Subject: [mobile-ip] RE: MIPv6 spec:Security Issue with 'R' bit in Prefix Information Option

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Sat, 15 Feb 2003 21:39:42 +0100

Hi James, 

 > Section 7.2 of draft-ietf-mobileip-ipv6-20.txt) specifies 
 > this as a MUST only
 > for home agents. It is a MAY for other routers.

=> Correct. But presumably FMIP will require a lot 
of changes to ARs so there is no harm in requiring 
this. IMNSHO, I think this should be a SHOULD in 
the basic spec and am very surprised it's a MAY. More
on the reasons below.

 > 
 > Unless I am missing something, advertising a global address 
 > for a last hop
 > router to a host raises a possible security risk. Though we 
 > should confirm this
 > with the IPv6 list, I suspect that the reason a global 
 > address was not specified
 > in RFC 2461 in the first place was because the authors 
 > wanted to avoid the
 > possibiity that a host could send the address to some other 
 > host across the
 > Internet, and the other host could then launch a DoS attack 
 > on the router. Also,
 > while a case might be made for a home agent, the subnet 
 > anycast address can be
 > used for the purpose of having the host contact the home 
 > agent. For any other
 > router, there is no need for this, and I can't see an ISP 
 > deploying this since
 > it will expose their last hop routers.
 > 
 > Any idea why this is in the draft, and any chance it can be 
 > removed? I realize
 > time is late.

=> Security issues aside (I'm not sure it's a problem), advertising
a global address is crucial for movement detection. Simply
receiving a new prefix does not mean the mobile node changed
links. Relying on the router's link-local address is not 
enough because it can easily be duplicated across links. This
is especially true for manually configured address. If I were
configuring addresses I'd use ::1, ::2 ...etc. 
Incidentally this voice was also echoed in draft-nordmark-foresight...
So I think the R bit (and the consequence of advertising a global address)
is crucial and will save time for movement detection. 

Hesham

PS: I think operators can simply use a prefix for their 
infrastructure nodes and make sure that their firewalls 
prevent anyone outside their network from reaching it
if they are worried about attacks on their ARs. Of course
in a public access network attacks can also come from
MNs; so routers need to be robust and secure enough anyway.

---

From: Francis Dupont <[email-masked]>
Date: Wed, 19 Feb 2003 18:07:54 +0100

Some comments:
 - I don't believe in the security issue because there are already
   several ways to know the address of the router...
 - even without mobility, there are many cases where it is very useful
   to know at least one global address of a router. IMHO the R bit
   should get a SHOULD for any router.

Regards

[email-masked]

PS: I don't propose to change the draft because this (s/MAY/SHOULD/) is
in the scope of the IPv6 WG.