[193355] in North American Network Operators' Group
Re: ICMPv6 PTBs and IPv6 frag filtering (particularly at BGP peers)
daemon@ATHENA.MIT.EDU (Saku Ytti)
Thu Jan 12 14:32:29 2017
X-Original-To: nanog@nanog.org
In-Reply-To: <11ff128d-2fba-7c26-4a9c-5611433d85d2@si6networks.com>
From: Saku Ytti <saku@ytti.fi>
Date: Thu, 12 Jan 2017 21:31:53 +0200
To: Fernando Gont <fgont@si6networks.com>
Cc: NANOG <nanog@nanog.org>
Errors-To: nanog-bounces@nanog.org
On 12 January 2017 at 17:02, Fernando Gont <fgont@si6networks.com> wrote:
> That's the point: If you don't allow fragments, but your peer honors
> ICMPv6 PTB<1280, then dropping fragments creates the attack vector.
Thanks. I think I got it now. Best I can offer is that B could try to
verify the embedded original packet? Hopefully attacker won't have
access to that information. An if attacker has access to that
information, they may as well do TCP RST, right?
Didn't we have same issues in IPv4 with ICMP unreachable and frag
neeeded, DF set? And vendors implemented more verification if the ICMP
message should be accepted.
--
++ytti
