Subject: Re: permission control for IPV6_REACHCONF

From: Erik Nordmark <[email-masked]>
Date: Thu, 25 May 2000 08:19:57 -0700 (PDT)

Sorry for the delay in responding - I've had it on my todo list for
quite a while.

> According to draft-ietf-ipngwg-rfc2292bis-01.txt, it seems to me that
> any users can set IPV6_REACHCONF cmsg type for an outgoing
> UDP/raw-IPv6 packet.
> 
> However, this option might be dangerous in some situations. Consider
> the following scenario:
> 
> - A node "A" resolves the link-layer address of another node "B", and
>   then starts communicating with B.
> - After starting the communication, a malicious user opens a UDP
>   socket to B, and continuously sends packets to B with the
>   IPV6_REACHCONF option.
> - Then the neighbor cache entry for B will never be stale, and NUD
>   will never occur even if B is down.
> 
> I'm not sure if we should regard such a scenario as a threat, but it
> would be much safer to limit use of the option to privileged users.

I agree that there is a risk for somewhat of a Denial of Service attack here.
But it is a fairly small possibility; not only do the attacking application
need to run on the same machine, it also has no effect until there is
actually a reachability problem.
So I don't know how serious problem this is.

Restricting its use to priviledged users means that e.g. the resolver library
(when invoked by a non-priviledged process) can't provide reachability
confirmation over UDP.
I think that would be unfortunate.

   Erik

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: JINMEI Tatuya / 神明達哉<[email-masked]>
Date: Fri, 26 May 2000 02:24:12 +0900

>>>>> On Thu, 25 May 2000 08:19:57 -0700 (PDT), 
>>>>> Erik Nordmark <[email-masked]> said:

> I think that would be unfortunate.

Right, and I feel this is a tradeoff issue. I personally think it is
okay not to restrict the use of the option as long as comments on the
possible attacks are stated. What do others think?

					JINMEI, Tatuya
					Communication Platform Lab.
					Corporate R&D Center, Toshiba Corp.
					[email-masked]
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: [email-masked]
Date: Fri, 26 May 2000 07:56:59 +0900

>possible attacks are stated. What do others think?

	I think it is unfortunate, but I vote for restrictive way (i.e. require
	root privilege).  another way may be to interpret, in the kernel, like
	this:
	- consider IPV6_REACHCONF from privileged user as very trustworthy
	- consider IPV6_REACHCONF from normal user as less trustworthy
	  information, just as hint.  do not 100% rely upon reachability
	  confirmation came from normal user.
	not sure how to implement the latter.  let me think.

itojun

---

From: Francis Dupont <[email-masked]>
Date: Sun, 28 May 2000 15:39:25 +0200

>possible attacks are stated. What do others think?
   
=> I believe this is the best solution.

=> I think the word is more complex than root and normal users, there are
in modern OSs more than two levels of privileges then please keep the door
open, ie. a comment is enough.

Regards

[email-masked]