On Thu, Jan 12, 2012 at 3:31 AM, Fernando Gont <[email protected]> wrote:
> On 01/12/2012 12:03 AM, Alexander Bluhm wrote: > > Drop overlapping IPv6 fragments in pf reassembly code. RFC 5722 > > is demanding that. Our stack does that already. > > > > The text "constituent fragments, including those not yet received, > > MUST be discarded" does not make clear, how long to do that. The > > easiest way for pf is to wait until the packet is complete and drop > > it then. > > > > Is that a good idea or should we wait for the reassembly timeout? > > I'd argue that you should drop all the "constituent fragments" as soon > as you receive them. > > Since there's no legitimate reason of overlapping fragments, get rid of > them asap. And if there were more fragments (for the same packet) > coming, they will be dropped as a result of the reassembly timeout. > They will be dropped if the remaining fragments can't be assembled into a complete packet. But when overlapping fragments are combined with the possibility of fragment duplication, I'd argue that you have to store just enough state to be able to either immediately drop newly arriving fragments or tag them as "not to be reassembled". -ken
