2 Čec
2016
2 Čec
'16
11:14
Hi,
I anyway wrote a patch for disabling PMTUD for UDP socket
(for both IPv4/IPv6), and posted to issue tracker:
https://gitlab.labs.nic.cz/labs/knot/issues/467#note_24304
This patch includes extra bonus for mitigating DNS fragmentation attack
for IPv4 UDP, by using Linux's newer sockopt IP_PMTUDISC_OMIT.
I tried to illustrate how PMTUD badly interact with DNS over UDP,
which draft-andrews-dnsext-udp-fragmentation is addressing.
Assuming that there is a small MTU link between DNS requester
and DNS responder. Responder is serving large response,
which size is exceeding that small MTU (1454):
Apparently many DNS operator don't want timeout and retransmission.
MTU MTU MTU
Requester--1500--[router1]--1454--[router2]--1500-- Responder
| . . |
| . . |
o --------------------------------------------->| 1. Requester initiates
| . . | DNS query.
| . . |
| . .<-------------o 2. Responder generates
| . . | large DNS resnponse
| . . | (packet size > 1454)
| . . |
| . o------------->| 3. Intermediate router
| . . | drops large packet
| . . | due to small MTU, and
| . . | generates ICMPv6
| . . | "Packet Too Big",
| . . | since the response
| . . | packet can't go
| . . | through the link.
| . . |
| . . | Responder would learn
| . . | smaller path MTU toward
| . . | requester, but
| . . | does not resend
| . . | the response. (It's UDP!)
~ ~ ~ ~
| . . |
o---------------------------------------------->| 4. After timeout
| . . | requester retries
| . . | query.
| . . |
|<----------------------------------------------| 5. Responder generates
| . . | fragmented DNS response
| . . | which can go throgh
| . . | the "MTU 1454" link.
| . . |
Regards,
--
Daisuke Higashi