Attribution of the source address Re: What does a unicast source address actually indicate? (Re: RFC2460bis and draft-previdi-6man-segment-routing-header-08)

Andrew 👽 Yourtchenko <ayourtch@gmail.com> Tue, 06 October 2015 08:39 UTC

MIME-Version: 1.0
Date: Tue, 06 Oct 2015 10:39:08 +0200
Message-ID: <CAPi140Pzmg6F2rCqwsovw8x88OCTOLOTfJh-BWnbQbgEdiTixQ@mail.gmail.com>
Subject: Attribution of the source address Re: What does a unicast source address actually indicate? (Re: RFC2460bis and draft-previdi-6man-segment-routing-header-08)
From: Andrew 👽 Yourtchenko <ayourtch@gmail.com>
To: Mark Smith <markzzzsmith@gmail.com>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <http://mailarchive.ietf.org/arch/msg/ipv6/RFnU4BY754w3mRI0-dHOKt4DPfc>
Cc: Erik Nordmark <nordmark@acm.org>, Bob Hinden <bob.hinden@gmail.com>, 6man WG <ipv6@ietf.org>
Precedence: list

On 10/6/15, Mark Smith <markzzzsmith@gmail.com> wrote:

> So I think a unicast source address is fundamentally intended to
> identify a unique and single packet source, to which the contents of
> the whole packet can be attributed.

This is a very interesting observation, for which I will fork another
topic to not pollute the one you created.

This attribution does indeed happen, however:

The current internet architecture does not enforce the validity of
source address in any way (RPF being an optional measure which is not
100% used, so it does not really count).

Thus placing this attribution creates a huge attack surface - NTP, DNS
reflection attacks come to mind immediately.

Thus, I'd consider weakening the assumption "you can trust the source
address" is a good thing (unless the Internet architecture evolves to
make the source more trustable, of course).

--a

Attribution of the source address Re: What does a… Andrew 👽 Yourtchenko