Re: [tcpm] 793bis: what to say about source routing

Hi, Wes,

The text in RFC793bis is correct and sufficient regarding TCP. TCP has no business making recommendations about what options IP uses.

Let’s please not continue to propagate the misconception that features that are not expected are either errors or attacks. And let’s please stop citing this deeply flawed work that is not BCP. Whether IP source routing is disabled or not on a system should be of no consequence to TCP. It is either used or not; when used, TCP *MUST* support its use

Joe

—
Joe Touch, temporal epistemologist
www.strayalpha.com

> On Nov 29, 2021, at 7:12 PM, Wesley Eddy <wes@mti-systems.com> wrote:
> 
> One of the IESG comments that needs to be addressed on 793bis regards source routing.  There is the comment:
> 
> [S3.9.2.1]
> 
> * I feel like there should be some additional caveat about security
>   implications of support for source routing.  RFC 6274, for example, says
>   packets with LSRR (6274s3.13.2.3) and SSRR (6274s3.13.2.4) options should
>   be dropped, citing various security concerns.
> 
>   I'm not sure there needs to be a lot of text; perhaps just an observation
>   that some end systems may not support the source route semantics described
>   here for security (or policy) reasons?
> After looking at what 6274 says (which is Informational) and 793bis, here are my main thoughts:
> 
> (1) The text in question was written for IPv4, prior to IPv6 with its own methods (deprecated RH0, and now other things like segment routing).
> 
> (2) I'm not aware of anything changing with regard to 1122's description of IPv4 source routing support in IP stacks.
> 
> (3) Looking at defaults on popular Linux systems, it looks like "net.ipv4.conf.default.accept_source_route = 1" is not uncommon ... so source routing support probably still exists.  I didn't look at what the TCP code does though, with regard to incoming source routed packets to see if it matches what 793bis says.
> 
> So, my suggestion is that we rename that section of 793bis (section 3.9.2.1) to be specific to *IPv4* source routing, and then append at the end of the section a sentence like:
> 
> RFC 6274 describes security concerns with IP source routing, and source routing may be disabled or unsupported on some systems.
> 
> Does this sound good?  Note that it basically leaves any flavors of IPv6 source routing unmentioned (which seems right, since there isn't anything on standards track to use).  I would be very happy if someone more knowledgeable about the state of source routing support and usage could check this and share their thoughts.
> 
> 
> 
> 
> 
> _______________________________________________
> tcpm mailing list
> tcpm@ietf.org
> https://www.ietf.org/mailman/listinfo/tcpm