Subject: RE: Limiting the Use of Site-Local

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Thu, 31 Oct 2002 14:16:46 +0100

> > => Forward them where?? I can't imagine BGP not filtering
  > > SLs coming from the downstream customers. Regardless
  > > of what the spec says. 
  > 
  > BGP is not the point.  Consider e.g.:
  > 
  > [attacker] --- [internet] ---- [ISP] --- [customer w/ site locals]
  > 
  > Now the attacker can send packets with a fec0::/10 source 
  > address to the
  > customer -- no one will block them unless they're 
  > explicitly configured as
  > site borders -- before the customer itself.  And if the 
  > customer does not
  > block them, we're in for very serious trouble.

=> So you're talking about two misconfigured 
sites and you didn't say, where is the attack ?

Also even if this happens it's a one-way 
communication because if the customer tries 
to reply packets will go nowhere.

Hesham
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Pekka Savola <[email-masked]>
Date: Thu, 31 Oct 2002 16:17:28 +0200 (EET)

> sites and you didn't say, where is the attack ?

One misconfigured site, of the victim.

ISP doesn't need to care about them, and Internet certainly doesn't.

The attackers site wasn't explicitly configured to use site-locals (they
probably even don't use them -- only globals), so it isn't blocked in
their routers -- this is a feature of your interpretation of the addrarch.

> to reply packets will go nowhere.

If you have e.g. security hole in a protocol using UDP, one-way 
communication is more than enough to exploit it.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords