Re: Non-Last Small IPv6 Fragments

[Fernando Gont <[e-mail]>]

On 11/1/19 11:40, Ole Troan wrote:
[....]
>>
>> Guidance: whenever there is some data structure that could potentially
>> grow without bounds, or a resource that consumed until it is exhausted,
>> and that would affect the system or the communications in which the
>> system is directly or indirectly involved, enforce limits and try to
>> avoid fair use of such resource. Otherwise, we will keep disvovering the
>> same kind of vulnerabiities we have discovered during the last 30 years
>> or so.
>>
>> :-)
>>
>> IP fragmention is no special.
> 
> That’s not quite true. IP reassembly is made an easy target because it forces the receiver to complete reassembly before it can determine that the complete packet was unwanted.
> Isn’t there a reason we see many IP reassembly attacks and not TCP segmentation attacks?

TCP is harder to understand, probably, and not many publicly available
tools out there (I haven't seen anything other than the tcp6 I
crafted... and it's v6-only). And for the script-kidde, his fw is
already shooting himself in his own foot.

There's lot's of things you can do with TCP, such as flooding nodes with
connections -- even ones for which there's no controlling process
anymore, etc. This warrants some testing which I never did
comprehensively, indeed.



> (And that we encourage deprecation of fragmentation at the network layer).

I do agree that network layer is bad idea, and also that it is even
harder to defend against frag-based attacks (in a sense since you cannot
even, say, limit #fragments/prefix, since spoofing is trivial).
Although I don't think this sort of mitigation is actually implemented
in TCP, either, particularly for the v6 cases, where you have a
virtually unlimitted number of addresses to spoof from.

Still, my comment above still holds: Connections will be degreded... but
at least you won't get DoS in the sense of ping o' death -- which kind
of seems to be the case here, if I understand correctly.

I've reproduced DoS-type of attacks for virtually every IPv6 data
structure we have: routes, configured addresses, neighbor cache, etc.
Things have improved a bit lately, though.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492