Subject: Re: [mobile-ip] list of things for MIPv6

From: Pekka Nikander <[email-masked]>
Date: Wed, 02 Jan 2002 13:02:32 +0200

Francis,

[I am catching old e-mail; the to/cc didn't include me
so I didn't notice this before now.]

Francis Dupont wrote:

>    Well, to me this seems to depend on how the CoAs are
>    assigned.  If the MN is allowed to use stateless autoconfiguration,
>    it can generate a few thousand different CoAs for itself,
>    and use each CoA separately to send different home addresses
>    in the Home Address Option.
> 
> => this behavior is so different than standard MN's one that
> the ingress filtering should block it.

How can ingress filtering notice that so that it could block it?
That is, how can it differentiate between one host generating
200 different CoAs and using them and having 200 different hosts
in the network?  Of course this depends on the link layer, but
given a suitable link layer (e.g. Ethernet), you cannot make the
difference.  (For Ethernet you need MAC spoofing, but that is easy.)

--Pekka

---

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Thu, 3 Jan 2002 16:14:52 +0100

> -----Original Message-----
  > From: Charles E. Perkins [mailto:[email-masked]]
  > Sent: Friday, December 21, 2001 10:12 PM
  > To: Jari Arkko
  > Cc: [email-masked]
  > Subject: Re: [mobile-ip] list of things for MIPv6
  > 
  > 
  > Jari Arkko wrote:
  > 
  > > I believe there is a real difference in current spoofing
  > > attacks compared to the ones enabled by the home
  > > address option. Namely, ingress filtering or other techniques
  > > can prevent source address spoofing but I can't see how
  > > they could prevent HAO spoofing.
  > 
  > Ingress filtering could put some restriction on this.
  > For instance, it could be enforced that only one home
  > address could be associated to a particular care-of address.
  > This would eliminate most of the "fun" that would be
  > associated with such spoofing.  We could also say that
  > a correspondent node has to do such filtering.  After
  > these two measures are taken, I think that no self-respecting
  > bad guy would waste time on such a low-payoff exploit.
  > 

Hello Charlie,

  > Supposing we had a new header type.  Wouldn't it be
  > appropriate to make the necessary signaling for protecting
  > Binding Updates to also fit in the same container?

=> Absolutely. In fact it is as simple as 
taking the exact same ext header and giving it 
a new name/Header Type. I think the biggest amount 
of work will be done by IANA :)
But I think Francis already said that.

Regarding your response on RR and CGAs please
see the separate thread containing my response 
to Erik and respond to that if you like. 

Hesham