Subject: Re: [MOBILE-IP] [Fwd: Re: [MOBILE-IP] New version of "MobilitySup port in IPv6"draft]

From: Glenn Morrow <[email-masked]>
Date: Mon, 9 Oct 2000 14:11:09 -0500

> In fact, I wish it were not required even when the mobile
> node is away from home.  In the future, if my fantasy comes
> true and ingress filtering is abolished, there will no longer
> be such a need for this restriction.

If an access router has a mobile node associated with it, then it should
probably be smart enough to allow the mobile to use it's home address(es) as
the destination.

In my opinion in an optimal environment ingress filtering should only be
done on the first hop at an access router, NAS, etc..

I have a similar fantasy but still believe the source filtering may be
needed only on the first hop from the source.

It may be that a rogue routing network may actually turn off 1st hop ingress
filtering and thus allow DoS attacks to originate from it. To handle this,
perhaps a method should be pursued of dynamically turning the filtering
temporarily on and off, once the origin edge network is discovered. I.e.
routing protocol work?

The problems with this are:

1> mobility is nuked during the origin location process.
2> if authentication of the signaling for turning on the filtering is not
done then
  this signaling could be used as a new form of mobile DoS attack.

The positive argument to item (1)'s temporary "problems" is that DoS attacks
may nuke a good portion of both mobile and non-mobile traffic anyway.

The positive argument to (2) is simply to do strong authentication on these
requests - no brainer.

On the bright side, I believe some recent work on filters between autonomous
systems have been published in the form of drafts for BGP4. The
applicability of this function for mobility in turning source address
ingress filtering on and off are not explicitly detailed in the drafts,
however.

People on the list and perhaps in the ipng wg might want to take a look at
and guage an opinion for these drafts.

http://search.ietf.org/internet-drafts/draft-ietf-idr-route-filter-00.txt
http://search.ietf.org/internet-drafts/draft-chen-bgp-route-filter-01.txt
http://search.ietf.org/internet-drafts/draft-chen-bgp-prefix-orf-00.txt

Perhaps the authors might wish to elaborate on some of the practical uses;
in particular - support for mobility without the use of COA as source
address.

I feel that this "find the bozos, shut them down and then let things return
to normal" solution would be far better than forcing ingress filtering to be
used all the time and everywhere.

I suspect that this could be accomplished rather quickly only denying
service for a very short time.

If the DoS attacks are not that bad, perhaps the search and destroy
procedures could be done at off hours.

        > What do you think about the "not at all swap" proposal?
        > Or have I missed something else important here?

        > Regards,
        > Charlie P.

gm> No  you haven't - thanks for bringing it up in a positive light.

I'm very interested in other proposals for solutions as well. Let's get rid
of the need for tunneling. Including the home address option is just another
form of minimal tunneling in my book. The AH question is only one such issue
that tunneling affects.

Thank You,

Glenn

---

From: Fred Baker <[email-masked]>
Date: Mon, 9 Oct 2000 16:13:03 -0700

At 02:11 PM 10/9/00 -0500, Glenn Morrow wrote:
>I feel that this "find the bozos, shut them down and then let things
>return to normal" solution would be far better than forcing ingress
>filtering to be used all the time and everywhere.

how do you detect the bozos? I think the argument for using ingress
filtering all the time is that it does indeed detect most bozos.

By the way, the most usual implementation of ingress filtering goes rather
beyond what the RFC actually says - it uses a reverse path forwarding
check. This has its own dangers, however, related to asymmetric routing.
Ingress filtering says "if you are among a few known bad things, I will
detect you", meaning that on every packet I have to apply a number of
rules. RPF says "if it would be reasonable for me to forward to you along
this path, I will let you forward via me", which happens to be a single
lookup way to apply a much stronger rule set. But asymmetric routing may
make it possible only for you to forward via me while I consider quite
another route to be my most reasonable route to you. Hence, ingress
filtering is usually only done at the edge-network-to-ISP interface;
ISP-ISP interfaces get eaten by asymmetric routing pretty badly.

I personally would favor a form of ingress filtering that ensures that only
addresses that may be found on a first-hop-router interface get used as
sources - in short, that the MAC Source Address and the IP Source Address
indeed match at the first hop, or on a dial line, that the Source IP
Address is the one that was assigned to the device dialing in. This would
detect a lot of bozo addressing. From an operational perspective, though,
unless we made this somehow mandatory to turn on and had laws that imposed
stiff fines for turning it off, operators could never trust it; they would
need to do their own RPF checks anyway, as this is the only defense that
they could control.

And yes, I think they do in fact turn on the RPF check when they think it
is appropriate, in many cases, as opposed to leaving it on all the time.

