Subject: [mobile-ip] Unresolved issue #15: Site local addresses and tunnel protection

From: Jari Arkko <[email-masked]>
Date: Wed, 10 Apr 2002 17:23:18 +0300

Background: Link-local addresses can not be used as home
addresses. However, site-local addresses can be used. Draft 16 has a
mandatory tunnel outer IP - currently known location check to verify
that the tunneled packets at least come from the right IP
source. Draft 16 has also an optional ESP usage for the tunneled
packets. It has been questioned whether the checking mechanism is
sufficient when site-local addresses are used, as it might allow
e.g. on-link attackers to send site-local packets to the home network.

Question: Is there a threat? If yes, should we (a) warn about it or
(b) mandate some additional security mechanisms such as ESP to be used
in this case? Without considering the security aspects, does MIPv6
fully work with site-local addresses? For instance, is the lack of
a zone id a problem, as asked in the mailing list?

Proposal: There is a threat in the sense that administrators must
be aware of the implications of allowing site-local home addresses.
Document the danger and recommended security precautions in the
Security Considerations section.

Text:
Binding updates to the home agents are secure and when receiving
tunneled traffic the home agent verifies the outer IP address
corresponds to the current location of the mobile node. This prevents
attacks where the attacker is controlled by ingress filtering, as well
as attacks where the attacker does not know the current care-of
address of the mobile node. Attackers who know the care-of address and
are not controlled by ingress filtering could still send traffic
through the home agent. This includes attackers on the same local link
as the mobile node is currently on. But such attackers could also send
spoofed packets without using a tunnel.

It is possible to use IPsec ESP to protect payload packets tunneled to
the mobile node and back. While this specification does not mandate
the use of ESP, its use is recommended to protect the payload
communications against attackers on the path between the home agent
and the current location of the mobile node.

When site local home address are used, reverse tunneling can be used
to send site local traffic from another location.  Administrators
should be aware of this when allowing such home addresses. In
particular, the outer IP address check described above is not
sufficient against all attackers and the use of encrypted tunnels is
particularly useful for this kind of home addresses.