Subject: [Anima] GTSM in draft-ietf-anima-autonomic-control-plane-02

From: Brian E Carpenter <[email-masked]>
Date: Sun, 17 Apr 2016 13:29:35 +1200

Hi,

A bit of advice on a security matter, please!

I was thinking about how I would add the following requirement to the GRASP
prototype code:

>    o  GRASP link-local multicast discovery messages MUST use GTSM
>       [RFC5082].  With GTSM, discovery packets are sent with a TTL of
>       255 and packets received with a TTL smaller than 255 are ignored
>       upon receipt.

I hit a problem. The advice I gathered from various on-line sources was
to set IPV6_MULTICAST_HOPS to 1 for link-local multicasts. Since they are
by definition link-local, a hop limit of 1 makes sense. In any case the
packets can never be forwarded to another link by a layer 3 action,
whatever the hop limit.

(Experimentally, it doesn't seem to matter what hop limit is set in
LL multicasts, which is logical enough since they are never forwarded.
But 1 makes more sense than 255.)

GTSM seems to have been designed to protect against forged off-link
unicast packets. AFAIK, link-local multicast packets can't be forged
by an off-link attacker. An on-link attacker can do whatever it wants,
including implementing GTSM. So I don't see what threat GTSM mitigates
in our case.

    Brian

---

From: "Michael Behringer (mbehring)" <[email-masked]>
Date: Mon, 18 Apr 2016 13:58:02 +0000

I believe GTSM doesn't make sense for link local packets, since, as you point out, they can't be forwarded beyond the link anyway. 

So I think we should write: 
- if link local: GTSM not needed
- if unicast to direct neighbour (do we ever do that?): GTSM is a strong SHOULD (if not MUST)
- if unicast to further away nodes: More complicated, only makes sense if we can predict the maximum path length in all conditions, which tends to be hard. 

Michael

> -----Original Message-----
> From: Anima [mailto:[email-masked]] On Behalf Of Brian E
> Carpenter
> Sent: 17 April 2016 03:30
> To: Anima WG <[email-masked]>
> Cc: Nancy Cam-Winget (ncamwing) <[email-masked]>
> Subject: [Anima] GTSM in draft-ietf-anima-autonomic-control-plane-02
> 
> Hi,
> 
> I was thinking about how I would add the following requirement to the
> GRASP prototype code:
> 
> I hit a problem. The advice I gathered from various on-line sources was to set
> IPV6_MULTICAST_HOPS to 1 for link-local multicasts. Since they are by
> definition link-local, a hop limit of 1 makes sense. In any case the packets can
> never be forwarded to another link by a layer 3 action, whatever the hop
> limit.
> 
> (Experimentally, it doesn't seem to matter what hop limit is set in LL
> multicasts, which is logical enough since they are never forwarded.
> GTSM seems to have been designed to protect against forged off-link unicast
> packets. AFAIK, link-local multicast packets can't be forged by an off-link
> attacker. An on-link attacker can do whatever it wants, including
> implementing GTSM. So I don't see what threat GTSM mitigates in our case.
> 
>     Brian
> 
> _______________________________________________
> Anima mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/anima