Re: [secdir] secdir review of draft-ietf-6man-multicast-scopes-05

[Brian Haberman <[e-mail]>]

Hi Tom,

On 6/10/14 12:24 AM, Tom Yu wrote:
> Brian Haberman <[e-mail]> writes:
> 
>>      I do think that the rules in RFC 4007 adequately cover the boundary
>> handling for realm-scoped multicast addresses.  The general rule defined
>> in 4007 is that a multicast packet is forwarded if there is forwarding
>> state and a scope boundary is configured on the router that is equal to
>> or greater than the scope contained in the multicast packet.
> 
> I'm not sure I see where that behavior is defined in RFC 4007, but
> perhaps I lack context or am misreading something.  What happens when a
> router receives a packet destined for an address having scope=3, but the
> router doesn't have an explicitly-configured zone boundary for that
> scope and also doesn't understand realm-local scope?  Would it drop the
> packet (no routing information for the unconfigured zone of scope=3) or
> restrict it to the largest zone of lower scope (protect inter-zone
> integrity)?

I think the context needed is in the second list in section 5 of 4007.
If a router does not have a boundary instantiated for scope=3 *or
larger*, the packet would be forwarded if forwarding state exists for
the multicast address.  If no forwarding state exists for that address
or a boundary exists for scope>=3, the packet is dropped.

> 
> Wouldn't forwarding that packet within a larger zone and scope cause the
> packet to possibly leave its intended zone, where its destination
> address might have a meaning unintended by the sender?
> 

There are two rules in 4007 that cover this...

   o  Zones of the same scope cannot overlap; i.e., they can have no
      links or interfaces in common.

   o  A zone of a given scope (less than global) falls completely within
      zones of larger scope.  That is, a smaller scope zone cannot
      include more topology than would any larger scope zone with which
      it shares any links or interfaces.

Regards,
Brian