Subject: RE: [mobile-ip] Routing header Vs tunneling

From: "Glenn Morrow" <[email-masked]>
Date: Tue, 11 Dec 2001 13:14:02 -0600

What prevents a node from obtaining and using any number of free or not free
(i.e. in use by another legitimate node) IP addresses such that they can
spoof addresses albeit only on the same subnet IF INGRESS FILTERING is used
on the first hop. Use of IPSEC is not mandated. Use of INGRESS FILTERING is
not mandated, either. What is the interaction with control lists, etc..
etc.. etc.. Are there any provisions for anti-mac-spoofing, etc.. etc..
etc.. Pekka's draft which detailed most of the holes has expired, perhaps he
is listening and will republish it. 

Ask yourself this Erik, would Sun use it and would Sun want to connect their
5 9's network to a network they have no control over that did use it, as is?
Would a bank want to be connected to a network they had no control over that
used it, as is? Would a government, military department, police department,
fire department, FEMA, etc.. That is if they had a choice. IPv6 is somewhat
of an expensive proposition, wouldn't it be good to build in new mandatory
anti-DDoS mechanisms to help satisfy that return on investment.

Don't get me wrong, I think autoconfig is neat and I like it but it isn't in
any better shape than MIPv6 with respect to DDoS prevention. This is
Charlie's point. I personally think both need to be fixed and backed up by
mandates but I'm amazed that autoconfig became a standard as is in the first
place.

Regards,

Glenn

> -----Original Message-----
> From: Erik Nordmark [mailto:[email-masked]]
> Sent: Tuesday, December 11, 2001 11:54 AM
> To: Morrow, Glenn [RICH2:C330:EXCH]
> Cc: [email-masked]; Erik Nordmark
> Subject: RE: [mobile-ip] Routing header Vs tunneling
> 
> 
> > GM2] You have hit the nail right on the head. I think you 
> doing the right
> > thing but I must say that the right thing needs to be done 
> to IPv6 itself. I
> > know this may not be your responsibility but nevertheless, 
> there are massive
> > gaping DDoS holes in IPv6. The fixes for these holes are 
> not backed up by
> > MUSTs either. Actually some of the fixes aren't even 
> described in IETF
> > documentation. This is a reverberation about Charlie's 
> point about being
> > singled out. Pekka has at least tried to point some of the 
> IPv6 holes out in
> > his ID. For instance compare the DDoS holes in stateless 
> autoconfiguration
> > with the reflector problem of MIPv6. It seems to me that stateless
> > autoconfiguration wouldd not have become an RFC under the 
> same scrutiny.
> 
> Some people feel that RFC 2461 and RFC 2462 should not be 
> draft standards
> since there was no interoperability testing of the suggested 
> security mechanism
> (use IPsec). This is a case where we learn as we go along. I 
> think that
> earlier it was viewed that limiting the threats to attackers 
> on the same link
> was good enough protection.
> 
> There are known holes (some documented in existing RFCs)
> limited to a single link (neighbor discovery and stateless addrconf).
> And the tunneling in RFC 2473 is silent on threats related to
> blindly decapsulating received packets.
> 
> What other security holes are you aware of?
> 
>   Erik
> 
>

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 11 Dec 2001 23:19:52 +0100 (CET)

> anti-DDoS mechanisms to help satisfy that return on investment.

While I understand and agree with your desire to improve security
I don't know of a magic bullet to prevent DoS and DDoS. The best we can
do is to minimize such opportunities and try to make it possible to somehow
trace back to the attacker for the other cases.
But the latter part is an IETF wide problem. See ITRACE WG and IPPT BoF.

> mandates but I'm amazed that autoconfig became a standard as is in the first

The significant difference is that the Neighbor Discovery and addrconf
attacks are limited to attackers on the link.
MIPv6 is global by design thus it makes sense to have stricter security
requirements.

  Erik

---

From: Pekka Nikander <[email-masked]>
Date: Wed, 12 Dec 2001 11:55:34 +0200

Glenn,

[I am redirecting this to ipng, in addition to mobile-ip,
 since the address ownership problems are a larger issue
 than just a Mobile IPv6 security thing.]

Glenn Morrow writes:
> What prevents a node from obtaining and using any number of free or 
> not free (i.e. in use by another legitimate node) IP addresses such
> that they can spoof addresses albeit only on the same subnet IF INGRESS 

> FILTERING is used on the first hop. Use of IPSEC is not mandated. Use of 
> INGRESS FILTERING is not mandated, either. What is the interaction with 
> control lists, etc.. etc.. etc.. Are there any provisions for 
> anti-mac-spoofing, etc.. etc.. etc.. Pekka's draft which detailed most 
> of the holes has expired, perhaps he is listening and will republish it.

The old address-ownership draft is available at
http://www.tml.hut.fi/~pnr/publications/draft-nikander-ipng-address-ownership-00.txt

If there is demand I'd be happy to revise it.  Would it
be useful to revise it and publish it as an informational RFC?
Please note that many of the issues discussed in that draft
are also discussed in my Cambridge Security Protocols Workshop
paper, which will eventually be published in the LNCS series.
A pre-publication version of that is available at
http://www.tml.hut.fi/~pnr/publications/cam2001.pdf

BTW, while you consider ingress filtering etc, you may find
it entertaining to read our recent half-serious half-joking
paper titled "IPv6 Source Addresses Considered Harmful",
available at http://www.tml.hut.fi/~pnr/publications/nordsec2001.pdf

--Pekka Nikander

---

From: Pekka Savola <[email-masked]>
Date: Thu, 13 Dec 2001 10:57:59 +0200 (EET)

> is listening and will republish it. 

A new revision was issued:

http://www.ietf.org/internet-drafts/draft-savola-ipv6-rh-ha-security-01.txt

Thanks.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Pekka Savola <[email-masked]>
Date: Thu, 13 Dec 2001 16:01:48 +0200 (EET)

> available at http://www.tml.hut.fi/~pnr/publications/nordsec2001.pdf

Perhaps you should tentatively schedule a re-presentation for the tenth
anniversary of this paper, in 2011, and hope a global IPSEC will be a 
reality then.

Oh, make that 15.

:-)