Subject: (IPng 7270) multicast NS without no source lladdr

From: Jun-ichiro itojun Hagino <[email-masked]>
Date: Fri, 05 Mar 1999 17:03:20 +0900

The NDP spec (RFC2461) says that the sender of multicast NS MUST
	attach source link-layer address option to the NS packet.
	However, the NS validation rule on the receiver side does not reject
	such packet.

	I would like to understand the reason for the difference:
	- What is the reason for the difference?
	  (1) Just an inconsistency
	  (2) "be strict on what you send, be liberal on what you receive"
	- Which is the expected behavior for the receiver side, when it
	  receives multicast NS packet *without* souce link-layer address
	  option?
	  A. reject the packet (more strict than spec)
	  B. accept the packet, try sending new NS to the sender to get
	     link-layer address (DoS attack possible by sending tons of
	     multicast NS?)
	Thanks,

[email-masked]

---
sender side
========================================================================
4.3.  Neighbor Solicitation Message Format
      Source link-layer address
                     The link-layer address for the sender.  MUST NOT be
                     included when the source IP address is the
                     unspecified address.  Otherwise, on link layers
                     that have addresses this option MUST be included in
                     multicast solicitations and SHOULD be included in
                     unicast solicitations.
========================================================================

receiver side
========================================================================
7.1.1.  Validation of Neighbor Solicitations

   A node MUST silently discard any received Neighbor Solicitation
   messages that do not satisfy all of the following validity checks:

      - The IP Hop Limit field has a value of 255, i.e., the packet
        could not possibly have been forwarded by a router.

      - If the message includes an IP Authentication Header, the message
        authenticates correctly.

      - ICMP Checksum is valid.

      - ICMP Code is 0.

      - ICMP length (derived from the IP length) is 24 or more octets.

      - Target Address is not a multicast address.

      - All included options have a length that is greater than zero.

      - If the IP source address is the unspecified address, the IP
        destination address is a solicited-node multicast address.

      - If the IP source address is the unspecified address, there is no
        source link-layer address option in the message.
========================================================================
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------