Subject: [tsvwg] draft-ietf-tsvwg-udp-options-13: Comments concerning Fragments

From: Gorry Fairhurst <[email-masked]>
Date: Tue, 31 Aug 2021 11:17:38 +0100

I have the following questions relating to the text about Fragments.

Best wishes,

Gorry

(as an  individual)

===
In section 5.3: Frag:

“   Legacy receivers interpret FRAG messages as zero-length payload
    packets (i.e., UDP Length field is 8, the length of just the UDP
    header), which would not affect the receiver unless the presence of
    the packet itself were a signal.”
- can you supply a reference here? (If no other then sect 5 of RFC8085).
===

Concerning Frag:

“ This allows either pre-reassembly or post-reassembly
    UDP option effects.”
- I think I understand a use case and it would be nice to have an 
example of using both per-fragment and per-datagram options: could this 
be used with fragments req/res options to determine a suitable PMTU, and 
the time options used per reassembled datagram (since in many case this 
needs to measure the time across the reassembled end-to-end datagram path).
===

Concerning Frag:

    >> UDP reassembly space limits SHOULD NOT be implemented as an
    aggregate, to avoid cross-socketpair DOS attacks.
- Please explain “aggregate” (is this across multiple socket-pairs?)
===

Concerning Frag:

    Any additional UDP options, if used, follow the FRAG option in the
    final fragment and would be included in the reassembled packet.
- I don’t like the word “additional” here, can you find a better word 
(per-datagram?)
===
In 5.7: Maximum Reassembled Segment Size (MRSS)
- I’m going to make a suggestion here, that was earlier brought up by 
Tom Jones: Why don’t we fix the DEFAULT MRSS to 2 packets when MRSS is 
supported. Larger values might be supported, which would be fine, but 
the case of 2 might have some immediate benefit:
- A receiver can then fragment a UDP packet to tunnel of include UDP 
options, likely in many current cases a second fragment will be enough.
- A receiver can greatly simplify its processing if it tries to 
reassemble whenever it receives a second fragment of the same datagram. 
The simplification here mitigates some worry about attacks that target 
reassembly buffers or processing costs. He previously had not 
implemented fragment support because it was cumbersome to include in the 
OS he worked with.
- Thoughts?

---

From: "[email-masked]" <[email-masked]>
Date: Tue, 31 Aug 2021 10:59:17 -0700

More responses…

—
Joe Touch, temporal epistemologist
www.strayalpha.com

> On Aug 31, 2021, at 3:17 AM, Gorry Fairhurst <[email-masked]> wrote:
> 

Thanks - I didn’t know that existed. Will do.

> - I think I understand a use case and it would be nice to have an example of using both per-fragment and per-datagram options: could this be used with fragments req/res options to determine a suitable PMTU, and the time options used per reassembled datagram (since in many case this needs to measure the time across the reassembled end-to-end datagram path).

OK.

> ===
> 
> Concerning Frag:
> 
>    >> UDP reassembly space limits SHOULD NOT be implemented as an

Yes; will do.

> - I don’t like the word “additional” here, can you find a better word (per-datagram?)

Yes.

> - I’m going to make a suggestion here, that was earlier brought up by Tom Jones: Why don’t we fix the DEFAULT MRSS to 2 packets when MRSS is supported. Larger values might be supported, which would be fine, but the case of 2 might have some immediate benefit:
> - A receiver can then fragment a UDP packet to tunnel of include UDP options, likely in many current cases a second fragment will be enough.
> - A receiver can greatly simplify its processing if it tries to reassemble whenever it receives a second fragment of the same datagram. The simplification here mitigates some worry about attacks that target reassembly buffers or processing costs. He previously had not implemented fragment support because it was cumbersome to include in the OS he worked with.
> - Thoughts?

IPv6 requires reassembly to 1500B but has no frag count limit (i.e., MRSS is a size, not a number). I favor the same approach here, especially because it can be argued to serve the same purpose with the same impact and vulnerability.