netdev - Re: Fwd: RFC 6980 on Security Implications of IPv6 Fragmentation with IPv6 Neighbor Discovery

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAOp4FwTPuY9H=w_A7vdwiJv3RqKLWnf+Nk=q8xaa9sN6+g4j1g@mail.gmail.com>
Date:	Mon, 19 Aug 2013 00:52:57 +0400
From:	Loganaden Velvindron <loganaden@...il.com>
To:	Loganaden Velvindron <loganaden@...il.com>,
	Fernando Gont <fernando@...t.com.ar>,
	netdev <netdev@...r.kernel.org>
Subject: Re: Fwd: RFC 6980 on Security Implications of IPv6 Fragmentation with
 IPv6 Neighbor Discovery

On Thu, Aug 15, 2013 at 2:25 PM, Hannes Frederic Sowa
<hannes@...essinduktion.org> wrote:
>
> On Thu, Aug 15, 2013 at 02:14:46PM +0400, Loganaden Velvindron wrote:
> > I'm not sure if you got my previous mails, but I'd like to know a
> > couple of things:
>
> Ah, you asked me off-list. So, for a wider audience, I copy & paste my answers
> from the just answered mail. ;)
>
> > 1) How can I test this diff ?
>
> Actually, nothing should change at all.
>
> Myself, I used scapy to construct some packets and send it to a system
> with the patched kernel and had some printks sprinkeled in the source
> while watching tcpdump.
>
> > 2) It's developed against which git brach ? linux-next ?
>
> Yes, I targeted linux-next. But it should apply to older kernels
> without too much fuzz as well.
>

I've tested with linux-next.

> > 3) What will/could break with this diff in a production environment ?
>
> RA messages could get fragmented if a speaker puts lots of options in it. I
> hope all RA speakers already spread the options over multiple RAs, but I don't
> know. In case the RA is fragmented it will now be dropped silently.
>

My IPv6 gateway machine runs OpenBSD, and so far, no issues with it.
I'm going to test
it at work in a couple of hours and report back.


> Thanks,
>
>   Hannes
>



-- 
This message is strictly personal and the opinions expressed do not
represent those of my employers, either past or present.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html