Subject: RE: Limiting the Use of Site-Local

From: Margaret Wasserman <[email-masked]>
Date: Tue, 29 Oct 2002 17:11:40 -0500

At 04:57 PM 10/29/02, Hesham Soliman (EAB) wrote:

>   > or to put it another way, why do you have so much faith in
>   > filters of SL addresses and so little faith in filters of prefixes?
>   >
>
>=> Because they're not configured, they're hardcoded.

No, they aren't.

You can't hardcode site-local address filtering in every router,
or you won't be able to communicate inside a site.

So the router will need to be configured, somehow, to block
site-local addresses from being forwarded from one interface
to another.  And that configuration isn't any more inviolate
than a traditional forwarding filter.

Margaret

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Pekka Savola <[email-masked]>
Date: Wed, 30 Oct 2002 15:16:19 +0200 (EET)

> than a traditional forwarding filter.

To (try to) clarify: the SL filters can be defined by hardcoding them
(basically just two trivial access-lists for example), but they cannot be
_enabled_ except manually or by some rather complex logic.

.. thus making the argument about the ease of use pretty much irrelevant
IMO ..

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Margaret Wasserman <[email-masked]>
Date: Wed, 30 Oct 2002 09:17:44 -0500

>.. thus making the argument about the ease of use pretty much irrelevant

Exactly.

It makes any argument that site-local filters are more "secure"
than global filters pretty much irrelevant, too...

If you can compromise the edge router and change its configuration,
you can get either intra-site global or site-local traffic to be
forwarded outside of the site.

Margaret

---

From: Pekka Savola <[email-masked]>
Date: Wed, 30 Oct 2002 16:28:48 +0200 (EET)

> forwarded outside of the site.

Totally agree; but I'd also add a simpler case: someone forgot to
explicitly configure (or like I did, when reading the spec -- assumed that
it should get done automatically) the site scope in the edge router(s).
Whoops!  

Watching the amount of spoofed traffic nowadays, most of which could be
prevented by proper filtering, doesn't give me any reassuration that
people would actually do this too.. and then wonder why their private
site-local address space has been compromised..

(Note that the above clarification implicitly considered multi-sited
routers out of scope: they will both have to be manually defined and
manually taken to use.  Even the simple case is so difficult to do 
properly.)