Subject: Re: IPv4 linklocal security

From: Stuart Cheshire <[email-masked]>
Date: Mon, 2 Apr 2001 23:22:47 -0700

>There are a number of things that could be done in
>order to improve resilience to such attacks, aside
>from setting TTL=255 (which would cause backwards
>compatibility problems). For example, Dave Thaler
>has suggested:
>
>1. Dropping packets on the host that are destined to
>   the linklocal prefix, but don't originate from the
>   linklocal prefix.
>
>2. Dropping packets on the host that originate from
>   the linklocal prefix that are destined for
>   non-linklocal prefixes.
>
>Implementing these two things would require the attacker
>to use both linklocal source and destination addresses.
>Ideally, a home gateway should have address spoofing protection
>enabled so that it will not accept any packets originating
>from the internal prefix on its external interface. That
>would kill all spoofs, not just linklocal ones.

I support this solution, instead of setting TTL = 255.

I think the draft should say, "MUST set TTL to 1".

Setting TTL = 1 at least limits *outward* leakage of link-local 
addresses, which is a good thing -- we don't want to give the 169.254 
network a bad name by annoying network administrators with lots of 
spurious traffic.

My feeling about the inbound security risk is this:

Inbound packets have got to get onto your link somehow. That means a 
router. Even today's routers won't deliver packets directly to a host on 
a local link unless you tell the router that the specified destination is 
directly reachable on that link -- e.g.:

 ifconfig eth0 169.254.1.2 netmask 255.255.0.0 broadcast 169.254.255.255
 route add -net 169.254.0.0 netmask 255.255.0.0 eth0

Unless you do that, the router won't have any knowledge of net 
169.254/16, so it will just bounce the packets to its default gateway.

Am I missing something here?

Stuart Cheshire <[email-masked]>
 * Wizard Without Portfolio, Apple Computer
 * Chairman, IETF ZEROCONF
 * www.stuartcheshire.org

---

From: "Bernard Aboba" <[email-masked]>
Date: Wed, 4 Apr 2001 09:57:24 -0700

>Am I missing something here?

No, except that the default route may get you quite a ways (try a
traceroute and see). As Daniel Senie suggested, I think you really
want a router who receives packets to 169.254/16 to send them to
the "bit bucket".