Re: Non-Last Small IPv6 Fragments

On Thu, Jan 10, 2019 at 1:59 PM Mark Andrews <marka@isc.org> wrote:
>
>
>
> > On 11 Jan 2019, at 8:44 am, Erik Kline <ek@loon.co> wrote:
> >
> > On Thu, 10 Jan 2019 at 13:39, Simon Hobson <linux@thehobsons.co.uk> wrote:
> >>
> >> Tom Herbert <tom@herbertland.com> wrote:
> >>
> >>> That might be reasonable, however requiring intermediate fragments to
> >>> be at least 1280 MTU in IPv6 also solves that without needing to
> >>> define some aritrary new limit.
> >>
> >> In setting a minimum payload size for a fragment, is there a risk of conflicting with some known, or future unknown, link type with a small MTU ?
> >
> > Technically that link wouldn't meet the 1280 min mtu requirement for
> > IPv6, right?
> >
> > Even with 1280 byte min fragment sizes, a reassembly engine still
> > probably needs to place some limits in practice on the resources it
> > will devote to reassembly.  An attacker and sent 1280-sized fragments
> > for an endless series of 65535-sized datagrams…
>
> approximate packet counts.
>
> 65535/1280
> 51
>
> 65535/1500
> 43
>
> or even
>
> 65535/640
> 102
>
> but a IPv6 node doesn’t have to support reassembly up to 65535
>
> If you are worried about too many fragments, count and limit the fragments
> not the fragment size.  If you get too many fragments for a packet just
> discard them all.

Mark,

I think that might lead to some odd scenarios. For instance, in Ron's
tiny fragment attack, the receiver would start reassembling fragments
up to the limit. In some sense the attack should be obvious, no
rationale implementation should be sending tiny fragments in this
manner. But once the limit is hit, then what happens? Unless the
receiver keeps some state about the failed reassembly (which would be
new complexity in the implementation), if would just restart the
reassembly of the packet on the next received fragment when further
efforts to reassmble are obviously futile.

Tom

>
> > --------------------------------------------------------------------
> > IETF IPv6 working group mailing list
> > ipv6@ietf.org
> > Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> > --------------------------------------------------------------------
>
> --
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: +61 2 9871 4742              INTERNET: marka@isc.org
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------