Subject: RE: ICMPv6 echo reply to multicast packet thread

From: [email-masked]
Date: Thu, 11 Mar 2004 01:28:39 -0600

> - As discussed in the context of the ICMPv6 spec revision, there are
>    similar multicast respond flooding issues even with base IPv6
>    processing before you get to any "application" such as ping.
>    Unrecognized destination option, for instance, would cause a
>    flood of responses.

This has been described as point 5 in the Security Considerations 
section of the latest draft (draft-ietf-ipngwg-icmp-v3-03.txt).

> In general, we may not wish to limit the ability of applications
> to respond to multicast, that may be needed in some cases. However,
> applications that do respond to multicast probably want to say
> something about the remaining case in their security considerations
> section. Some applications may also use some form of source 
> authentication to ensure that only the legitimate sender's messages 
> are processed.

I agree.

> This still leaves open what the behaviour for ICMPv6 Echo Request
> should be. I would not bundle this issue with what the other
> applications do, but my default answer would be to not respond
> to multicast requests unless there is a specific reason to do
> so. In this case there seems to be some discussion about multicast
> debugging capabilities. I do not have experience of that myself.
> Are multicast echo requests the primary multicast debugging
> mechanism? If yes, we should allow responses to be sent. If not,
> I agree with Suresh that it should be disallowed. Note that
> multicast debugging through echo responses is naturally limited
> to rather small multicast groups ;-) So I suspect people who
> need multicast in a large scale are going to need another
> debugging tool in any case.

I do not have any preferences here either.  I agree with Pekka
that it should be either MUST or MUST NOT.  Leaving it as a 
SHOULD is not a good idea.

Now, who can tell if multicast echo request is the primary 
multicast debugging mechanism or not ??

Regards
Mukesh

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Pekka Savola <[email-masked]>
Date: Thu, 11 Mar 2004 12:19:21 +0200 (EET)

> multicast debugging mechanism or not ??

It is extensively used for link-local at least, and used a bit for 
wider scopes as well.

But IMHO the real question is this: as there are a number of ways how
you could elicit this "response storm" from any node at all (e.g.,
using the parameter problem trick, using TCP/UDP which is bound to the
wildcard address, etc.), I'm not sure if I see the need for expressly
prohibiting ICMPv6 echo requests -- it would seem like (mostly) wasted
effort to close one door, while leaving the other two dozen doors
open.  Whether there are 24 or 25 open doors doesn't really impact the
overall security but only create more corner cases the implementations
should get right.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings