Re: [v6ops] Security Considerations for draft-gont-v6ops-ipv6-ehs-in-real-world

[Brian E Carpenter <[e-mail]>]

On 04/09/2014 11:55, Mark Andrews wrote:
> In message <[e-mail]>, Fernando Gont writes:
>> Folks,
>>
>> Based on the recent discussions, we're planning to update Section 5.2
>> (which contains all the discussion about the ICMP-based attack vector)
>> of the aforementioned I-D as follows. Please let us know if you have any
>> comments:
>>
>> ---- cut here ----
>> 5.2.  A possible attack vector
>>
>>    The widespread filtering of IPv6 packets
> 
> 	with Extension Headers by enterprise firewalls
> 
>>                                               employing IPv6 Extension
>>    Headers can, in some scenarios, be exploited for malicious purposes:
>>    if packets employing IPv6 EHs are known to be filtered on the path
>>    from one system (say, "A") to another (say, "B"), an attacker could
>>    cause packets sent from A to B to be dropped by sending a forged
>>    ICMPv6 Packet Too Big (PTB) [RFC4443] error message to A (with a
>>    Next-Hop MTU smaller than 1280), such that subsequent packets from A
>>    to B include a fragment header (i.e., they result in atomic fragments
>>    [RFC6946]).
> 
> IPv6 packets with fragmentation headers get through if you don't
> stuff a device with deliberately blocks them in the path.  This is
> self inflicted pain.

I think the problem is that isn't painful at all to the people who
configure the blocking device. It's only painful to actual users.

   Brian
>