Subject: Re: [BEHAVE] Some fragmentation issues

From: marcelo bagnulo braun <[email-masked]>
Date: Sat, 09 Jan 2010 13:47:22 +0100

Iljitsch van Beijnum escribió:
> On 23 dec 2009, at 12:12, marcelo bagnulo braun wrote:
>
>   
>> Iljitsch van Beijnum escribió:
>>     
>>> Listening to the Hiroshima MP3s, I came upon the discussion on how to handle fragments, in particular with UDP zero checksums.
>>>
>>> First, the attacks that Marcelo talked about are mostly avoided simply enforcing that the whole transport header is in the first fragment and not in any other fragments. So the first fragment must be at least 80 bytes or so (don't talk to me about the 68 bytes in RFC 791, this is just a theoretical minimum, not something any sane person would ever use) and non-initial fragments must have an offset of > 80 bytes.
>>>
>>> Second, I don't think going out of our way to support fragmented UDP packets with checksum 0 makes sense. I'd say: recompute the checksum if you get a whole UDP packet with checksum 0, but don't bother reassembling packets just for this purpose. This is especially relevant for stateless translators which can translate fragments individually even out of order, but would have to buffer and reassemble UDP fragments just in case the checksum has to computed.
>>>
>>> Both UDP with checksum 0 and fragmented UDP are rare. The intersection must be extremely rare. Especially as in an earlier discussion the main use of UDP with checksum 0 was identified as VoIP, where packets are never large enough to warrant fragmentation.
>>>       
>
>   
>> my understanding is that all that you mention is already included in the current version of the draft.
>> could you check it and let me know?
>>     
>
>
> If the overlapping fragments issue is addressed, I managed to miss it when reading the draft. There is no link to a reference for this (unless it's one of the "message to the ... list ones).
>
> The checksum 0 issue is already solved this way in the xlate draft, sorry I didn't check earlier. I hope to get around to doing a full review of that draft. In the mean time:
>
>    When a stateless translator receives the first fragment of a
>    fragmented UDP IPv4 packet and the checksum field is zero, the
>    translator SHOULD drop the packet and generate a system management
>    event specifying at least the IP addresses and port numbers in the
>    packet.  When it receives fragments other than the first it SHOULD
>    silently drop the packet, since there is no port information to log.
>
> How exactly is the translator supposed to know that a non-initial fragment of a UDP packet is from a UDP packet with a 0 checksum or from a UDP packet with a valid checksum?
>
> I'll answer it myself: that's impossible without waiting for the first fragment, and doing that defeats the purpose of not handling 0 checksum packets. So a stateless translator needs to translate the non-initial fragments in case they belong to a packet with a valid checksum. And then, for simplicity, may as well forego the 0 checksum check for initial fragments and translate these as well. The resulting packet will be dropped by the receiver but at least that way the receiver gets to clear its reassembly buffers.
>
>
>
>   
I understand that this is not an issue for the stateful draft and that 
the current text supports this situation.
I mean, in the statefull case, the NAT64 will store frgaments that 
arrive earlier than the first segment, since it cannot translate them. 
When the first segment comes, it finds out whether the checksum is zero 
or not and then it decides whether it shoudl wait for all the frgaments 
to recompute the checksum or can forward the separated fragments.

Regards, marcelo