Subject: Overlapping fragments in IPv6 and firewalls

From: Suresh Krishnan <[email-masked]>
Date: Mon, 14 Jul 2008 19:29:48 -0400

Hi Folks,
   This draft describes how to use overlapping fragments in IPv6 to 
bypass firewalling restrictions. It recommends disallowing overlapping 
fragments in IPv6.

Thanks
Suresh

-------- Original Message --------
Subject: I-D Action:draft-krishnan-6man-overlap-fragment-01.txt
Date: Mon, 14 Jul 2008 14:15:02 -0700 (PDT)
From: [email-masked]
Reply-To: [email-masked]
To: [email-masked]

A New Internet-Draft is available from the on-line Internet-Drafts 
directories.

	Title           : Issues with overlapping IPv6 fragments
	Author(s)       : S. Krishnan
	Filename        : draft-krishnan-6man-overlap-fragment-01.txt
	Pages           : 7
	Date            : 2008-07-13

The fragmentation and reassembly algorithm specified in the base IPv6
specification allows fragments to overlap.  This document
demonstrates the security issues with allowing overlapping fragments
and updates the IPv6 specification to explicitly forbid overlapping
fragments.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-krishnan-6man-overlap-fragment-01.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

_______________________________________________
I-D-Announce mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Doug Montgomery <[email-masked]>
Date: Wed, 30 Jul 2008 07:28:51 -0400

> bypass firewalling restrictions. It recommends disallowing overlapping 

The following two documents provide fairly detailed analysis of this (and other 
issues) that IPv6 Firewalls should consider:

Firewall Design Considerations for IPv6
http://www.nsa.gov/snac/ipv6/I733-041R-2007.pdf

A Filtering Strategy for Mobile IPv6
http://www.nsa.gov/snac/ipv6/I733-040R-2007.pdf

The first document covers other interesting issues with fragments, including the 
possibility of tunneled fragments being fragmented again ... header option 
ordering, etc.

As far as specsmanship to "prohibit" overlapping fragments, if the motivation is 
to change/ensure the behavior of all end nodes, updating 2460 (or some other 
vehicle) might make sense.

If the goal is to effect the behavior of firewalls, what we really need is a 
firewalls capability spec.  As far as I know, firewalls are not required to 
enforce all aspects of protocol correctness ... nor are they required to follow 
all aspects of end to end protocol specs.  So it is questionable if changing 
2460 will impact firewall behavior ... unless the firewall community decides on 
its own that it is a useful/necessary feature to implement.  Maybe it would some 
leverage that customers could use to lean on FW implementors .... but it would 
be indirect.

dougm
-- 
+----------------------------------------------------------------------------+
| Doug Montgomery       Manager, Internetworking Technologies Research Group |
| Advanced Network Technologies Division      WWW: http://www.antd.nist.gov/ |
| National Institute of Standards and Technology      Email:  [email-masked] |
| 100 Bureau Drive                                    Voice: +1-301-975-3630 |
| Gaithersburg, MD 20899-8920 USA                     Fax:   +1-301-975-6238 |
| Key fingerprint =       3BCA EDD0 585D D068 CD46 E578 BD01 92A3 D1B0 04BB  |
+----------------------------------------------------------------------------+