Subject: [mobile-ip] Reflection attack using bogus BU?

From: Erik Nordmark <[email-masked]>
Date: Sat, 3 Aug 2002 00:03:48 +0200 (CEST)

In section 9.4.4 draft 18:

    -  Otherwise, if the Source IP Address of the packet containing
       the Binding Update, is legal for inclusion in a Routing Header,
       the routing header will be constructed using that IP address.
       Note that multicast addresses, link-local addresses, loopback
       addresses, IPv4 mapped addresses, and the unspecified address,
       MUST NOT be used within a Routing Header for the Binding
       Acknowledgement.

   Otherwise, if the Binding Update has a zero lifetime but the Source
   IP address is not allowable for use within the Routing Header,
   the Binding Acknowledgment MUST be sent to the mobile node's home
   address.

This seems to say that if a node forms a packet with
	ip src = mapped address
	ip dst = reflector
	HAO = victim
	MH protocol, type = BU
		random bits in the authenticator

then the reflector will send binding ack to the victim with status 
            137   Invalid authenticator

I propose that when the source address can't use used in a routing header,
the CN should silently drop the BU.

  Erik

---

From: Jari Arkko <[email-masked]>
Date: Tue, 06 Aug 2002 12:14:49 +0300

>             137   Invalid authenticator

Right.

> the CN should silently drop the BU.

Agreed.

Proposed text:

- Otherwise, the Binding Acknowledgment MUST NOT be sent.

Jari

---

From: Jari Arkko <[email-masked]>
Date: Tue, 06 Aug 2002 12:14:49 +0300

Right.

Agreed.

Proposed text:

Jari

---

From: Jari Arkko <[email-masked]>
Date: Tue, 06 Aug 2002 12:14:49 +0300

Right.

Agreed.

Proposed text:

Jari

---

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 06 Aug 2002 10:19:36 -0700

Section 10.2 which talks about primary Care-of Address registration 
with the Home Agent refers to section 9.4.4. specifically the text
mentioned below. you should move the text there. it is needed for
the HA to select the destination address for the Binding Ack.

the reflection attack does not exist when we are talking about
Home Agent.

Vijay

---

From: Jari Arkko <[email-masked]>
Date: Wed, 07 Aug 2002 12:50:39 +0300

> the reflection attack does not exist when we are talking about

Yes. The HA can still keep sending the BA even in these cases.
I will make the following change in 10.2:

    The rules for selecting the Destination IP address (and possibly
    Routing Header construction) for the Binding Acknowledgement to the
    mobile node are the same as in section 9.4.4.

=>

    If the packet
    is to be sent to the mobile node at any address other than the mobile
    node's home address, it MUST be sent using a Routing header (even if
    the binding was rejected).  The intermediate IP address, to which
    the packet will be delivered immediately before the home address, is
    determined as follows:

     -  Whenever the Binding Update is accepted with a nonzero lifetime,
        the routing header will be constructed using the care-of address
        as described in Section 9.6.

     -  Otherwise, the Source IP Address of the packet containing
        the Binding Update MUST be used, unless it is a multicast
        address, link-local address, loopback address, IPv4 mapped
        address, or the unspecified address.

     - Otherwise, the Binding Acknowledgment MUST be sent to the mobile
       node's home address.

Jari

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 07 Aug 2002 10:30:30 -0700

>      - Otherwise, the Binding Acknowledgment MUST be sent to the mobile

this wont go anywhere. the MN is not at home. the HA should not
send a Binding Ack, in case it cant be sent to the MN's current 
CoA.

the third point could say

       - Otherwise, the Binding Acknowledgment is not sent.

Vijay

---

From: Jari Arkko <[email-masked]>
Date: Thu, 08 Aug 2002 10:02:05 +0300

>        - Otherwise, the Binding Acknowledgment is not sent.

I though you argued earlier that the CN and HA cases are
different, and the third points differ because there's no
reflection attack danger. But perhaps I misunderstood this.

Anyway, if the HA sends something to the mobile node's home address,
this should be intercepted by the HA and sent to the currently registered
CoA. Note that currently registered may not be the same as the source
address used in the BU, particularly if the BU failed for some reason.

But I guess the main question here is if we *need* to do anything
else than to drop the ack if the source is weird? I'd be very happy
if we didn't need to do anything else.

Jari

---

From: Jari Arkko <[email-masked]>
Date: Thu, 08 Aug 2002 14:10:13 +0300

Vijay Devarapalli wrote:

>> send a Binding Ack, in case it cant be sent to the MN's current CoA.

> if we didn't need to do anything else.

After some thinking, we do need to handle at least the case where
the source address is link-local (when the MN is returning home).

Also, I'm not sure the rule about the current CoA is sufficient
either. Say, the MN has moved and can no longer use the previous
coa. Then, it sends a BU but for some reason with a wrong sequence
number. The BA will give an error about this, and the MN must be
able to read this error before the situation can be corrected. So
it would seem that we must be able to send the BA to the source of
the BU rather than the currently registered coa?

Jari

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 08 Aug 2002 10:10:39 -0700

> reflection attack danger. But perhaps I misunderstood this.

no you did not. I was saying that.

> address used in the BU, particularly if the BU failed for some reason.

I dont want this. let me try to construct a scenario

1. HA has a binding for MN pointing to CoA1.

2. MN sends a binding update to the HA with CoA2.

3. BU fails for some reason and is not accepted.

    a) CoA2 is a valid address (a global unicast address). 
       the HA sends a binding ack to CoA2 and not CoA1. the 
       BCE contents are not used. the routing header contains 
       the HoA.

    b) CoA2 is not a valid address (a non-global unicast
       address). HA does not send a binding ack. 

does this sound ok?

regards
Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 08 Aug 2002 10:16:00 -0700

> the source address is link-local (when the MN is returning home).

okay. anyway, if a BU was received with link local address as
the source address the HA can assume it is from the same link.
if the MN sends a BU from a visited link with the source address
set to link local, the packet should have never been forwarded
by the router serving the MN in the visited link.
 
> the BU rather than the currently registered coa?

right.

Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 08 Aug 2002 10:33:36 -0700

> by the router serving the MN in the visited link.

one more thing. there is no need for the MN to send a BU using link 
local address. it is possible with the current draft 18 for the MN 
to send a BU with its home address as the source after it comes 
home. and it works.

Vijay

---

From: Jari Arkko <[email-masked]>
Date: Fri, 09 Aug 2002 14:01:39 +0300

>        address). HA does not send a binding ack. 

Yes.

Jari