Subject: RE: [mobile-ip] I-D ACTION:draft-mccann-mobileip-80211fh-01.txt

From: "Mohamed Khalil" <[email-masked]>
Date: Mon, 11 Nov 2002 14:37:40 -0600

Hi James,

The ingress filter defines the addresses which could be passed or dropped as
follows:

    IF    packet's source address from within 204.69.207.0/24
    THEN  forward as appropriate

    IF    packet's source address is anything else
    THEN  deny packet

So, according to the above rule we could let the AR, when it receives HI
message, to add the following rule:

    IF    packet's source address from within 204.69.207.0/24
    THEN  forward as appropriate

    IF    packet's source address is MN's-oCOA/0
    THEN  forward as appropriate

    IF    packet's source address is anything else
    THEN  deny packet

Of course the actual implementation of those rules is just a table which
define the IP addresses and their ranges, which are allowed to pass. The
Access Router will add a new entry in this table for each MN's COA.

-Mohamed
-----Original Message-----
From: James Kempf [mailto:[email-masked]] 
Sent: Monday, November 11, 2002 1:32 PM
To: Alper E. YEGIN; Pete McCann
Cc: Rajeev Koodli; [email-masked]
Subject: Re: [mobile-ip] I-D ACTION:draft-mccann-mobileip-80211fh-01.txt

> I wasn't necessarily in agreement with the unspecified address use 
> actually, just topologically incorrect address use (e.g., oldCoA). And 
> this discussion does not relate to PANA discussion on unspec. address 
> use.
>
> How is this creating a major security hole? What is it that the 
> attacker can do, and how does the administrator of the access network 
> (collection of ARs and
> more) cannot identify the offender? Note that the pinhole in the 
> filter should just allow a host to send a FBU to one of the ARs, 
> that's it.
>

It allows someone to mount a DoS attack on the router. The attacker can't be
confined to operating from the same link because the old router could be at
arbitrary topological distance away from the new link.

            jak

---

From: "James Kempf" <[email-masked]>
Date: Mon, 11 Nov 2002 13:36:12 -0800

I was not clear.

I meant that allowing a MN to send an F-BU with the null source address from the
new link opens the old AR to untracable DoS attacks.

I was not talking about anything else. The current 05 draft deals with the case
of how to handle ingress filtering with the tunnel.

            jak

----- Original Message -----
From: "Mohamed Khalil" <[email-masked]>
To: "'James Kempf'" <[email-masked]>
Cc: "Rajeev Koodli" <[email-masked]>; <[email-masked]>;
"Alper E. YEGIN" <[email-masked]>; "Pete McCann" <[email-masked]>
Sent: Monday, November 11, 2002 12:37 PM
Subject: RE: [mobile-ip] I-D ACTION:draft-mccann-mobileip-80211fh-01.txt