Re: [tsvwg] Please tell us of any topics you would like to see discussed by TSVWG at the Montreal IETF

[Vincent Roca <[e-mail]>]

Hi Gorry et al.,

I suggest topic that is closely related to what Joe/Mikael exchange: about the minimum guaranteed MTU on a link (i.e., the 576 or 1280 limit).
This is a discussion I wanted to bring, especially as it has connections to the UDP PLPMTU I-D, but haven’t found time till now...

The question is what happens if, for a good or bad reason (e.g., an attack), a router that is a tunnel entry point, is already limited to this 576 or 1280 size on its outgoing link?
How will a client whose packets need to go through this tunnel behave after receiving PTB ICMP error messages with a suggested MTU lower than 576/1280?
The quick answer is: « a big mess », with either a DoS, or major performance issues, sometimes after a long freeze period (we measured up to 7 min).

Of course the detailed behaviour depends on the use of TCP vs. UDP, PMTUd vs. PLPMTU, IPv4 vs. IPv6, Ubuntu vs. W7.
We tried to explore all of this through an exploit. The two articles below exhibit an IPsec and IP-in-IP attack that relies on this principle, but the underlying problem
is of course independent of the tunnel nature.

- The initial work:
L. Jaqcuin, V. Roca, J-L. Roch, ``Too Big or Too Small? The PTB-PTS ICMP-based Attack against IPsec Gateways'', IEEE Global Communications Conference (GLOBECOM'14), December 2014. http://hal.inria.fr/hal-01052994/en/ <http://hal.inria.fr/hal-01052994/en/>, (slides, PDF) <http://www.inrialpes.fr/planete/people/roca/doc/slides_globecom14_ptb_pts_attack_interactive_session.pdf>.

- An update with many additional configurations tested (you can look at these slides for a good introduction to the problem):
V. Roca, L. Jacquin, S. Fall, J-L. Roch, ``New Results for the PTB-PTS Attack on Tunnelling Gateways'', GreHack 2015, November 2015. https://hal.inria.fr/hal-01245629/en/ <https://hal.inria.fr/hal-01245629/en/>, (slides, PDF) <http://www.inrialpes.fr/planete/people/roca/doc/GreHack15_ptb_pts_attack_VR.pdf>.

- We tried to discuss it at IPSECME a few years ago but didn’t find any echo:
V. Roca, S. Fall, ``Too Big or Too Small? The PTB-PTS ICMP-based Attack against IPsec Gateways'', IETF IP Security Maintenance and Extensions (IPSECME) Working Group, work in progress, July 2015. 
https://datatracker.ietf.org/doc/draft-roca-ipsecme-ptb-pts-attack/ <https://datatracker.ietf.org/doc/draft-roca-ipsecme-ptb-pts-attack/>

If the group considers it’s a topic of interest, I can update the I-D (perhaps focussing more on the min guaranteed MTU and strange situations it can create than on
the attack itself) and discuss it during next IETF meeting.

Cheers,

  Vincent