Subject: Query about draft-gont-6man-ipv6-smurf-amplifier-01

From: Suresh Krishnan <[email-masked]>
Date: Fri, 15 Mar 2013 13:30:03 -0400

Hi Fernando,
  While I am supportive of getting rid of ICMPv6 responses for 10xxxxxx
options, I am not at all sure about how probable this attack is. My
understanding is that for this attack to work, the following two
conditions need to be met.

a) Ingress filtering MUST NOT be enabled on the attacker side
b) multicast RPF on the path MUST NOT catch the packet and throw it away

Is my understanding correct?

Thanks
Suresh

---

From: Fernando Gont <[email-masked]>
Date: Fri, 15 Mar 2013 15:31:16 -0400

Hi, Suresh,

Thanks so much for your comments! -- Please see inline...

> Is my understanding correct?

Yes, it's correct.

However, as noted on the "Next steps with
draft-ong-t6man-preditable-fragment-id", one usually cannot rely on such
filtering. That's mostly why e.g. reflection attacks are still an issue.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

---

From: Brian Haberman <[email-masked]>
Date: Fri, 15 Mar 2013 16:50:27 -0400

> filtering. That's mostly why e.g. reflection attacks are still an issue.

You cannot rely on a) occurring, but b) is done by all multicast routers 
for loop prevention.

Brian

---

From: Fernando Gont <[email-masked]>
Date: Fri, 15 Mar 2013 17:16:41 -0400

> You cannot rely on a) occurring, but b) is done by all multicast routers

I don't know *all* of multicast routers, but in any case, Section 1 of
the document states:

"     It should be noted that if the multicast RPF check is used (e.g.
      to prevent routing loops), this would prevent an attacker from
      forging the Source Address of a packet to an arbitrary value, thus
      preventing an attacker from launching this attack against a remote
      network.

      Chapter 5 of [Juniper2010] discusses multicast RPF configuration
      for Juniper routers."

Thanks!

Cheers,