Subject: Re: Treatment of scoped addresses carried in extension headers

From: Steve Deering <[email-masked]>
Date: Thu, 14 Oct 1999 07:21:19 -0700

At 4:00 AM -0700 10/14/99, Brian Zill wrote:
>But what about scoped addresses in extension headers?  For example, in
>routing headers and mobility options? ...
>
>I can see three actions a node could take upon encountering such a header.
>I can also see arguments for and against each one.
>
>1) Treat the scoped address as meaningful in the zone that the interface the
>packet arrived on belongs to.  This has the advantage of being simple to
>implement and the disadvantage that in order to be useful, the originator of
>the header would need detailed (?) information about the network topology.
>In the absence of such information, the packet could easily be interpreted
>incorrectly.

This is the approach I prefer.  (No, the "correct" behavior has never been
decided or written down.)  In order to construct a useful Routing header
or mobility option, one needs a certain amount of (not necessarily
"detailed") topological information anyway, so my inclination is to assume
that the sender knows what he/she/it is doing and is operating under the
assumption that receivers behave according to your suggestion number (1).
If senders do something meaningless, they will get meaningless behavior
in response.

>  One could also argue that allowing remote nodes to send to a
>local node that only has a link-local address via clever use of a routing
>header is a security problem.  Others might see this as a handy feature.

One shouldn't think of scoped addresses as giving you security against
unwanted traffic arriving from outside a zone.  There are many ways such
traffic can arrive, including higher-layer forwarding (e.g., transport
layer proxies, application-level relays, etc.)  We cannot write a
practical spec on how to filter out all such behaviors.

The only security property one should assume of scoped addresses is that
packets containing a scoped source or destination address, sent from
well-behaved senders (i.e., senders that don't try to play tricks with
routing headers, etc.), will not leave the zone of the smaller-scoped of
the two addresses.  And note that that's not a particularly strong
security property, given that any zone can include tunnel links (either
at layer 2 or layer 3) that cross arbitrary "external" paths.

Steve

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------