Subject: (IPng 7536) Re: Last Call: IPv6 Jumbograms to Proposed Standa rd

From: "Steven M. Bellovin" <[email-masked]>
Date: Fri, 14 May 1999 15:16:35 -0400

In message <[email-masked]>, "Matt Crawford" writes:
> > u_short ip_id;                  /* identification */
> >                 meaningless after reassembly
> > short   ip_off;                 /* fragment offset field */
> >                 changes en route
> 
> When fragmentation is done en route, the bad guy can insert bogus
> fragments, making correct reassembly an exponential problem.  Even
> when fragmentation is done solely by the source, the rules for AH
> (reassembly before ICV check) make the same attack possible.

If fragmentation is done en route, as in IPv4, the offset field is mutable,
and hence isn't checkable.  We could presumably check the 'id' field, but
that doesn't help; the bad guy could still replay fragments with changed
offset fields.

For IPv6, there might be some merit to checking the 'id' field (though
frankly I need to think about that one some more); however, RFC 2402 explicitly
excludes the fragmentation header from AH calculations (see Appendix A.2).

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Steve Deering <[email-masked]>
Date: Fri, 14 May 1999 17:48:39 -0700

At 3:16 PM -0400 5/14/99, Steven M. Bellovin wrote:
>frankly I need to think about that one some more); however, RFC 2402 explicitly excludes the fragmentation header from AH calculations

Steve

The IPv6 spec requires that the Fragment Header be discarded after
reassembly, which occurs before AH verification, so there won't be
any ID field for AH to check.

(Symmetrically, at the sender end, AH computation is assumed to be
performed before fragmentation, i.e., before a Fragment Header is
inserted into the packet and a new ID generated, so here also there
is no ID for AH to cover.)

Steve