Re: Fwd: RFC 6980 on Security Implications of IPv6 Fragmentation with IPv6 Neighbor Discovery

[Loganaden Velvindron <loganaden@gmail.com>]

On Mon, Aug 19, 2013 at 12:52 AM, Loganaden Velvindron
<loganaden@gmail.com> wrote:
> On Thu, Aug 15, 2013 at 2:25 PM, Hannes Frederic Sowa
> <hannes@stressinduktion.org> wrote:
>>
>> On Thu, Aug 15, 2013 at 02:14:46PM +0400, Loganaden Velvindron wrote:
>> > I'm not sure if you got my previous mails, but I'd like to know a
>> > couple of things:
>>
>> Ah, you asked me off-list. So, for a wider audience, I copy & paste my answers
>> from the just answered mail. ;)
>>
>> > 1) How can I test this diff ?
>>
>> Actually, nothing should change at all.
>>
>> Myself, I used scapy to construct some packets and send it to a system
>> with the patched kernel and had some printks sprinkeled in the source
>> while watching tcpdump.
>>
>> > 2) It's developed against which git brach ? linux-next ?
>>
>> Yes, I targeted linux-next. But it should apply to older kernels
>> without too much fuzz as well.
>>
>
> I've tested with linux-next.
>
>> > 3) What will/could break with this diff in a production environment ?
>>
>> RA messages could get fragmented if a speaker puts lots of options in it. I
>> hope all RA speakers already spread the options over multiple RAs, but I don't
>> know. In case the RA is fragmented it will now be dropped silently.
>>
>
> My IPv6 gateway machine runs OpenBSD, and so far, no issues with it.
> I'm going to test
> it at work in a couple of hours and report back.

Works fine @ work with cisco routers.

>
>
>> Thanks,
>>
>>   Hannes
>>
>
>
>
> --
> This message is strictly personal and the opinions expressed do not
> represent those of my employers, either past or present.



-- 
This message is strictly personal and the opinions expressed do not
represent those of my employers, either past or present.