messages. These messages can be used to manipulate Path MTU records
in the kernel and mount attacks misusing this technique.

See https://mailarchive.ietf.org/arch/msg/dnsop/elxvZIi8qNgF0eBcu-5AANNlKAo/
and
other messages in the thread for further discussion.

It would seem that this behavior would preclude compliance with Sections
4.5 and 4.6 of RFC 8899, at least without modification to the kernel.

Mike Heard

On Fri, Nov 15, 2024 at 1:54 AM Marten Seemann <[e-mail]>
wrote:

> Hello TSVWG!
>
> I just submitted a draft describing how to control IP fragmentation for
> UDP sockets on common platforms:
> https://datatracker.ietf.org/doc/draft-seemann-tsvwg-udp-fragmentation/
>
> Preventing IP fragmentation is a prerequisite for doing Datagram Path MTU
> Discovery (DPLPMTUD). On IPv4, this is achieved by setting the DF bit in
> the IP header. IPv6 can't be fragmented in transit; however, the sender's
> kernel might decide to split up packets that exceed the path's MTU.
>
> The fragmentation behavior is controlled by socket options. Unfortunately,
> these socket options vary between commonly used platforms, as does the
> behavior of dual-stack UDP sockets. This draft aims to provide guidance for
> implementers on how to control IP fragmentation on common platforms,
> similar to how Martin Duke's draft describes how to set and receive the ECN
> bits.
>
> The GitHub repository for the draft contains a cross-platform C program
> that demonstrates how to set the respective socket options:
> https://github.com/marten-seemann/draft-seemann-tsvwg-udp-fragmentation/tree/main/code.
> The program is most useful when used in combination with Wireshark or
> tcpdump to observe the effects on packets being sent.
>
> Best wishes,
> Marten (with no hats)
>