Subject: RE: [NSIS] NATFW NSLP; attack in Section 5.10.1 is not specific to NATs

From: "Hancock, Robert" <[email-masked]>
Date: Fri, 28 Apr 2006 13:13:00 +0100

hi,

[this is not really a follow up to Ali's question but another
issue on 5.10:]

I found at least the introduction of the scenario in 5.10 a 
little difficult to follow from a motivational point of view.
How common is it for IP layer mobility to be used purely on 
the private side of a NAT? (I'm not saying that it's impossible,
just that I tend to think of NATs as reducing the need for
renumbering in small networks, where you wouldn't use IP
mobility in the first place.)

A more significant point is that the mitigation described on
page 81 (second sentence) seems to depend on the end host being 
able to prove session ownership directly to the NAT, but the 
facilities available mainly apply to peer-peer relationships. 
Is the last sentence here actually correct?

r.

> -----Original Message-----
> From: Ali Fessi [mailto:[email-masked]] 
> Sent: 20 April 2006 23:12
> To: nsis
> Subject: [NSIS] NATFW NSLP; attack in Section 5.10.1 is not 
> specific to NATs
> 
> 
> Hi,
> 
> the attack described in Section 5.10.1 (Misuse of mobility in NAT 
> handling) is actually not specific to NATs. Firewalls need also to 
> update their policy rules to support mobility.
> 
> I would modify the description of the attack accordingly and call it 
> "Miuse of Mobility Support" or something like this.
> 
> Also: in the figure 42, the end host does not necessarly need 
> to be on 
> the private side of the network. a Mobile Node can be on both 
> sides of 
> the network; and in both cases, policy rules need to be updated.
> 
> So there shouldn't be a difference between the public and the private 
> network sides.
> 
> Regards,
> Ali
> -- 
> Ali Fessi
> University of Tuebingen, Germany
> 
> _______________________________________________
> nsis mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/nsis
> 

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: Ali Fessi <[email-masked]>
Date: Fri, 28 Apr 2006 14:33:28 +0200

Hi Robert,

> mobility in the first place.)

i'm not an expert in mobility; but i think, if Hierarchical MIP is used, 
then the HMIP anchor point would basically behaves as a NAT. So the 
scenario described in this section would fit well to HMIP.

Maybe someone else can provide a better explanation?!

> Is the last sentence here actually correct?

I guess that the mitigation is meant to be provided hop-by-hop by 
authenticating the user by the NAT.

But I fully agree with you that this section has to be revised.

Cheers,
Ali

-- 
Ali Fessi
Computer Networks and Internet
Wilhelm Schickard Institute for Computer Science
University of Tuebingen, Germany
Phone: +49 7071 29-70534 / Fax: +49 7071 29-5220
EMail: [email-masked]
Web: http://net.informatik.uni-tuebingen.de/~fessi/

---

From: Ali Fessi <[email-masked]>
Date: Fri, 28 Apr 2006 15:39:27 +0200

Hi again,

Ali Fessi wrote:
>> I found at least the introduction of the scenario in 5.10 a little 
>> difficult to follow from a motivational point of view.
>> How common is it for IP layer mobility to be used purely on the 
>> private side of a NAT? (I'm not saying that it's impossible,

i've just thought about it a bit more.

the setup with HMIP is similar; but with HMIP there is no need for NSIS 
NATFW NSLP. Instead, Mobile Nodes send their Mobile IP "Binding Updates" 
straightforward to the HMIP anchor point.

So, the motivation for scenario 5.10 is still unclear.

Cheers,
Ali

---

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 30 Apr 2006 14:45:13 -0400

Hi Ali,

there is no big motivation behind the mentioned scenario. It is just an 
end host behind a NAT that moves around and uses the NATFW NSLP protocol 
for NAT and Firewall signaling. This end host needs to update its NAT 
binding to continue to receive the data traffic at the new care-of-address.

For some reason you got jumped to mobility protocols.

We, however, need to ensure that the text does not give you a wrong 
impression.

Ciao
Hannes

Ali Fessi wrote:
>> i'm not an expert in mobility; but i think, if Hierarchical MIP is 
>> used, then the HMIP anchor point would basically behaves as a NAT. So 
>> the scenario described in this section would fit well to HMIP.
>>
> ------------------------------------------------------------------------
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 30 Apr 2006 14:45:51 -0400

Hi Robert,

> mobility in the first place.)

I agree with you that Section 5.10 should not give the impression that 
it is a mobility solution.

All the text should indicate is that when a host behind a NAT moves then 
the contact address towards its peer does not change. An adversary can 
modify a NAT binding to redirect traffic.

> Is the last sentence here actually correct?
You are referring to this sentence:
"
The NSIS NATFW NSLP aware NAT MUST authorize
       the end host to insure that the messages are indeed belonging to
       the previously established session.
"

Well, it is up to us to specify things in a way that either ownership is 
  shown over multiple NSIS hops or not. Given the past discussions 
regarding the session identifier and usage of cryptgraphic ownership I 
got the impression that this is not a strong requirement.

Ciao
Hannes