Subject: Re: [MEXT] Issue #17: Multi-homed mobile node can cause routing loop between home agents

From: "Giaretta, Gerardo" <[email-masked]>
Date: Sat, 1 Nov 2008 21:10:19 -0700

Hi Vijay, Charlie and all,

I tend to agree with Raj that this does not seem a MIP6-specific issue or at least it does not require any MIP6-specific solution.

While the way of creating the routing loop is specific to MIP6, in the sense that MIP6 signaling is used, the outcome of the attack may be just a flood of packets to the HA. How is this flooding of packets different from any other DoS/flooding? Does the HA anyway be equipped to drop packets in case of packets floods?

The HA may just drop packets if they exceed a ceratin threshold and optionally delete the binding. This seems to be enough in my view considering that there is anyway a long trust relationship between the attacker (i.e. the MN) and the HA.

What do you think?

Gerardo

________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Vijay Devarapalli [[email-masked]]
Sent: Friday, October 31, 2008 4:15 PM
To: Charles E. Perkins; Benjamin Lim
Cc: [email-masked]
Subject: Re: [MEXT] Issue #17: Multi-homed mobile node can cause routing        loop between home agents

Hi Charlie,

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Charles E. Perkins
> Sent: Thursday, October 02, 2008 4:51 PM
> To: Benjamin Lim
> Cc: [email-masked]
> Subject: [MEXT] Issue #17: Multi-homed mobile node can cause
> routing loop between home agents
>
>
> Hello Benjamin,
>
> I have not seen any further discussion about this issue,
> but I agree that the problem does exist.
>
> It might be possible to specify that the Home Agent should (or,
> ?may?) use the RFC 2473 "Tunnel Encapsulation Limit Option".
> to help avert the threat.  Otherwise, the loop could persist for
> an annoyingly long amount of time.  It is also possible for the
> home agent to enforce a policy by which a home address on
> a network cannot be bound to a care-of address on the same
> network, but in fact there may be cases where that would be
> a valid binding.
>
> I hope that other people in the working group will
> express an opinion about this.  At minimum, we could
> certainly include text within the Security Considerations
> section.

Recommending the use of the Tunnel Encapsulation Limit Option" in the
security considerations section seems to be the best option to me. Here
is some text.

   A malicious mobile node associated to multiple home agents could
   create a routing loop amongst the home agents. This can be
   achieved when a mobile node binds one home address located on a
   first home agent to another home address on a second home agent.
   This type of binding will force the home agents to route the same
   packet among each other without knowledge that a routing loop has
   been created. To present this routing loop, it is recommended for
   the home agents to use the Tunnel Encapsulation Limit Option
   [RFC 2473], when tunneling packets for the mobile node.

It would be good to recommend a default value for the "Tun Encap Lim"
field, but I don't know what to recommend. How about '5'? This should be
sufficient for any additional GTP, PMIPv6, HMIPv6 or FMIPv6 tunneling
between the home agent and the mobile node. :)

Vijay

>
> The existing discussion is documented at the following URL:
> http://trac.tools.ietf.org/wg/mext/trac/ticket/17
>
> Regards,
> Charlie P.
>
> _______________________________________________
> MEXT mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mext
>
_______________________________________________
MEXT mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mext
_______________________________________________
MEXT mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mext

---

From: "Vijay Devarapalli" <[email-masked]>
Date: Mon, 3 Nov 2008 19:40:18 -0500

Hi Gerardo,

One difference is that this flooding attack is too easy to launch. The
mobile node needs to just performing the two binding registrations and
then start a session. 

Vijay

> I tend to agree with Raj that this does not seem a 
> MIP6-specific issue or at least it does not require any 
> MIP6-specific solution.
> 
> While the way of creating the routing loop is specific to 
> MIP6, in the sense that MIP6 signaling is used, the outcome 
> of the attack may be just a flood of packets to the HA. How 
> is this flooding of packets different from any other 
> DoS/flooding? Does the HA anyway be equipped to drop packets 
> in case of packets floods?
> 
> The HA may just drop packets if they exceed a ceratin 
> threshold and optionally delete the binding. This seems to be 
> enough in my view considering that there is anyway a long 
> trust relationship between the attacker (i.e. the MN) and the HA.
> 
> What do you think?
> 
> Gerardo
> 
> From: [email-masked] [[email-masked]] On Behalf 
> Of Vijay Devarapalli [[email-masked]]

---

From: "Giaretta, Gerardo" <[email-masked]>
Date: Mon, 3 Nov 2008 20:52:42 -0800

HI Vijay,

I would actually claim the opposite. This attack needs multiple tunneling of binding update messages in particular in case ingress filtering is in place. This to me seems more complex than just flood one given IP address with packets.

