Subject: Re: [mobile-ip] possible DOS by creating a reverse a binding

From: "Bryan Wang" <[email-masked]>
Date: Mon, 3 Mar 2003 09:48:59 -0800

Hi folks,

Could I hear some opinions from any of you regarding this issue, or
non-issue ? I'm soliciting your opinions again since I know its not the
style of this list to disagree a opinion by ignoring it ;-)

Thanks,
Bryan

Bryan Wang
Elmic Systems USA

----- Original Message -----
From: "Bryan Wang" <[email-masked]>
To: <[email-masked]>
Cc: "Ed Remmell" <[email-masked]>
Sent: Friday, February 28, 2003 9:08 AM
Subject: Re: [mobile-ip] possible DOS by creating a reverse a binding

> Hi,
>
> Realized that a smart attacker can wait until the two RRP succeeds before
> sending any BUs. The sulotion provided in the previous Email doesn't solve
> the problem. Instead, we need a requirement like:
>
> "When processing a valid BU that requests a CN to cache a binding, if the
> care of address in the BU is the same as the home address of an existing
> binding, the CN MUST selently discard the BU without creating any new
> binding"
>
> What do you think?
>
> Thanks,
> Bryan Wang
> Elmic Systems USA
>
> ----- Original Message -----
> From: "Bryan Wang" <[email-masked]>
> To: <[email-masked]>
> Cc: "Ed Remmell" <[email-masked]>
> Sent: Thursday, February 27, 2003 1:51 PM
> Subject: [mobile-ip] possible DOS by creating a reverse a binding
>
>
> > Hi,
> >
> > Just found one interesting scenatrio when testing our implemenation of
> > MIPv6:
> >
> > I have a  MN with two addresses configured, A1 & A2. It sends two BUs to
an
> > CN, one with A1 as the home address, A2 as the alt care of addrews, the
> > second the other way round. CN sucessfully creats the two bindings ;-).
Now
> > my CN trys to send a packet to A1, it immediately runs out of memory!
There
> > is a never ending recursion trying to find the CoA address. In our
> > implementation, we optimiz it to route looking up and sending packet
through
> > a virtual device, which requires dynamic memory allocation.
> >
> > Talked to Ed and we realized this might be a real DOS attack issue that
we
> > should bring to the attention of the miling list.
> >
> > Apparantly the quick solution would be adding a hard requirement as
follows
> > to prevent creating an reverse binding.
> >
> > CN MUST NOT send an COT message to an MN's care of address if it is the
home
> > address in an exising binding.
> >
> > Thanks,
> > Bryan Wang
> > Elmic Systems USA
> >
> >
>