Subject: Question about MLD messages, related to SEND-06, link-local multicast groups (like all-nodes), and host MLD signaling ...

From: "John Spence, CCSI, CCNA, CISSP" <[email-masked]>
Date: Thu, 27 Jan 2005 17:52:56 -0800

I don't understand a few things as I read Section 9.1 of the 06 SEND Draft.
I've provided the passage below, and added my comments at ">>" marks.

I may be wrong about how MLD works - if so please enlighten me.

Thank you.

------------- start ---------------

9.1 Threats to the Local Link Not Covered by SEND

(stuff snipped out)

Prior to participating in Neighbor Discovery and Duplicate Address
Detection, nodes must subscribe to the link-scoped All-Nodes
Multicast Group and the Solicited-Node Multicast Group for the
address that they are claiming for their addresses; RFC 2461 [7].

>> I understand this to be correct.

Subscribing to a multicast group requires that the nodes use MLD
[19].

>> I don't understand this.  I don't believe a node needs to use MLD
to subscribe to these link-local multicast addresses.  MLD is used to
signal the DR for the link about what non link-local multicast messages
a host wants to receive.  For link-local multicast groups, I believe the
node just starts listening for them - no MLD required.

MLD contains no provision for security.  An attacker could
send an MLD Done message to unsubscribe a victim from the
Solicited-Node Multicast address.  

>> I don't understand this.  I don't believe a host would be listening for
MLD Done messages - routers would be.  If a host received an MLD Done
message I don't believe it would stop listening for link-local multicast
groups. 

>> I don't believe a router, upon receiving an MLD Done message for FF02::1,
FF02::2, or solicited-node-multicast group would honor the message, and stop
listening to those addresses either.

However, the victim should be able
to detect such an attack because the router sends a
Multicast-Address-Specific Query to determine whether any listeners
are still on the address, at which point the victim can respond to
avoid being dropped from the group.  This technique will work if the
router on the link has not been compromised.  Other attacks using MLD
are possible, but they primarily lead to extraneous (but not
overwhelming) traffic.

--------- end ------------

----------------------------------------------------
John Spence, CCSI, CCNA, CISSP
Native6, Inc.
IPv6 Training and Consulting
[email-masked]
www.native6.com
----------------------------------------------------

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

---

From: Brett Pentland <[email-masked]>
Date: Mon, 31 Jan 2005 12:02:59 +1100

> node just starts listening for them - no MLD required.
A node should use MLD for link-scope addresses in order to allow correct
operation of MLD-snooping switches (I am not aware of any yet, but
there are certainly IGMP-snooping switches for IPv4 - this is needed for
efficient implementation of multicast rather than just broadcasting all
multicast packets).

There is an inconsistancy though.  Both MLDv1 and MLDv2 state that MLD
messages are *not* sent for the all-nodes link scope multicast group:

MLDv1 (RFC2710), section 5:

    MLD messages ARE sent for multicast addresses whose scope is 2
    (link-local), including Solicited-Node multicast addresses [ADDR-
    ARCH], except for the link-scope, all-nodes address (FF02::1).

And MLDv2 (RFC3810), section 6:

    The link-scope all-nodes multicast address, (FF02::1), is handled as
    a special case.  On all nodes -- that is all hosts and routers,
    including multicast routers -- listening to packets destined to the
    all-nodes multicast address, from all sources, is permanently enabled
    on all interfaces on which multicast listening is supported.  No MLD
    messages are ever sent regarding neither the link-scope all-nodes
    multicast address, nor any multicast address of scope 0 (reserved) or
    1 (node-local).

> message I don't believe it would stop listening for link-local multicast
I agree.  And I don't think a router would care, since it's not
forwarding link-scope messages anyway.  An MLD-snooping switch might
react to a done message but it would only stop delivering packets to
the attacker (if it was delivering them in the first place).
> listening to those addresses either.
I don't think the document actually says that it would.

> --------- end ------------

Regards,
Brett.