Gerardo

> From: Vijay Devarapalli [mailto:[email-masked]]
> Sent: Monday, November 03, 2008 4:40 PM
> To: Giaretta, Gerardo; Charles E. Perkins; Benjamin Lim
> Cc: [email-masked]
> Subject: RE: [MEXT] Issue #17: Multi-homed mobile node can cause routingloop
> between home agents
> 
> Hi Gerardo,
>

---

From: Suresh Krishnan <[email-masked]>
Date: Tue, 04 Nov 2008 10:53:45 -0500

Hi Gerardo,
   I agree more with Vijay. This attack is harder to INITIATE but way 
way  easier to SUSTAIN. In a direct denial of service attack, you are 
limited by the bandwidth you have on your uplink and you need to keep 
sending the packets. In the HA routing loop. You can use well connected 
servers (Google,Youtube...) to perform your attack for you. You just 
setup the bindings, request a video and just go away. The HAs will be 
busy for a while :-) and they would not notice you went away.

Cheers
Suresh

---

From: "Giaretta, Gerardo" <[email-masked]>
Date: Tue, 4 Nov 2008 09:02:36 -0800

Hi Suresh,

The point I was trying to make is that the HAs will be anyway equipped to handle DoS attacks. This is done independently of the type of attack performed. So the point is the following: do we need a MIP6-specific solution to prevent the attack given the fact that we already have existing solutions which are not MIP6-specific and which will address the issue?

Gerardo

> From: Suresh Krishnan [mailto:[email-masked]]
> Sent: Tuesday, November 04, 2008 7:54 AM
> To: Giaretta, Gerardo
> Cc: Vijay Devarapalli; Charles E. Perkins; Benjamin Lim; [email-masked]
> Subject: Re: [MEXT] Issue #17: Multi-homed mobile node can cause routingloop
> between home agents
> 
> Hi Gerardo,
> > I would actually claim the opposite. This attack needs multiple tunneling of
> binding update messages in particular in case ingress filtering is in place.
> This to me seems more complex than just flood one given IP address with
> packets.
> >
> > Gerardo
> >

---

From: "fan zhao" <[email-masked]>
Date: Tue, 4 Nov 2008 12:48:14 -0800

Hi Gerardo, Suresh and Vijay et al,

I agree on the view of Suresh and Vijay. The DoS attack caused by the
tunnel loop
is much worse than the regular flooding attack. Furthermore, whether the generic
DoS protection solution would work depends on its implementation; for example,
some solution may not look into the signaling message, thus the tunnel loop
can result in signaling message flooding. The details of such
protection solution is
not specified anywhere. Also the attack messages may look complicated, but it
is not technically difficult for attackers to launch such attack.

I think there are two kinds of solutions. One is to detect/drop the
looped payload packets,
such as using the tunnel limit option. However, such solution still
results in amplified
effects even the tunnel limit can be set. Another solution is to
prevent the looping
binding state created when the attacker sends the bogus binding update
messages.
I think the latter is much cleaner.

What do you think?

Sincerely,
fan

---

From: "Mohana Jeyatharan" <[email-masked]>
Date: Thu, 6 Nov 2008 17:56:56 +0800

Hi Gerardo,

Of course as you say currently implemented HAs have adequate mechanisms
to handle DoS attack. However, if such attacks are launched frequently,
it is essential for the HA to detect this early and handle it as quickly
as possibly. Thus it is essential to solve it. 

