Subject: Re: Oppose: LL29 Link-local sources should specify TTL=1

From: Stuart Cheshire <[email-masked]>
Date: Wed, 12 Mar 2003 23:21:23 -0800

Thomas Narten wrote:
>This is clearly a broken configuration and will result in LL in
>general not working. I.e., two nodes, both on Link A, both using LL
>addresses, won't be able to communicate. The Router will grab their
>traffic and forward it to the wrong place.  Right?

No, Router A is not "grabbing" traffic.

A malicious attacker on Link A is deliberately sending traffic to Router 
A to exploit its misconfiguration in order to print offensive material on 
the LL printer on Link B.

Stuart Cheshire <[email-masked]>
 * Wizard Without Portfolio, Apple Computer, Inc.
 * www.stuartcheshire.org

---

From: Thomas Narten <[email-masked]>
Date: Thu, 13 Mar 2003 09:46:20 -0500

> > > Now suppose that Link A and Link B have LL hosts on them.
> > 
> > > The only additional requirement for a malicious host on Link A to send a
> > > packet to a LL destination on Link B is that either Gateway-A or Gateway-B
> > > has been configured with a route which directs the LL prefix onto
> > > Link B.

> the LL printer on Link B.

OK. But its still a misconfiguration (and one that doesn't seem all
that likely to me, since its really an odd configuration). However, if
one looks at the specific vulnerability, it's not IMO
huge. Specifically, it allows an attacker on a link one hop away from
the target network to (incorrectly) cause a LL packet to be delivered
to a network behind a neighboring router.

Yes, this is a vulnerability compared to the router not forwarding the
packet at all. But iIt is also not equivalent to opening a gaping hole
that allows an arbitrary attacker anywhere on the internet from
sending LL traffic to some target network.  Is it a big enough
vulnerabiliy that it needs to be prevented in all cases (e.g, by using
something like the TTL = 255 on reciept)? I personally have a hard
time seeing that.

Thomas