Subject: Re: Last Call: Multicast Listener Discovery (MLD) for IPv6 to Proposed Standard

From: Thomas Narten <[email-masked]>
Date: Thu, 19 Aug 1999 11:56:17 -0400

This document is now being balloted by the IESG. In reviewing the
document, I noted one issue that might be worth thinking about, as
this is a decision that cannot easily be changed later.

In MLD, all packets must originate from a link-local address, and the
Hop Limit field is set to 1 prior to sending a packet. If we assume
that routers will check and not improperly forward packets that have
link-local source addresses, an intruder could only interfere with the
MLD protocol running on the same link to which it attaches.

> 9.  Security Considerations
> 
> We consider the ramifications of a forged message of each type.  Note
> that the requirement that nodes verify that the IPv6 Source Address of
> all received MLD messages is a link-local address defends them from act-
> ing on forged MLD messages originated off-link, so we discuss only the
> effects of on-link forgery.

When ND was developed, requiring that packets originate from a
link-local source address was deemed insufficient to prevent off-link
attacks. It was asserted that routers might ignore the check and
forward such packets anyway as a performance enhancement. Thus, ND has
the Hop Limit == 255 check, where on receipt a packet is not accepted
if its Hop Limit is < 255. This ensures that no packet traversing a
router will be accepted for processing.

Question: Should MLD also make use of the 255 hack, or is the current
approach sufficient?

The tradeoff issue I see is the following:

1) As currently defined, it may be possible for a remote node to send
a Report message indicating that there is a listener for a particular
group on a link. This could be used to fool a router on a remote link
to believe it should begin forwarding a high-bandwidth audio/video
stream to that link, overwhelming (say) a low-bandwidth access link
between a site and the internet. Note: this can only happen if routers
improperly forward messages originating from link-local source
addresses.

2) On the other hand, using the Hop Limit == 255 hack would cause
Report messages (which are sent to the specific multicast group they
are reporting on) to possibly be forwarded beyond the local link
(again, only if routers skipped the source address check), resulting
in traffic going further than it needs to.

The current draft prevents the problem in 2), because all packets have
a TTL of 1.

Question: Is problem 1) a significant enough concern that it should be
addressed via the 255 hack?  Are there other attacks from off-link
sources that we need to worry about? (note: the security
considerations section does a good job of outlining
vulnerabilities. I've appended it FYRP.)

Thomas

9.  Security Considerations

We consider the ramifications of a forged message of each type.  Note
that the requirement that nodes verify that the IPv6 Source Address of
all received MLD messages is a link-local address defends them from act-
ing on forged MLD messages originated off-link, so we discuss only the
effects of on-link forgery.

Query message:

     A forged Query message from a machine with a lower IP address than
     the current Querier will cause Querier duties to be assigned to the
     forger.  If the forger then sends no more Query messages, other
     routers' Other Querier Present timer will time out and one will
     resume the role of Querier.  During this time, if the forger
     ignores Done messages, traffic might flow to addresses with no lis-
     teners for up to [Multicast Listener Interval].

     A forged Query message sent to an address with listeners will cause
     one or more nodes that are listeners to that address to send a
     Report.  This causes a small amount of extra traffic on the link,
     but causes no protocol problems.

Report message:

     A forged Report message may cause routers to think there are lis-
     teners for an address present on a link when there are not.  How-
     ever, since listening to a multicast address is generally an
     unprivileged operation, a local user may trivially gain the same
     result without forging any messages.

Done message:

     A forged Done message will cause the Querier to send out Multicast-
     Address-Specific Queries for the address in question.  This causes
     extra processing on each router and on each of the address's lis-
     teners, and extra packets on the link, but cannot cause loss of
     desired traffic.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------