netdev - Re: [PATCH net-next-2.6] ipv6: make fragment identifications less predictable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20110721.161301.1825037422957926629.davem@davemloft.net>
Date:	Thu, 21 Jul 2011 16:13:01 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	rick.jones2@...com
Cc:	fernando@...t.com.ar, eric.dumazet@...il.com, security@...nel.org,
	eugeneteo@...nel.sg, netdev@...r.kernel.org, mpm@...enic.com
Subject: Re: [PATCH net-next-2.6] ipv6: make fragment identifications less
 predictable

From: Rick Jones <rick.jones2@...com>
Date: Thu, 21 Jul 2011 15:46:21 -0700

> On 07/21/2011 03:17 PM, David Miller wrote:
>> From: Fernando Gont<fernando@...t.com.ar>
>> Date: Wed, 20 Jul 2011 22:32:18 -0300
>>
>>> Does it make sense to go in this direction rather than simply
>>> randomize
>>> the IPv6 Fragment Identification?
>>
>> We could, but that's actually a bit more work.
>>
>> You have to avoid recycling IDs to the same destination host otherwise
>> a retransmit could use the same ID and overlap with a previous set of
>> frags, causing corruption.
> 
> I think you mean ID reuse rather than packet retransmit no?
> 
> It is the same "frankengram" issue present in IPv4 with its now puny
> 16 bit id field. Doesn't that pretty much rely on layer4 or higher
> checksums to avoid corruption?

We've had documented cases where checksums match after recycling the
fragment ID space in ipv4, that's why we have all of the special
code in the ipv4 fragmentation handling to work around that problem.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html