Re: Non-Last Small IPv6 Fragments

[Bob Hinden <[e-mail]>]

Tim,

> On Jan 11, 2019, at 5:44 AM, Timothy Winters <[e-mail]> wrote:
> 
> As Tom mentioned he has started a discussion on the Linux Network list about FragmentSmack.  I'll report back if they have a more elegant solution to the problem.
> 
> This is the best write-up I've found discussing the issue.
> 
> https://access.redhat.com/articles/3553061
> 
> Based on the general comments on list and reading about this attack I'm going to create a draft to give some guidance to implementors for this attack.

Reading the article, the potential attack applies to IPv4 and IPv6.  The article doesn’t say anything about < 1280 sized IPv6 fragments, just:

“….change the default 4MB and 3MB values of net.ipv4.ipfrag_high_threshand net.ipv4.ipfrag_low_thresh (and their IPv6 counterparts net.ipv6.ipfrag_high_thresh and net.ipv6.ipfrag_low_thresh) sysctl parameters to 256 kB and 192 kB (respectively) or below.”

Still confused as to the issue.

Thanks,
Bob






> 
> ~Tim
> 
> On Fri, Jan 11, 2019 at 8:31 AM Bjoern A. Zeeb <[e-mail]> wrote:
> On 11 Jan 2019, at 3:02, Brian E Carpenter wrote:
> 
> Hi,
> 
> > If an RFC7195 translator receives an IPv4 fragment, it will translate
> > it into an IPv6 fragment. So if the IPv4 fragment is "small" by some
> > definition, so is the IPv6 fragment.
> >
> > I think that's a legitimate route to non-last fragments shorter than
> > 1280, regardless of what is considered normal for IPv6.
> 
> I think this topic has been re-hashed in the past often enough.
> 
> I want us to stop thinking that there’s anything but IPv6 if we ever
> want fragments to be “clean” and sorted and usable and working.
> It’s a total waste of time to sort this out for a transition
> technology as it’d be a major change to IPv6 implementations and
> involving end nodes and translator nodes (*) and by that time that would
> have happened IPv4 is no longer relevant.
> 
> Can we please start looking ahead to the decades of IPv6-only before we
> need to extend “real-time” communications to Mars and outside of our
> galaxy? (+)
> 
> 
> /bz
> 
> 
> (*) If you really wanted to you’d need a way to signal the min-MTU
> violation from the translator exception case to the end not and you’d
> probably need some kind of extension header for that.  Sadly this
> wasn’t done 20 years ago and neither for 8200.
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------