Deprecating the Generation of IPv6 Atomic Fragments
draft-gont-6man-deprecate-atomfrag-generation-00

The information below is for an old version of the document
Document Type Active Internet-Draft (individual)
Last updated 2014-08-19
Stream (None)
Intended RFC status (None)
Formats pdf htmlized (tools) htmlized bibtex
Stream Stream state (No stream defined)
Consensus Boilerplate Unknown
RFC Editor Note (None)
IESG IESG state I-D Exists
Telechat date
Responsible AD (None)
Send notices to (None)
IPv6 maintenance Working Group (6man)                            F. Gont
Internet-Draft                                    SI6 Networks / UTN-FRH
Updates: 2460 (if approved)                                       W. Liu
Intended status: Standards Track                     Huawei Technologies
Expires: February 20, 2015                               August 19, 2014

          Deprecating the Generation of IPv6 Atomic Fragments
            draft-gont-6man-deprecate-atomfrag-generation-00

Abstract

   The core IPv6 specification requires that when a host receives an
   ICMPv6 "Packet Too Big" message reporting a "Next-Hop MTU" smaller
   than 1280, the host includes a Fragment Header in all subsequent
   packets sent to that destination, without reducing the assumed Path-
   MTU.  The simplicity with which ICMPv6 "Packet Too Big" messages can
   be forged, coupled with the widespread filtering of IPv6 fragments,
   results in an attack vector that can be leveraged for Denial of
   Service purposes.  This document briefly discusses the aforementioned
   attack vector, and formally deprecates the generation of IPv6 atomic
   fragments, such that the aforementioned attack vector is eliminated.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on February 20, 2015.

Copyright Notice

   Copyright (c) 2014 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of

Gont & Liu              Expires February 20, 2015               [Page 1]
Internet-Draft  Deprecate Generation of IPv6 Atomic Frags    August 2014

   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Terminology . . . . . . . . . . . . . . . . . . . . . . . . .   3
   3.  Denial of Service (DoS) attack vector . . . . . . . . . . . .   3
   4.  Updating RFC2460  . . . . . . . . . . . . . . . . . . . . . .   4
   5.  Additional Considerations . . . . . . . . . . . . . . . . . .   5
   6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   5
   7.  Security Considerations . . . . . . . . . . . . . . . . . . .   5
   8.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .   5
   9.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   6
     9.1.  Normative References  . . . . . . . . . . . . . . . . . .   6
     9.2.  Informative References  . . . . . . . . . . . . . . . . .   6
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .   6

1.  Introduction

   [RFC2460] specifies the IPv6 fragmentation mechanism, which allows
   IPv6 packets to be fragmented into smaller pieces such that they fit
   in the Path-MTU to the intended destination(s).

   Section 5 of [RFC2460] states that, when a host receives an ICMPv6
   "Packet Too Big" message [RFC4443] advertising a "Next-Hop MTU"
   smaller than 1280 (the minimum IPv6 MTU), the host is not required to
   reduce the assumed Path-MTU, but must simply include a Fragment
   Header in all subsequent packets sent to that destination.  The
   resulting packets will thus *not* be actually fragmented into several
   pieces, but rather just include a Fragment Header with both the
   "Fragment Offset" and the "M" flag set to 0 (we refer to these
   packets as "atomic fragments").  As required by [RFC6946], these
   atomic fragments are essentially processed by the destination host as
   non-fragment traffic (since there are not really any fragments to be
   reassembled).  IPv6/IPv4 translators will typically employ the
   Fragment Identification information found in the Fragment Header to
   select an appropriate Fragment Identification value for the resulting
   IPv4 fragments.

   While atomic fragments might seem rather benign, there are scenarios
   in which the generation of IPv6 atomic fragments can introduce an
Show full document text