Subject: Redirect ICMP and TAHI test?

From: Markku Savela <[email-masked]>
Date: Mon, 19 Feb 2001 14:38:06 +0200

In RFC-2461 "8.1 Validation of Redirect Messages" there is

"- The IP source address of the Redirect is the same as the current
   first-hop router for the specified ICMP Destination Address."

In TAHI Neighbor Discovery test 62, it introduces two routers, then
sends a redirect from "one" of them, and expects the redirect to have
an effect...

...and in my code it doesn't, because I currently coded the validation
literally in respect to the above entry. I take the destination
address and check from the routing table which router would actually
be getting this destination. And, as it happens, I pick the "other"
and validation declares the redirect as invalid (e.g. I get a redirect
from router, to wich I would not have sent the packet in question...)

So, I assume I have to loosen the test, and accept redirects from any
router, which potentially might be valid for the destination (for
example, any of the default routers), even if it is not my "current
first-hop router for the destination"?

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Erik Nordmark <[email-masked]>
Date: Mon, 19 Feb 2001 15:31:33 +0100 (CET)

Sounds like the TAHI test might be making an invalid assumption.

The idea behind the validity test is that a node should only accept
a redirect from router R1 if the node very recently sent a packet
to R1 that was for the destination.

In your implementation do you have something similar to a "destination cache"
which retains the next hop where you last sent packet?
Or do you always do a lookup and find the default route(s)?

  Erik

>----- Begin Included Message -----<

Date: Mon, 19 Feb 2001 14:38:06 +0200
From: "Markku Savela" <[email-masked]>
Subject: Redirect ICMP and TAHI test?
To: [email-masked]

>----- End Included Message -----<

---

From: OKABE Nobuo <[email-masked]>
Date: Tue, 20 Feb 2001 11:37:25 +0900

Hi Markku,

Thank you for your feedback.
I need your help to start examining the test that you pointed.

Could you give me a name of the test instead of number?
	ex. ncStateByRedirect4Reachable.seq 

Test number is frequently changed.

I would appreciate your help.

From: Markku Savela <[email-masked]>
Subject: Redirect ICMP and TAHI test?
Date: Mon, 19 Feb 2001 14:38:06 +0200

> first-hop router for the destination"?

--- nobuo

---

From: OKABE Nobuo <[email-masked]>
Date: Tue, 20 Feb 2001 11:37:25 +0900

Hi Markku,

--- nobuo

---

From: Markku Savela <[email-masked]>
Date: Wed, 21 Feb 2001 14:52:55 +0200

I would like get clarification to section 5.5.3 (e): what is supposed
to happen with the preferred lifetime? Do the two hour checks apply to
it too? [if not, then DOS can force all addresses into deprecated
state].

However, I have some doubts whether this two-hour rules gives any
protection against DOS attacks. Anyone can read the RFC, and note:
"Ok, that won't work, but let's try some other things...", like

 fake a number of RA's from same or different routers, with *LOTS* of
 different prefixes

=> Either the target nodes runs out of memory or if there is upper
   limit of prefixes (like I have), they overwrite existing valid ones
   or prevent new ones from being entered. Any ideas how to prevent
   this?

Perhaps one should only rely that the "official" routers monitor the
RA's and raise an alarm, if they see unknown routers or inconsitent
information? Anyone trying to DOS from the local net would quickly be
caught? 

Of course, there is the IPSEC, but...

 seems that only manual SA's will work (can't run IKE for this). (For
 RA's, a single unidirectional SA with DST=allnodes multicast would do
 the trick, SA wouldn't need the src addres either, the same could be
 used by all routers).

=> the keys must be widely known so that valid users can install their
   machines on the net. Not too secure, but I suppose better than
   nothing.

After RA's are passing securely, things get easier, because you can
start using IKE in some cases. It's a kind of bootstrapping process
that needs to be designed...?
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: JINMEI Tatuya / 神明達哉<[email-masked]>
Date: Sat, 24 Feb 2001 20:22:51 +0900

>>>>> On Wed, 21 Feb 2001 14:52:55 +0200, 
>>>>> Markku Savela <[email-masked]> said:

> it too? [if not, then DOS can force all addresses into deprecated

I don't think so.  Section 5.5.4. of RFC 2462 says
   A deprecated address SHOULD continue to be used as a source
   address in existing communications, but SHOULD NOT be used in new
   communications if an alternate (non-deprecated) address is available
   and has sufficient scope.

Thus, even if all addresses become deprecated, you can still use all
the addresses as the source address for a new communication, because
there's no other non-deprecated addresses.

I admit the "two-hour" rule is not a complete solution against all
types of DOS attack, though.

					JINMEI, Tatuya
					Communication Platform Lab.
					Corporate R&D Center, Toshiba Corp.
					[email-masked]
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------