Re: [RFC/PATCH] "strict" ipv4 reassembly

[Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>]

On Wed, May 18, 2005 at 01:36:47AM +0200, Patrick McHardy wrote:
> 
> You mean vulnerable at reassembly time? Isn't that something reassembly
> and policy checks should take care of?

I mean that it's vulnerable to the following simple DoS attack by
someone who doesn't otherwise have the capability to drop the
packets between the source and the target.

If the IPsec packets arrive as fragments, the attacker only needs
to guess the identity to cause the entire IPsec packet to be dropped.

If it was fragmented prior to IPsec it would not be vulnerable to
this.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt