Re: Non-Last Small IPv6 Fragments

[Fernando Gont <[e-mail]>]

On 10/1/19 19:20, Erik Kline wrote:
> On Thu, 10 Jan 2019 at 13:58, Mark Andrews <[e-mail]> wrote:
>>
>>
>>
>>> On 11 Jan 2019, at 8:44 am, Erik Kline <[e-mail]> wrote:
>>>
>>> On Thu, 10 Jan 2019 at 13:39, Simon Hobson <[e-mail]> wrote:
>>>>
>>>> Tom Herbert <[e-mail]> wrote:
>>>>
>>>>> That might be reasonable, however requiring intermediate fragments to
>>>>> be at least 1280 MTU in IPv6 also solves that without needing to
>>>>> define some aritrary new limit.
>>>>
>>>> In setting a minimum payload size for a fragment, is there a risk of conflicting with some known, or future unknown, link type with a small MTU ?
>>>
>>> Technically that link wouldn't meet the 1280 min mtu requirement for
>>> IPv6, right?
>>>
>>> Even with 1280 byte min fragment sizes, a reassembly engine still
>>> probably needs to place some limits in practice on the resources it
>>> will devote to reassembly.  An attacker and sent 1280-sized fragments
>>> for an endless series of 65535-sized datagrams…
>>
>> approximate packet counts.
>>
>> 65535/1280
>> 51
>>
>> 65535/1500
>> 43
>>
>> or even
>>
>> 65535/640
>> 102
>>
>> but a IPv6 node doesn’t have to support reassembly up to 65535
>>
>> If you are worried about too many fragments, count and limit the fragments
>> not the fragment size.  If you get too many fragments for a packet just
>> discard them all.
> 
> I don't yet see the need to limit the fragment size (but perhaps some
> persuasive argument will emerge).
> 
> What I was trying to describe was: take all of those numbers you
> reference per 32bit fragment ID.
> 
> An attacker could forge the source address and send 50 of the 51
> packets for each of 4 billion fragment IDs.  The missing fragment
> could even be the one with the L4 header too (to try to circumvent L4
> ACLs that might cause the rest of the fragments to be dropped).

Indeed.


>From the frag6(1) (htps://github.con/fgont/ipv6toolkit.git) man page:

  # frag6 -s ::/0 --flood-frags 100 -l -z 5 -d fc00:1::1 -v
    Send  100  fragments  (every  5 seconds) to the host fc00:1::1,
    using a forged IPv6 Source Address from the  prefix  ::/0.  The
    aforementioned fragments  should  have  an  offset  of  0, and
    the M bit set (i.e., be first-fragments). Be verbose.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492