Re: Non-Last Small IPv6 Fragments

[Fernando Gont <[e-mail]>]

On 11/1/19 10:44, Timothy Winters wrote:
> As Tom mentioned he has started a discussion on the Linux Network list
> about FragmentSmack.  I'll report back if they have a more elegant
> solution to the problem.
> 
> This is the best write-up I've found discussing the issue.
> 
> https://access.redhat.com/articles/3553061
> 
> Based on the general comments on list and reading about this attack I'm
> going to create a draft to give some guidance to implementors for this
> attack.

Guidance: whenever there is some data structure that could potentially
grow without bounds, or a resource that consumed until it is exhausted,
and that would affect the system or the communications in which the
system is directly or indirectly involved, enforce limits and try to
avoid fair use of such resource. Otherwise, we will keep disvovering the
same kind of vulnerabiities we have discovered during the last 30 years
or so.

:-)

IP fragmention is no special.

-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492