Subject: permission control for IPV6_REACHCONF

From: JINMEI Tatuya / 神明達哉<[email-masked]>
Date: Mon, 17 Apr 2000 16:12:10 +0900

Hello,

According to draft-ietf-ipngwg-rfc2292bis-01.txt, it seems to me that
any users can set IPV6_REACHCONF cmsg type for an outgoing
UDP/raw-IPv6 packet.

However, this option might be dangerous in some situations. Consider
the following scenario:

- A node "A" resolves the link-layer address of another node "B", and
  then starts communicating with B.
- After starting the communication, a malicious user opens a UDP
  socket to B, and continuously sends packets to B with the
  IPV6_REACHCONF option.
- Then the neighbor cache entry for B will never be stale, and NUD
  will never occur even if B is down.

I'm not sure if we should regard such a scenario as a threat, but it
would be much safer to limit use of the option to privileged users.

I'd like to know your (and other implementors') opinion this.

Thanks.

					JINMEI, Tatuya
					Communication Platform Lab.
					Corporate R&D Center, Toshiba Corp.
					[email-masked]

p.s. KAME's latest implementation has (experimentally) introduced the
restriction.
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------