Subject: Re: Worldnet.att.net via Linux PPP Connection

From: [email-masked] (Bruce Perens)
Date: Fri, 13 Sep 96 14:05 PDT

There is a "Disable source routes" prompt when configuring the kernel
(with "make menuconfig" or "make config"). You are free to enable it
when building your own kernel.

I'd like to hear a good explanation of what the security problem is,
and why anyone would want to use source routes.

	Thanks

	Bruce

---

From: Christian Hudon <[email-masked]>
Date: Fri, 13 Sep 1996 20:34:40 -0700 (PDT)

> and why anyone would want to use source routes.

The security problem? Basically, if you've got source routing enabled, I
can send bad IP packets to your machine and they'll get there. By 'bad' I
mean, say, packets with a wrong 'Source IP' field.

This can be used to get packets from 'outside' through a firewall and make
the packets look like they came from 'inside' to the destination machine,
I believe.

And of course, this is kinda 'helpful' to crack services (eg rsh, etc.)
that put trust into specific IP numbers.

I don't know it that was very clear, but at least it was some kind of an
explanation. Please keep 'Drop source routed frames' enabled in the Debian
kernels.

  Christian

---

From: "David L. Craig" <[email-masked]>
Date: Mon, 16 Sep 1996 09:24:54 -0400 (EDT)

As Bruce Perens wrote:

> Message-Id: <[email-masked]>
> Date: Fri, 13 Sep 96 14:05 PDT
> From: [email-masked] (Bruce Perens)
> To: [email-masked] (Christoph Lameter), "David L. Craig" <[email-masked]>
> Subject: Re: Worldnet.att.net via Linux PPP Connection
> Cc: [email-masked]
> Reply-To: Bruce Perens <[email-masked]>

> and why anyone would want to use source routes.

The only legitimate use of source routing of which I am aware
is for testing explicit network routes, determining their
RTTs, etc.  Illegitimate uses are attacks employing address
spoofing, sequence number guessing, ICMP Redirects,  and
undoubtedly many other methods, with results running from
denial of service to complete compromise of a host.  I am not
enough of a security maven to provide a better explanation,
though I'm trying to become more knowledgable.  "Firewalls
and Internet Security" by Cheswick and Bellovin makes for
sobering reading, but leaves much as an exercise to the
reader.  Perhaps the more knowledgable, like Alan Cox, could
provide a satisfactory explanation.

Again, my point is:  shouldn't there be a mention of the basics
(be sure IP forwarding and source routing are not enabled) with
an end user level of explanation of why not, a pointer to more
info, and an encouragement to be sure the local network admin
is aware of the link?