Re: Question for IPv6 w.g. on [Re: IPv6 Type 0 Routing Header issues]

On Thu, Apr 26, 2007 at 12:16:46PM +0200, Brian E Carpenter wrote:
> Excuse my ignorance, but have the following three rules ever been
> considered?
> 
> 1. The list of addresses in an RH0 MUST NOT include the packet's source 
> address.
> 2. The same address MUST NOT occur more than once in an RH0.
> 3. A node processing an RH0 MUST discard any packet breaking these two 
> rules.
> 
> I'd be interested in whether this would eliminate the various attacks.

I think we did talk about some rules like this before, maybe about
the time of the security considerations draft. I think these rules
make the attack only slightly more difficult, while at the same
time making some possibly valid uses of RH0 require trickery.

For example, these rules make it hard to use traceroute to find a
round-trip route from me to you. The obvious thing to do here is
do a traceroute where SRC=me, RH0[0]=you, RH0[1]=me. Of course, I
can always get almost the same information by doing SRC=me, RH0[0]=you
RH0[1]=someone_in_my_subnet.

You can use the same idea to make the attacks work even with the
restrictions above. If I want to flood a link, I find hosts X1 ...
XN on one side of the link and Y1 ... YN on the other side. Then I
send lots of packets with RH0[0] = X1, RH0[1] = Y1, RH0[2] = X2,
RH0[3] = Y2, ...

	David.

--------------------------------------------------------------------
IETF IPv6 working group mailing list
ipv6@ietf.org
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------