Yes, as you say there is an existing mechanism but it is not sufficient
in the sense that it is general and not targetting at identifying the
tunnel loop as early as possible and acting on it such that looping does
not occur again! Moreover in the current mechanism what value to set for
TEL? The MN's home agents are unknown to the first tunnel entry node and
it is difficult to set adequate value TEL. Also, the important thing is
that a loop is detected and it is not a mere completion of TEL option
decrementation. Once loop is detected all concerned nodes are alerted
and this prevents further such loops being formed due to malicious MN.
All this is explanied in the ID called draft-ng-intarea-tunnel-loop-00
which provides further details.

Moreover the solution is simple and requires some changes to the HA and
I don't see why it cannot be incorporated into MIPv6 Bis.

BR,
Mohana

> Behalf Of Giaretta, Gerardo
> Sent: Wednesday, November 05, 2008 1:03 AM
> To: Suresh Krishnan
> Cc: [email-masked]
> Subject: Re: [MEXT] Issue #17: Multi-homed mobile node can 
> cause routingloop between home agents
> 
> Hi Suresh,
> 
> The point I was trying to make is that the HAs will be anyway 
> equipped to handle DoS attacks. This is done independently of 
> the type of attack performed. So the point is the following: 
> do we need a MIP6-specific solution to prevent the attack 
> given the fact that we already have existing solutions which 
> are not MIP6-specific and which will address the issue?
> 
> Gerardo
> 
> > Subject: Re: [MEXT] Issue #17: Multi-homed mobile node can cause 
> > routingloop between home agents
> > 
> > Hi Gerardo,
> > sending the packets. In the HA routing loop. You can use well 
> > connected servers (Google,Youtube...) to perform your 
> attack for you. 
> > You just setup the bindings, request a video and just go 
> away. The HAs 
> > will be busy for a while :-) and they would not notice you 
> went away.
> > 
> > Cheers
> > Suresh
> > 
> > Giaretta, Gerardo wrote:
> > > HI Vijay,
> > >
> > This to me seems more complex than just flood one given IP address 
> > with packets.
> > >
> > > Gerardo
> > >
> > >> One difference is that this flooding attack is too easy 
> to launch. 
> > >> The mobile node needs to just performing the two binding 
> > >> registrations and then start a session.
> > >>
> > >> Vijay
> > >>
> MIP6-specific 
> > >>> issue or at least it does not require any MIP6-specific 
> solution.
> > >>>
> > >>> While the way of creating the routing loop is specific 
> to MIP6, in 
> > >>> the sense that MIP6 signaling is used, the outcome of 
> the attack 
> > >>> may be just a flood of packets to the HA. How is this 
> flooding of 
> > >>> packets different from any other DoS/flooding? Does the 
> HA anyway 
> > >>> be equipped to drop packets in case of packets floods?
> > >>>
> > >>> The HA may just drop packets if they exceed a ceratin threshold 
> > >>> and optionally delete the binding. This seems to be 
> enough in my 
> > >>> view considering that there is anyway a long trust relationship 
> > >>> between the attacker (i.e. the MN) and the HA.
> > >>>
> > >>> What do you think?
> > >>>
> > >>> Gerardo
> > >>>
> > >>> From: [email-masked] [[email-masked]] On 
> Behalf Of 
> > >>> Vijay Devarapalli [[email-masked]]
> > >>>> I have not seen any further discussion about this issue, but I 
> > >>>> agree that the problem does exist.
> > >>>>
> > >>>> home agent to enforce a policy by which a home address on a 
> > >>>> network cannot be bound to a care-of address on the 
> same network, 
> > >>>> but in fact there may be cases where that would be a valid 
> > >>>> binding.
> > >>>>
> > >>>> I hope that other people in the working group will express an 
> > >>>> opinion about this.  At minimum, we could certainly 
> include text 
> > >>>> within the Security Considerations section.
> > >>> Recommending the use of the Tunnel Encapsulation Limit 
> Option" in 
> > >>> the security considerations section seems to be the 
> best option to 
> > >>> me. Here is some text.
> > >>>
> > >>> sufficient for any additional GTP, PMIPv6, HMIPv6 or FMIPv6 
> > >>> tunneling between the home agent and the mobile node. :)
> > >>>
> > >>> Vijay
> > >>>
> > >>>