Re: Non-Last Small IPv6 Fragments

[Timothy Winters <[e-mail]>]

On Fri, Jan 11, 2019 at 9:40 AM Ole Troan <[e-mail]> wrote:

> >> As Tom mentioned he has started a discussion on the Linux Network list
> >> about FragmentSmack.  I'll report back if they have a more elegant
> >> solution to the problem.
> >>
> >> This is the best write-up I've found discussing the issue.
> >>
> >> https://access.redhat.com/articles/3553061
> >>
> >> Based on the general comments on list and reading about this attack I'm
> >> going to create a draft to give some guidance to implementors for this
> >> attack.
> >
> > Guidance: whenever there is some data structure that could potentially
> > grow without bounds, or a resource that consumed until it is exhausted,
> > and that would affect the system or the communications in which the
> > system is directly or indirectly involved, enforce limits and try to
> > avoid fair use of such resource. Otherwise, we will keep disvovering the
> > same kind of vulnerabiities we have discovered during the last 30 years
> > or so.
> >
> > :-)
> >
> > IP fragmention is no special.
>
> That’s not quite true. IP reassembly is made an easy target because it
> forces the receiver to complete reassembly before it can determine that the
> complete packet was unwanted.
> Isn’t there a reason we see many IP reassembly attacks and not TCP
> segmentation attacks?
> (And that we encourage deprecation of fragmentation at the network layer).
>
> Cheers,
> Ole

Ultimately, that is the issue in this case.    I think the safest thing to
help against an attack like this, is to update the size to something like
640 to allow implementations to not waste CPU time on processing super
small fragments.

~Tim