Subject: RE: [mobile-ip] Routing header Vs tunneling

From: "Glenn Morrow" <[email-masked]>
Date: Wed, 5 Dec 2001 10:59:18 -0600

Has anyone done a analysis on tunneling in general to describe possible
DDoS, reflector holes in it? It seems to me that by simple induction, the
same reflector threats are relavant to all forms of tunneling and that to
protect against these DDoS threats state must be kept on the tunnel
endpoints in order to police against DDoS reflector attack.

That said - what is the use of sending the extra addresses in each packet at
all since per-address authorization state must be kept on the tunnel
endpoints in order to protect against the reflector attacks?

> -----Original Message-----
> From: Pekka Savola [mailto:[email-masked]]
> Sent: Wednesday, December 05, 2001 8:24 AM
> To: mobile-ip
> Subject: Re: [mobile-ip] Routing header Vs tunneling
> 
> 
> On Wed, 5 Dec 2001, Francis Dupont wrote:
> >    >     b. Home Address Option/Routing Header vs Tunnelling
> >    
> >    I think we should modify 'b' to say " Home Address Option
> >    vs Tunnelling" because ...
> > 
> > => I disagree: home address option and routing header are two
> > basic types of tunnel address compression (cf the Deering/Zill's
> > draft-deering-ipv6-encap-addr-deletion-00.txt), i.e. there is
> > no essential difference.
> > But if your purpose is to show that mobile-ip is the wrong WG
> > I agree, and IMHO the same remark applies to 'c' (piggy-backing).
> 
> I agree with Francis.
> 
> If we are to adopt tunneling, it seems to make sense to use 
> it for both
> HAO and RH.  If there were no problems with HAO, introducing tunneling
> just for RH might not be as "imperative".  These issues are 
> intertwined,
> as the mechanisms compared to tunneling are very similar.
> 
> -- 
> Pekka Savola                 "Tell me of difficulties surmounted,
> Netcore Oy                   not those you stumble over and fall"
> Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords
> 
>

---

From: Pekka Savola <[email-masked]>
Date: Wed, 5 Dec 2001 19:47:16 +0200 (EET)

> endpoints in order to police against DDoS reflector attack.

I think one needs to create a small I-D at least on how (more or less) 
exactly specific tunneling would replace the current use.

In this specific case -- I don't think the security considerations have 
been analyzed.

Personally, I'd sure would be interested in trying to review a tunneling 
method.

> endpoints in order to protect against the reflector attacks?

Tunneling "open to all" is bad.  I don't think an "open-to-all" tunneling
solution would be much better than current mechanisms if it wasn't
restricted in some ways (e.g. by omitting certain addresses, to make them
unforgeable).

However, currently tunneling (e.g. IPv4-in-IPv6 manual tunnels) are point 
to point, and more or less trust each end; you can create restrictions 
there.