IETF Logo Mail Archive

Re: [savi] Potential issue for all SAVI mechanisms?

Mikael Abrahamsson <swmike@swm.pp.se> Wed, 22 June 2011 06:27 UTC

Return-Path: <swmike@swm.pp.se>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 15CFA11E80A7 for <savi@ietfa.amsl.com>; Tue, 21 Jun 2011 23:27:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q1ijdJv5CbT6 for <savi@ietfa.amsl.com>; Tue, 21 Jun 2011 23:27:44 -0700 (PDT)
Received: from uplift.swm.pp.se (ipv6.swm.pp.se [IPv6:2a00:801::f]) by ietfa.amsl.com (Postfix) with ESMTP id 39A5B11E8070 for <savi@ietf.org>; Tue, 21 Jun 2011 23:27:44 -0700 (PDT)
Received: by uplift.swm.pp.se (Postfix, from userid 501) id DD9919C; Wed, 22 Jun 2011 08:27:41 +0200 (CEST)
Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id D828C9A for <savi@ietf.org>; Wed, 22 Jun 2011 08:27:41 +0200 (CEST)
Date: Wed, 22 Jun 2011 08:27:41 +0200
From: Mikael Abrahamsson <swmike@swm.pp.se>
To: savi@ietf.org
In-Reply-To: <4E017D0B.8090301@it.uc3m.es>
Message-ID: <alpine.DEB.2.00.1106220825010.26369@uplift.swm.pp.se>
References: <BANLkTi=Te8AS+sdhOGtCvgFqa48dHc80WQ@mail.gmail.com> <F29187458BA64F46BE7069B37C4CF19D@junbiVAIOz138> <4E013482.3080405@joelhalpern.com> <70DEE8BFA1794CA9B6694032363C3460@junbiVAIOz138> <4E017D0B.8090301@it.uc3m.es>
User-Agent: Alpine 2.00 (DEB 1167 2008-08-23)
Organization: People's Front Against WWW
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset="US-ASCII"; format="flowed"
Subject: Re: [savi] Potential issue for all SAVI mechanisms?
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 22 Jun 2011 06:27:45 -0000

On Wed, 22 Jun 2011, marcelo bagnulo braun wrote:

> If not, maybe we could simply say that SAVI will ignore the fragmented 
> packets.

What do you mean by "ignore", do you mean drop?

It's my firm belief that any security measure needs to take into account 
these corner cases and properly handle them (with the same security), 
allowing anyone to send RA just because they're sending them fragmented is 
not ok. It's better to drop these packets than to allow them.

-- 
Mikael Abrahamsson    email: swmike@swm.pp.se

v2.23.0 | Report a Bug | By Email