Subject: RE: [mobile-ip] CLARIFICATION: Unverified HAO Processing - Recommendation note

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Fri, 8 Mar 2002 17:02:53 +0100

> And also, questioning the more harm argument,
  > comparing to non-mobility case, there could be similar
  > off-path attacks (attacker just inserting an arbitrary
  > spoofed address to IPhdr source) if/since there can be
  > places/paths where we do not have Martian filtering
  > (ingress filtering from addresses coming from
  > topologically "wrong" directions) verifiably on
  > every path an attacker could use.

=> Well, the 'do no harm' argument is based on certain
assumptions (existing preventative mechanisms 
today). when comparing two solutions we have to keep
the assumptions fixed. In the statement above you
are changing these assumptions by saying that
'ingress filtering may not be available' and based
on that you claim that off-path attacks are possible
today. Which seems to me like changing the original
problem being solved. Am I missing something?

Hesham

---

From: "Jari T. Malinen" <[email-masked]>
Date: Fri, 08 Mar 2002 10:24:18 -0800

> problem being solved. Am I missing something?

If any path has filtering not available/enabled, off
path attacks can be possible. But this is beside the
point, changing assumptions would mean dismissing
the need for the firewalls to block HAO-reflected traffic.

The issue was about the difference in filtering effect when
using a rule resulting in both attacker's and victim's
packets getting dropped. With non-mobility packets
having source spoofed address this clearly can happen in
some cases. The case for best-effort tagging-based filtering
is also an extreme one (cf. earlier mail). The do-no-harm
argument is whether tagging-based filtering is significantly
worse from the level of security provided by ingress filtering
in a firewall for non-mobility packets. Best effort tagging
provides an alternative source of information for filtering
which is not exact but the level of precision in non-mobility
filtering is not exact either, hence a need for clarification
what is significantly worse with this particular issue.

> Hesham

BR,

-Jari