Subject: Neighbor Discovery (Atomic Fragment)

From: Timothy Winters <[email-masked]>
Date: Fri, 28 Sep 2018 13:04:35 -0400

Should a Neighbor Discovery message with an atomic fragment be processed?

According to RFC 6980
"Nodes MUST silently ignore the following Neighbor Discovery and SEcure
Neighbor Discovery messages if the packets carrying them include an IPv6
Fragmentation Header:

   o  Neighbor Solicitation

   o  Neighbor Advertisement

   o  Router Solicitation

   o  Router Advertisement

   o  Redirect"

According to RFC 8200

"If the fragment is a whole datagram (that is, both the Fragment
         Offset field and the M flag are zero), then it does not need
         any further reassembly and should be processed as a fully
         reassembled packet (i.e., updating Next Header, adjust Payload
         Length, removing the Fragment header, etc.).  Any other
         fragments that match this packet (i.e., the same IPv6 Source
         Address, IPv6 Destination Address, and Fragment Identification)
         should be processed independently."

I take this to mean that according to RFC 8200 the fragment header
should be removed so the packet should be processed?

~Tim

---

From: Fernando Gont <[email-masked]>
Date: Fri, 28 Sep 2018 20:40:55 -0300

> Should a Neighbor Discovery message with an atomic fragment be processed?

No.

> o Neighbor Solicitation o Neighbor Advertisement o Router Solicitation o
> Router Advertisement o Redirect"
> 
> 
> According to RFC 8200
> 
> "If the fragment is a whole datagram (that is, both the Fragment Offset
> field and the M flag are zero), then it does not need any further
> reassembly and should be processed as a fully reassembled packet (i.e.,
> updating Next Header, adjust Payload Length, removing the Fragment
> header, etc.). Any other fragments that match this packet (i.e., the
> same IPv6 Source Address, IPv6 Destination Address, and Fragment
> Identification) should be processed independently."
> 
> 

RFC8200 applies to general traffic. RFC6980 overrides it for ND.

Sample logic: If you receive normal fragmented traffic (say
DNS/UDP/IPv6), the normal rag reassembly rules would apply. However, if
you receive ND traffic employing fragmentation, you should drop such
traffic.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

---

From: Bob Hinden <[email-masked]>
Date: Sat, 29 Sep 2018 14:10:04 -0700

> On Sep 28, 2018, at 4:40 PM, Fernando Gont <[email-masked]> wrote:
> 

I agree.

Bob

> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------