Subject: [Pana] PANA - link local address - duplicate address detection

From: Goeman Stefan <[email-masked]>
Date: Thu, 13 May 2004 16:29:13 +0200

Hello,

I have a question that is puzzling me.
In IPv6 you could use an autoconfigured link local address and start PANA.
However, normally you should do duplicate address detection for this link
local address, and everybody knows the problems that exist with DAD. I know
that IETF SEND provides a solution to this problem, but personally I am not
so happy with this (PKI-based) approach.

Q1: So, I wonder what would be the real threat/problem if you would use a
link local address to start PANA, secure the link layer and configure a post
PANA IP-address with DHCPv6 for example?

Q2: In case of a wireless environment, would the following approach be
possible? A MN creates a link local address and performs DAD. The AP, where
the link layer terminates, "intercepts" this request and answers on behalf
of all MN connected to the AP (the AP knows all link local and other address
of the MN which are currently already connected). In this case a malicious
MN would not be able to falsely claim the link local address of the new MN
trying to obtain IP connectivity.

Greetings,
Stefan. 

Stefan Goeman 
SIEMENS ICM/ICN 
[email-masked]  <mailto:[email-masked]> 

Mobile Solutions 
and Enabling Services
http://www.ic.siemens.be <http://www.ic.siemens.be/eng/default_rd.shtm>

Customer driven solution providers

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Thu, 13 May 2004 09:36:19 -0700

> trying to obtain IP connectivity.
Please see this draft 
http://www.join.uni-muenster.de/Dokumente/drafts/draft-park-ipv6-dad-problem-wlan-00.txt

The originator of the DAD also gets the DAD packet and the link layer seems to
drop the packet. i.e Duplicate address is not detected today in IPv6 with wlans.

If this problem gets fixed, then this DoS attack can happen and PANA cannot stop it and also it is
not in the scope of PANA to stop it.

-mohan

> Customer driven solution providers 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Thu, 13 May 2004 09:36:19 -0700

Please see this draft 

-mohan

---

From: Thomas Narten <[email-masked]>
Date: Fri, 14 May 2004 08:03:05 -0400

> The originator of the DAD also gets the DAD packet and the link
> layer seems to drop the packet. i.e Duplicate address is not
> detected today in IPv6 with wlans.

I think this is a misreading of the problem statement. The above draft
basically says that if two nodes are using the same MAC (i.e,
link-layer) address, DAD doesn't work. Surprise surprise. If there are
two nodes in your network using the same link-layer address, there are
probably a bunch of things that don't work anymore, DAD being just one
example. But your last statement above seems rather strong.

> If this problem gets fixed, then this DoS attack can happen and PANA
> cannot stop it and also it is not in the scope of PANA to stop it.

PANA cannot prevent all DOS attacks. I know of no protocol that can.

Thomas

---

From: Thomas Narten <[email-masked]>
Date: Fri, 14 May 2004 08:03:05 -0400

Thomas

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Fri, 14 May 2004 10:12:33 -0700

Thomas,

Some clarification below.

> example. But your last statement above seems rather strong.
If there are two nodes with the same MAC address on a wired ethernet, DAD would
have detected the duplicated address assuming both the nodes auto-configure the
address using the MAC address ? The first step you do is to configure a link-local address
and do a DAD on it before doing anything else on the network. So, when the second
node with the same MAC address configures the link-local address, it should detect the
duplicate if it is wired ethernet as the switch does not send back the DAD packet back
on the same port on which it was sent. This fails to work on the WLANs. Is that
the right understanding ? I agree that the last statement of mine was too strong. DAD can
be detected if other address configuration mechanisms are used and hence
the DAD attack is still possible.  Is that what you meant ?

> PANA cannot prevent all DOS attacks. I know of no protocol that can.
Agreed. I was specifically talking about DAD and i don't know what exactly SEND did with it.

-mohan

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Fri, 14 May 2004 10:12:33 -0700

Thomas,

-mohan