RE: Non-Last Small IPv6 Fragments

[Ron Bonica <[e-mail]>]

> I read some of the reports on the link, but am still not clear what the
> underlying problem is.   Why does Linux have a problem with receving
> intermediate fragments less than 1280?
> 

Hi Bob,

Might we be defending against an attack in which a packet contains:

- An IPv6 header (40 bytes)
- A Fragment Header (8 bytes)
- A TCP header (20 bytes)
- TCP Payload (1200 bytes)

This packet doesn't need to be fragmented at all because the total length is only 1268 bytes. However, a mischievous source node divides the packet into 1200 fragments. The first fragment contains an IPv6 header, a fragment header, the TCP header, and one byte of the TCP payload. Each subsequent fragment contains the IPv6 header, a fragment header, and one byte of TCP payload.

Are reassembly algorithms clever enough to protect against such attacks? If so, I don't see the problem either. But if not, we may have a problem.

                                                                                           Ron