RFC 5722
Handling of Overlapping IPv6 Fragments
Handling of Overlapping IPv6 Fragments 🎀
Okay bestie, here's the header info first 💅
- Series: Network Working Group
- Request for Comments: 5722
- Author: S. Krishnan (Suresh Krishnan), Ericsson
- Date: December 2009
- Category: Standards Track
- Updates: 2460
Abstract 🦋
The fragmentation and reassembly algorithm in the base IPv6 spec lets fragments overlap, and that's a whole mess. This doc shows the security issues that come with allowing overlapping fragments, and it updates the IPv6 spec to explicitly forbid them. 🙈
Status of This Memo 📜
This document is an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements. For the current standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited. 💖
Copyright Notice ⭐
Copyright (c) 2009 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, since they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the BSD License. 🫶
Table of Contents 🌈
1. Introduction ....................................................2
1.1. Conventions Used in This Document ..........................2
2. Overlapping Fragments ...........................................2
3. The Attack ......................................................3
4. Node Behavior ...................................................5
5. Security Considerations .........................................5
6. Acknowledgements ................................................5
7. References ......................................................6
7.1. Normative References .......................................6
7.2. Informative References .....................................61. Introduction 🧚
Fragmentation happens in IPv6 when the packet won't fit inside the path MTU to its destination. When that happens, an IPv6 node uses a fragment header, as specified in Section 4.5 of the IPv6 base specification [RFC2460], to break the datagram into smaller fragments that fit in the path MTU. The destination node gets those fragments and reassembles them. The fragmentation algorithm in [RFC2460] doesn't stop fragments from overlapping, and that can cause some security issues with firewalls [RFC4942]. This document looks at the problems overlapping fragments can cause, and it updates the IPv6 spec to explicitly forbid overlapping fragments. ✨
1.1. Conventions Used in This Document 📖
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 🍓
2. Overlapping Fragments 🌸
Commonly used firewalls use the algorithm in [RFC1858] to weed out malicious packets that try to overwrite parts of the transport-layer header so they can get past inbound connection checks. [RFC1858] protects against an overlapping fragment attack on an upper-layer protocol (TCP, in this case) by recommending that packets with a fragment offset of 1 get dropped. That works well for IPv4 fragments, but it won't work for IPv6 fragments. The reason is that the fragmentable part of an IPv6 packet can contain extension headers before the TCP header, which makes this check a lot less effective. 😭
3. The Attack 💀
This attack is about how a malicious node can bypass a firewall using overlapping fragments. Picture a sufficiently large IPv6 packet that needs to be fragmented.
+------------------+--------------------//-----------------------+
| Unfragmentable | Fragmentable |
| Part | Part |
+------------------+--------------------//-----------------------+
Figure 1: Large IPv6 PacketThe sender splits this packet into several fragments so it fits inside the path MTU. Let's say it gets split into two fragments. 🔥
+------------------+--------+--------------------+
| Unfragmentable |Fragment| first |
| Part | Header | fragment |
+------------------+--------+--------------------+
+------------------+--------+--------------------+
| Unfragmentable |Fragment| second |
| Part | Header | fragment |
+------------------+--------+--------------------+
Figure 2: Fragmented IPv6 PacketNow look at the first fragment. Let's say it has a destination options header (DOH) that's 80 octets long, followed by a TCP header. 👑
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<==FH
|NextHdr=DOH(60)| Reserved | FragmentOffset = 0 |Res|1|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Identification=aaaabbbb |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<==DOH
|NextHdr=TCP(6) | HdrExtLen = 9 | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +
| |
. .
. Options .
. .
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<==TCP
| Source Port | Destination Port |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Acknowledgment Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Offset| Reserved |U|A|P|R|S|F| Window |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 3: First FragmentThe TCP header here has S(YN)=1 and A(CK)=1 set. That can make an inspecting stateful firewall think it's a response packet for a connection request that started on the trusted side of the firewall, so it lets the fragment through. It also lets through the following fragments that have the same Fragment Identification value in the fragment header. 🧃
Now the malicious node forms a second fragment with a TCP header that flips the flags to S(YN)=1 and A(CK)=0. On the receiving end, that makes the packet look like a connection request instead of a response. And just like that, the malicious node has slipped past the firewall's access control to start a connection request to a node the firewall protects. 😈
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<==FH
|NextHdr=DOH(60)| Reserved | FragmentOffset = 10 |Res|0|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Identification=aaaabbbb |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<==TCP
| Source Port | Destination Port |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Acknowledgment Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Offset| Reserved |U|A|P|R|S|F| Window |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 4: Second FragmentThis attack is way more serious in IPv6 than in IPv4. In IPv4, the overlapping part of the TCP header doesn't include the source and destination ports. In IPv6, though, the attack can easily replace the source or destination port with an overlapping fragment. 🚨
4. Node Behavior 🔒
IPv6 nodes transmitting datagrams that need to be fragmented MUST NOT create overlapping fragments. When reassembling an IPv6 datagram, if one or more of its constituent fragments is determined to be an overlapping fragment, the entire datagram (and any constituent fragments, including those not yet received) MUST be silently discarded. 🚫
Nodes MAY also provide mechanisms to track the reception of such packets, for instance by implementing counters or alarms for these events. 📊
5. Security Considerations 🛡️
This document discusses an attack that can be used to bypass IPv6 firewalls using overlapping fragments. It recommends disallowing overlapping fragments to prevent this attack. 💜
6. Acknowledgements 🫶
The author would like to thank Thomas Narten, Doug Montgomery, Gabriel Montenegro, Remi Denis-Courmont, Marla Azinger, Arnaud Ebalard, Seiichi Kawamura, Behcet Sarikaya, Vishwas Manral, Christian Vogt, Bob Hinden, Carl Wallace, Jari Arkko, Pasi Eronen, Francis Dupont, Neville Brownlee, Dan Romascanu, Lars Eggert, Cullen Jennings, and Alfred Hoenes for their reviews and suggestions that made this document better. 🎀
7. References 📚
7.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6
(IPv6) Specification", RFC 2460, December 1998.7.2. Informative References
[RFC1858] Ziemba, G., Reed, D., and P. Traina, "Security
Considerations for IP Fragment Filtering", RFC 1858,
October 1995.
[RFC4942] Davies, E., Krishnan, S., and P. Savola, "IPv6
Transition/Co-existence Security Considerations", RFC
4942, September 2007.Author's Address 💖
Suresh Krishnan
Ericsson
8400 Blvd Decarie
Town of Mount Royal, Quebec
Canada
EMail: suresh.krishnan@ericsson.com📦 where this page comes from
- ietf: rfc5722 2009-12
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms