Subject: RE: [Mipshop] Possible Solution to Duplicate Problem?

From: "Soliman, Hesham" <[email-masked]>
Date: Fri, 26 Aug 2005 18:04:41 -0400

> > => This is obviously a security threat and is not related to 
 > > the address collision discussion. 
 > > 
 > > Let's dig deeper into this case. The root cause of the problem
 > > here is that there is no reachability test for the NCoA. Of course
 > > there is no security at all in FMIP right now so when we have 
 > > a secure FMIP solution we can discuss this threat. 
 > > The only case today where we have no reachability test for a CoA
 > > is the BU sent to the HA. In this case, the WG assumed (for better
 > > or for worse), that a malicious MN can be trackable. We've taken
 > > the same approach in HMIPv6. The AR here is essentially a tmp HA. 
 > > 
 > > So, we can look into this case and decide whether we need to do
 > > a reachability test or not, but it's important to note that this
 > > has no bearing on the address collision discussion.
 > > 
 > 
 > By having the NAR proxy the NCE for NCoA after processing 
 > HI, we do not 
 > actually forward packets to NCoA until the MN sends 
 > unsolicited NA (at 
 > which point if there is a collision, it is as good as 
 > anything else that 
 > allows traffic forwarding when DAD is in progress).

=> I don't know how this relates to the discussion we're
having about the attack above. If a NCE already exists in
the NAR and the MN moved back to the PAR there is nothing
you can do to stop it from sending a BU to the address on
the NAR's link, which doesn't belong to anyone now but still
has an entry in the NAR's cache.

Hesham

 > 
 > -Rajeev
 > 
 > 
 > > Hesham
 > > 
 > > 
 > > ===========================================================
 > > This email may contain confidential and privileged 
 > material for the sole use
 > >  of the intended recipient.  Any review or distribution by 
 > others is strictly
 > >  prohibited.  If you are not the intended recipient please 
 > contact the sender
 > >  and delete all copies.
 > > ===========================================================
 > > 
 > 
 > 

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

---

From: Rajeev Koodli <[email-masked]>
Date: Fri, 26 Aug 2005 15:21:01 -0700

> you can do to stop it from sending a BU to the address on

You can. When PAR processes FBU, it sends HI to NAR, which should then 
proxy the NCoA. If it is the same NCoA that MN used on NAR's link 
previously and the entry hasn't timed out, NAR will report a collision. 
Otherwise (if either of the two conditions is not true), NAR will proxy 
the new NCoA (so that any inadvertant redirection to a victim is avoided).

> has an entry in the NAR's cache.

If there is an entry in NAR's NCE that does not belong to anyone, then 
there is no harm.

-Rajeev