Subject: Fwd: I-D ACTION:draft-huitema-multi6-addr-selection-00.txt

From: marcelo bagnulo braun <[email-masked]>
Date: Tue, 19 Oct 2004 17:38:01 +0200

Comments are welcome

regards, marcelo

Inicio mensaje reenviado:

> De: [email-masked]
> Fecha: 19 de octubre de 2004 13:46:29 GMT+02:00
> Para: [email-masked]
> Asunto: I-D ACTION:draft-huitema-multi6-addr-selection-00.txt
> Responder a: [email-masked]
>
> A New Internet-Draft is available from the on-line Internet-Drafts  
> directories.
>
>
> 	Title		: Address selection in multihomed environments
> 	Author(s)	: C. Huitema, et al.
> 	Filename	: draft-huitema-multi6-addr-selection-00.txt
> 	Pages		: 17
> 	Date		: 2004-10-18
> 	
> This note presents mechanisms for address selection in hosts within a
>    multihomed site.  The goal of the presented mechanisms is to allow
>    hosts within the multihomed site to establish new communications
>    after an outage.  The presented mechanisms are not by themselves a
>    complete multihoming solution but rather a component of such
>    solution.
>
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-huitema-multi6-addr- 
> selection-00.txt
>
> To remove yourself from the I-D Announcement list, send a message to
> [email-masked] with the word unsubscribe in the body of  
> the message.
> You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce
> to change your subscription settings.
>
>
> Internet-Drafts are also available by anonymous FTP. Login with the  
> username
> "anonymous" and a password of your e-mail address. After logging in,
> type "cd internet-drafts" and then
> 	"get draft-huitema-multi6-addr-selection-00.txt".
>
> A list of Internet-Drafts directories can be found in
> http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>
>
> Internet-Drafts can also be obtained by e-mail.
>
> Send a message to:
> 	[email-masked].
> In the body type:
> 	"FILE /internet-drafts/draft-huitema-multi6-addr-selection-00.txt".
> 	
> NOTE:	The mail server at ietf.org can return the document in
> 	MIME-encoded form by using the "mpack" utility.  To use this
> 	feature, insert the command "ENCODING mime" before the "FILE"
> 	command.  To decode the response(s), you will need "munpack" or
> 	a MIME-compliant mail reader.  Different MIME-compliant mail readers
> 	exhibit different behavior, especially when dealing with
> 	"multipart" MIME messages (i.e. documents which have been split
> 	up into multiple messages), so check your local documentation on
> 	how to manipulate these messages.
> 		
> 		
> Below is the data which will enable a MIME compliant mail reader
> implementation to automatically retrieve the ASCII version of the
> Internet-Draft.
> Content-Type: text/plain
> Content-ID: <[email-masked]>
>
> _______________________________________________
> I-D-Announce mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/i-d-announce
>
------------------------------------------
Please note that my former email address
[email-masked] is no longer in use
Please send mail to:
marcelo at it dot uc3m dot es
------------------------------------------

---

From: Kenji Ohira <[email-masked]>
Date: Wed, 20 Oct 2004 17:13:35 +0900

Hi Marcelo,

I appreciate your fine draft.

Well, let me ask you a question.
In section 3, it is described that:
" - If X tries to communicate with Y using A:X as a source address,
    packets will be routed through ISPA in order to comply with ingress
    filters, ... "
Do you assume that a kind of source address dependent routing mechanism
is running in the site X?

IMHO, it is better to note about source address dependent routing
because selecting a source address may not be equal to selecting a path
in a site with normal (destination address based) routing.

Regards,

----
October 20, 2004
Kenji Ohira <[email-masked]>
Kyoto University

---

From: David Gethings <[email-masked]>
Date: Wed, 20 Oct 2004 15:21:10 +0100

> Comments are welcome
Overall a good draft. But I do have one concern. In section 5.2 you propose 3 
source address selection methods. The third suggests that a host try with all 
possible source addresses simultaneously that are within scope.

While this offers the advantage of providing best path selection - as you 
point out in your draft - it could also provides a ready made DOS'ing 
mechanism. The DOS'er simply has to clear the SA cache and send a packet, 
cira repeat.

My apologies if this security consideration is already addressed in another 
RFC/ID.

Cheers

Dg

---

From: marcelo bagnulo braun <[email-masked]>
Date: Wed, 20 Oct 2004 18:36:51 +0200

Hi Kenji,

> is running in the site X?

Well i am assuming one of the solutions available in

http://www.ietf.org/internet-drafts/draft-huitema-multi6-ingress- 
filtering-00.txt

(except the one of suppressing ingress filtering)

> in a site with normal (destination address based) routing.

Yes, but you can also do approaches like the one presented in the  
appendix of the above draft

Regards, marcelo

---

From: marcelo bagnulo braun <[email-masked]>
Date: Wed, 20 Oct 2004 18:39:57 +0200

Hi David,

El 20/10/2004, a las 16:21, David Gethings escribió:

> Overall a good draft.

thanks

>  But I do have one concern. In section 5.2 you propose 3

I may not be understanding your point here...
The proposed mechanism is to be used for initiating communications, not 
when the host receives an incoming communication.
I mean, the DOSer doesn't have a mechanism to trigger the multiple 
packets, i think.

Am i missing your point?

Thanks, marcelo

---

From: David Gethings <[email-masked]>
Date: Thu, 21 Oct 2004 10:38:28 +0100

> I mean, the DOSer doesn't have a mechanism to trigger the multiple
Perhaps a bit. Suppose the DOS'er has control of a dual homed node. He then 
installs some code that initiates communication with a target. For every 
packet this code sends the stack will send two. This will multiply the effect 
of the attack.

I'm not saying that this mechanism facilitates DOS'ing but it could multiple 
it's effects without any additional effort by the DOS'er.

Cheers

Dg

---

From: marcelo bagnulo braun <[email-masked]>
Date: Thu, 21 Oct 2004 11:51:59 +0200

> it's effects without any additional effort by the DOS'er.

Ok, i see your point and i agree

however, once that an attacker has control over a given node, i am not 
sure if there is much difference in the required effort to send one or 
two packets.

Anyway, thanks for your comment, regards, marcelo