Subject: RE: [Ipoverib] What's inside an IPoIB link layer address?

From: "Jim Pinkerton" <[email-masked]>
Date: Thu, 17 Jan 2002 10:09:13 -0800

Vivek,

Using the source address for the Spanning Tree algorithm for bridging
(not routing) is required on Ethernet. Thus on Ethernet at least, the
source address is *always* the same as the true source - otherwise
spanning tree doesn't work. Technically you could make the argument that
the true restriction is that the side of the bridge that the spoofer
sits on just has to be the same as the spoofee - but no-one does it that
way that I'm aware of. KISS rules(keep it simple stupid). 

In fact, if you allow what you are suggesting it is technically a
security hole. That's why on some networks even gratuitous ARP replies
are intentionally discarded. If you only allow ARP replies to ARP
requests, then if you have a spoofing malicious user out there you'll
get two replies (and thus detect the spoofer and signal a problem to the
network admin).

Jim

> -----Original Message-----
> From: Vivek Kashyap [mailto:[email-masked]]
> Sent: Wednesday, January 16, 2002 11:31 AM
> To: Arvind Murching
> Cc: Vivek Kashyap; [email-masked]
> Subject: Re: [Ipoverib] What's inside an IPoIB link layer address?
> 
>         A device can always respond for another. The LID of the sender
>         is not the same as the LID for which it has responded. It also
>         allows any network monitoring/debugging device to work
>         independently. This is the reason why none of the other media
>         does anything like this. You don't pick ethernet source
>         address from the frame but take it from the ARP/ND packet.
> 
>         [ If it was ok we wouldn't need anything except QPN/cap_flags
>         - get the LID from response, consult SA using LID for GID if
>         you want that, and you are done. ]
> 
> Vivek
> 
> >
> > Why do we need to include the LID inside the link layer address when
it
> > is already available in the SLID field? Previous discussions
indicate
> > that the SLID value works for proxy ARP/bridge implementations.
> >
> > - Arvind
> >
> > -----Original Message-----
> > From: Vivek Kashyap [mailto:[email-masked]]
> > Sent: Wednesday, January 16, 2002 10:29 AM
> > To: [email-masked]
> > Cc: [email-masked]
> > Subject: Re: [Ipoverib] What's inside an IPoIB link layer address?
> >
> > Ashwin,
> > Ashwin,
> >
> >         I agree that you get more flexibility if you include the
LID.
> >         If we include the GID along with the LID we allow all
> >         implementations the choice to create different solutions. We
> >         don't tie them down to one thing. Choosing one or the other
> >         (LID or GID) blocks out various advantages that different
> >         implementations seek. Hence I suggested that let us include
> >         both and move on.
> >
> > Vivek
> >
> > <snip>
> >
> > _______________________________________________
> > IPoverIB mailing list
> > [email-masked]
> > http://www.ietf.org/mailman/listinfo/ipoverib
> >
> 
> 
> --
> Vivek Kashyap
> Linux Technology Center, IBM
> [email-masked]
> [email-masked]
> 503 578 3422 (o)
> 
> _______________________________________________
> IPoverIB mailing list
> [email-masked]
> http://www.ietf.org/mailman/listinfo/ipoverib

_______________________________________________
IPoverIB mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/ipoverib

---

From: Vivek Kashyap <[email-masked]>
Date: Thu, 17 Jan 2002 10:28:05 -0800 (PST)

Jim,
        The spanning tree is a different than IP connectivity
        information exchanged via ARP. Notice that the ARP packets
        duplicate the ethernet source/destination information in the
        ARP packet. The address is not picked up from the frame.

        A spoofer can give the wrong GID too. Kiss any security
        good-bye if that is all it is based on. If you think that is
        hard - there are no safeguards against any of the SA updates.
        It can be a DoS attack if non-existent GIDs are returned.

        Additionally, consider the case at present where there is one
        particular point across the IB subnet that can be contacted.
        It is only one single point of that type. A local IPoIB device
        responds with the IB routers LID and the remote points GID in
        response to the ARP. Things work. It is a valid example
        whether you like it or not. I think Roger and Yaron have
        talked of such devices.

        Thirdly, there is the implementational simplicity and
        flexibility that comes with including the LID. Those that
        always want to go to the SA, ignore the LID and do so. Those
        that think the responders value is good enough can use it. Why
        is that a problem ? I would like to know the answer to that.

        I have explained in earlier mails how the LID can be ignored,
        I probably don't need to tell anyone that, but it can be
        ignored very easily by those that want to. 

Vivek