Subject: RE: [LL2]: Explicit Additional Mechanism to disable v4LL

From: "Christian Huitema" <[email-masked]>
Date: Wed, 19 Feb 2003 08:06:57 -0800

>   | Most of the text here seems ok, with the exception of the last
> sentence:
>   |
>   | "Where that configuration
>   | mechanism uses DHCP, the node MUST implement the DHCP option to
> disable
>   | stateless auto-configuration in IPv4 clients [RFC2563]."
>   |
>   | If we accept the resolution of Issue 1, then we already have a way
to
>   | disable stateless auto-configuration -- provide a DHCPv4 address.
As a
>   | result, this last sentence is unnecessary.
> 
> No, that omits the possibility that what is desired is to disable LL
> addressing *without* allocating a routable address.   That is, to tell
> the node that there's no point configuring IP on the LAN to which it
> is connected (most likely, it is plugged into the wrong place).

I agree with KRE's assessment. This is not a security issue, but a
usability issue. Suppose a network in which, for whatever reason, the
resident hosts have been configured not to interact with LL addresses.
In such a network, the visiting host which configures an LL address will
find out eventually that it cannot communicate with any other host.
Wouldn't it be better to have a way to learn that immediately?

-- Christian Huitema

---

From: Mika Liljeberg <[email-masked]>
Date: 19 Feb 2003 20:27:59 +0200

> Wouldn't it be better to have a way to learn that immediately?

You mean like put up a popup for the user rather than wait for him to
try to connect to something? That sounds like a lot of fun waiting to
happen...

Besides, if two such nodes are plugged in, wouldn't it be better to have
the communicate with each other even if the resident nodes refuse to
communicate with them?

	MikaL

---

From: Ted Lemon <[email-masked]>
Date: Wed, 19 Feb 2003 11:53:48 -0700

> Suppose a network in which, for whatever reason, the

Sure.  There are lots of things that would be nice.   Some of them 
create opportunities for denial of service.   This is one.   Are you 
willing to have this immediate notification in one rare situation, in 
exchange for opening yourself up to a really easy denial of service 
attack?

---

From: Keith Moore <[email-masked]>
Date: Wed, 19 Feb 2003 14:40:11 -0500

On Wed, 19 Feb 2003 11:53:48 -0700
Ted Lemon <[email-masked]> wrote:

> create opportunities for denial of service.   This is one.  

Given that DHCP is used at all, I don't see how the risk of DoS is increased
by allowing DHCP to specify that LL not be used.  And a host that is fooled 
into configuring LL when it should have acquired a routable address has still 
been successfully attacked.  LL is simply not an adequate fallback for
most hosts on most networks.

---

From: Ted Lemon <[email-masked]>
Date: Wed, 19 Feb 2003 13:03:19 -0700

> And a host that is fooled
> been successfully attacked.

Keith, you're not making sense.   How do you fool a host *into* 
configuring LL?

---

From: Keith Moore <[email-masked]>
Date: Wed, 19 Feb 2003 15:15:38 -0500

> > And a host that is fooled into configuring LL when it should have acquired
> > a routable address has still been successfully attacked.
> 

by somehow blocking the DHCP server's response.

Keith

---

From: Bernard Aboba <[email-masked]>
Date: Wed, 19 Feb 2003 11:05:41 -0800 (PST)

> Keith, you're not making sense.   How do you fool a host *into*

And what difference does it make if you do, assuming that the LLv4 address
isn't used?

---

From: Bernard Aboba <[email-masked]>
Date: Wed, 19 Feb 2003 11:05:03 -0800 (PST)

> by allowing DHCP to specify that LL not be used.

Issue #23 already takes care of making sure that LLv4 will not be used if
DHCPv4 is present. So that is already taken care of, no?

> been successfully attacked.

How can it be attacked if the LLv4 address is configured, but not used? Is
the issue that the host will be willing to receive on the LLv4 address?
How would that occur if it is not advertised?

> LL is simply not an adequate fallback for most hosts on most networks.

I'd agree.

---

From: Keith Moore <[email-masked]>
Date: Wed, 19 Feb 2003 15:40:43 -0500

> How would that occur if it is not advertised?

use is the real issue.  I don't care much if hosts configure LL addresses as
long as they don't use them at inappropriate times.

---

From: Keith Moore <[email-masked]>
Date: Wed, 19 Feb 2003 15:41:46 -0500

> >How do you fool a host *into* configuring LL?
> 

the point is that fallback to LL is not an effective defense against
DoS attack.

Keith