Subject: [Fwd: New Version Notification for draft-gont-6man-teredo-loops-00]

From: Fernando Gont <[email-masked]>
Date: Wed, 08 Sep 2010 04:19:11 -0300

Hi, folks,

FYI.

Thanks!

Kind regards,
Fernando

-------- Original Message --------
Subject: New Version Notification for draft-gont-6man-teredo-loops-00
Date: Wed,  8 Sep 2010 00:15:31 -0700 (PDT)
From: IETF I-D Submission Tool <[email-masked]>
To: [email-masked]

A new version of I-D, draft-gont-6man-teredo-loops-00.txt has been
successfully submitted by Fernando Gont and posted to the IETF repository.

Filename:	 draft-gont-6man-teredo-loops
Revision:	 00
Title:		 Mitigating Teredo Rooting Loop Attacks
Creation_date:	 2010-09-08
WG ID:		 Independent Submission
Number_of_pages: 7

Abstract:
Recently, a number of routing loop vulnerabilities were discovered in
Teredo.  This document specifies a number of security checks to be
performed by Teredo hosts and Teredo servers such that these
vulnerabilities are eliminated.

The IETF Secretariat.

-- 
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

---

From: "Rémi Denis-Courmont" <[email-masked]>
Date: Thu, 9 Sep 2010 05:51:48 +0300

Hello,

As far as I understand, the attack in §2.1 requires that the victim processes 
an IPv4 packets whereby both source and destination are equal to a local 
assigned address. Any sane IPv4 stack will reject such a packet, unless it 
comes from the loop back.

The user (or 'root') could still inject such a packet. But that amounts to 
shooting oneself in the foot. And this won't have the devastating bandwidth 
escalation effect from the USENIX paper - it will merely waste CPU cycles 
looping back a packet.

The recommendation in §2.1.2 basically states that Teredo relays should not 
exist. That would formally make Teredo an isolated IPv6 island. Then there's 
not much point in Teredo.

As for the attack in §2.2, I think it was already discussed here:
http://www.ietf.org/mail-archive/web/ipv6/current/msg10801.html
But again, it seems to assume the IPv4 stack accepts packets with its own 
source address yet coming from the outside.

-- 
Rémi Denis-Courmont
http://www.remlab.net/

---

From: Fernando Gont <[email-masked]>
Date: Fri, 10 Sep 2010 15:27:48 -0300

Hi, Remi,

Thanks so much for your comments! -- Please find my responses inline....

> comes from the loop back.

I'd probably agree, but: do stacks actually reject those packets? -- For
instance, this attack seems to be effective against MS Teredo
implementation....

> not much point in Teredo.

Not sure why you think so. I'm basically arguing that if your node is
multihomed, it should not use the Teredo node to route packets e.g.
received from the local LAN over the Teredo tunnel towards the Internet.
-- for instance, these packets would not pass the source address
verification checks, anyway!

Same thing in the opposite direction: what you receive over the Teredo
tunnel should be destined to yourself, not to other nodes in the LAN.

> http://www.ietf.org/mail-archive/web/ipv6/current/msg10801.html

Will take a look.

> source address yet coming from the outside.

What do you think about the proposed countermeasure?

Thanks!

Kind regards,