Subject: RE: Limiting the Use of Site-Local

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Thu, 31 Oct 2002 01:33:48 +0100

> > => Are you saying that site-local traffic would start
  > > leaking outside the site and routed globally? 
  > > As in transient ISPs will just forward it? 
  > 
  > Of course the ISP's will forward them -- they (probably) 
  > haven't been
  > configured to be part of any sites 

=> Forward them where?? I can't imagine BGP not filtering
SLs coming from the downstream customers. Regardless
of what the spec says. 

Hesham
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Pekka Savola <[email-masked]>
Date: Thu, 31 Oct 2002 11:07:43 +0200 (EET)

> SLs coming from the downstream customers. Regardless

BGP is not the point.  Consider e.g.:

[attacker] --- [internet] ---- [ISP] --- [customer w/ site locals]

Now the attacker can send packets with a fec0::/10 source address to the
customer -- no one will block them unless they're explicitly configured as
site borders -- before the customer itself.  And if the customer does not
block them, we're in for very serious trouble.

That seemed to be what everyone except me read the ADDRARCH paragraph to
imply.  I thought attackers first-hop router (or at the latest, attackers
edge router) should block these packets automatically.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Margaret Wasserman <[email-masked]>
Date: Thu, 31 Oct 2002 10:02:58 -0500

>block them, we're in for very serious trouble.

Far be it from me to argue the other side in this debate, but...

I agree that the packet with a site-local source would get
through to the customer's site.  But, what serious trouble
would this cause?

This would only cause trouble, I guess, if the customer's
system attributes some special security status to packets
that appear to come _from_ a site-local address, which would
be quite inadvisable.

Margaret

---

From: Pekka Savola <[email-masked]>
Date: Thu, 31 Oct 2002 17:05:56 +0200 (EET)

> that appear to come _from_ a site-local address, which would

The whole point (or a big portion of it..) of the "security benefit" of
site-local addresses comes from the added trust given to site-local
addresses (which by the site's definition, are only reachable from inside
the site).