On 01/12/2012 12:03 AM, Alexander Bluhm wrote: > Drop overlapping IPv6 fragments in pf reassembly code. RFC 5722 > is demanding that. Our stack does that already. > > The text "constituent fragments, including those not yet received, > MUST be discarded" does not make clear, how long to do that. The > easiest way for pf is to wait until the packet is complete and drop > it then. > > Is that a good idea or should we wait for the reassembly timeout?
I'd argue that you should drop all the "constituent fragments" as soon as you receive them. Since there's no legitimate reason of overlapping fragments, get rid of them asap. And if there were more fragments (for the same packet) coming, they will be dropped as a result of the reassembly timeout. Thanks, -- Fernando Gont e-mail: [email protected] || [email protected] PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1