Note that if I require the IP Source Address and the MAC Address to match,
I just made COA addresses a failure case... This would have to be seen as
an acceptable exception.

---

From: Glenn Morrow <[email-masked]>
Date: Tue, 10 Oct 2000 10:03:07 -0500

fb>
> filtering all the time is that it does indeed detect most bozos.
        gm> Yes, I believe the bozos (aagh - what have I started?) should be
detected on the first hop all of the time. I think we agree.

        fb>
        By the way, the most usual implementation of ingress filtering goes
rather
> ISP-ISP interfaces get eaten by asymmetric routing pretty badly.
        gm> Good points, thanks for bringing these up.

        fb>
> detect a lot of bozo addressing.
>
        gm> me too for the IP source address. I'm not so sure about the MAC
address for all cases.

        fb>
> From an operational perspective, though,
        gm> Making it a standard BCP for IPv6 might be all that is needed.

        A method of propagating amoung autonomous systems the turning of
ingress filtering on and off on specific routes might allow for the
detection of the attackers' network or address. Once detected, the offending
nodes' connectivity could be prevented and then the filtering removed.

        The drafts I mentioned are possibly the beginnings of such
functionality.  Think of it like a tool for detecting the location of the
attacking node(s) and acting upon them.

        If such a tool were available, it would allow detection and
prosecution using existing laws.

        If no remedies for prosecution were available and the provider
refuses to enable the 1st hop filtering, the offending network might have to
be denied at the AS level as purely a business decision of other providers.
I could see how this might happen among belligerents across national
borders.

        fb>
> I just made COA addresses a failure case... This would have to be seen as
        gm> I'm not so sure about the MAC address needing to match for all
cases. The standard first hop ingress filtering would work for the COA
address without any additional routes etc.. in the first hop router.

        The use of the home address as the source address would likely
require that the first hop access router implement the concept of a binding
cache. If the route is in the binding cache then ingress filtering probably
does not need to be done. This assumes that very strong AAA is done before
any entry is made into this binding cache - no matter what method of network
access and COA assignment is used.

        I would enjoy continuing this conversation, you seem to have a very
good insight into the problem space and current deployed solution set. I'm
more interested in getting node mobility built into IPv6 the right way for
the long term at this point.

        I do not want to focus on IPv4 deployment issues that may arise with
existing implementations.

        It seems that getting strong BCPs in place for ingress filtering in
IPv6 with node mobility in mind is an important step in this regard.

        It seems that most people are supportive of limiting the filtering
to the edges of the network. This would help mobility immensely in that home
addresses could be used as the source address and remove a bunch of issues
with tunneling.

        How do think we could proceed, if at all, on these matters?

        Thanks,

        Glenn

---

From: Fred Baker <[email-masked]>
Date: Wed, 11 Oct 2000 11:29:32 -0600

At 10:03 AM 10/10/00 -0500, Glenn Morrow wrote:
>gm> I'm not so sure about the MAC address needing to match for all cases.
>The standard first hop ingress filtering would work for the COA address
>without any additional routes etc.. in the first hop router.

Well, I mentioned MAC Address to IP Source Address mapping on the first
routed hop because many of those are in fact on LANs and there is a
correlation that can be checked. When the first routed hop is also a COA
(or a designated address on the system, perhaps a loopback address, is a
COA), it would be easy enough to add its own address to the list of
acceptable mappings. My point here is that a common attack mode is that
some system fabricates traffic as if from some other system. If the system
is topologically distinct, an RPF check will catch it. If the other system
is or appears to be on the same LAN, the RPF check will not. correlating
MAC and IP Source Address should catch that.

That said, obviously not all attachments are LAN attachments, and getting
anything to happen universally is a nightmare. So for dial-up and related,
one maybe could assume that only a small set of addresses are acceptable
form the far end, and beyond that we're back to RPF checks.

>existing implementations.
I don't believe I have mentioned IPv4 other than pointing to operational
experience. What we are talking about maps equally to IPv4 or IPv6.
>It seems that most people are supportive of limiting the filtering to the
>edges of the network. This would help mobility immensely in that home
Have you gotten any operators to say that? You haven't made much of a case
until you have operational support.

---

From: Glenn Morrow <[email-masked]>
Date: Fri, 13 Oct 2000 09:02:53 -0500

> -----Original Message-----
> From: Fred Baker [SMTP:[email-masked]]
> Sent: Wednesday, October 11, 2000 12:30 PM
> To:   [email-masked]
> Subject:      Re: [MOBILE-IP] [Fwd: Re: [MOBILE-IP] New version of
> "MobilitySup port  in IPv6"draft]
>
        I have spoken with a few and most agree that it takes only one
dissenter to eliminate the possibility - looks like the use of the COA as
the source throughout the network is definitely needed.