Subject: [nemo] multihoming: potential threat? (was: about draft-ietf-nemo-requirements-00.txt)

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Fri, 28 Mar 2003 17:25:35 -0000

I wonder if there's not also a security issue there, if we start doing
dynamic advertisements from the MR to the HA. 

Scenario is this:

2 uncoordinated MRs provide their services on the same Mobile Network

MR1 -> prefix 1
MR2 -> prefix 2

prefix 1 and prefix 2 are now both present and advertised in RAs on the
Mobile Network.

If MR1 does not support stateless autoconf on the ingress interface to
that Mobile Network, then we have the ingress filtering problem that
Erik mentioned.

Now if MR1 supports stateless autoconf on that interface:

MR1 will allocate an address out of P2 AND install a connected route to
P2 via the ingress interface. 
Note that this route does not come from a routing protocol with a
trusted party. Only L2 access control may actually hint about the
veracity of the claim by MR2 of the ownership of prefix 2. 
 
If MR1 redistributes its connected routes over the routing protocol with
the HA, and if in turn the HA redistributes that, now we end up with a
situation where HA1 advertises P2.

Now what if MR2 is a rogue advertising prefixes that it does not
actually own... 

Pascal

> -----Original Message-----
> From: Erik Nordmark [mailto:[email-masked]] 
> Sent: vendredi 28 mars 2003 10:11
> To: Hesham Soliman (EAB)
> Cc: 'Erik Nordmark'; 'Takeshi TANAKA'; 'marcelo bagnulo'; 'IETF NEMO'
> Subject: RE: [nemo] about draft-ietf-nemo-requirements-00.txt
> 
> 
> > => Sure, but I was aiming at a smaller step, i.e. making this
> > configuration work. 
> > My main concern was to accomodate the case where the two
> > MRs belong to different HAs/ISPs/domains ...etc so that
> > ingress filtering in the home network cannot be coordinated. 
> > In this case the benefit of multihoming is not redundancy, 
> > but potentially because the two MRs can provide different 
> > access characteristics (cellular, WLAN ...etc). They may also
> > provide the same access but more than one happened to be available.
> > I.e. load sharing on the MRs' egress interfaces. 
> 
> OK. In that case you end up with the "uncoordinated site 
> multihoming" problem. Solutions have been proposed in that 
> context (in the ipv6mh discussions and perhaps in multi6 as 
> well). It wouldn't hurt to have some Nemo document covering 
> multihoming to state the issue/problem, but I'm assuming that 
> solutions (that are not Nemo specific) will be developped 
> elsewhere so no need to touch on solutions in a Nemo document I think.
> 
>   Erik
> 
>

---

From: Alexandru Petrescu<[email-masked]>
Date: Fri, 28 Mar 2003 19:42:52 +0100

Hi Pascal, I'm trying to understand your scenario and risks.

Are you basically saying that when a mobile network is multi-homed,
and the MRs and HA run dynamic routing protocol, then it is possible
for one MR to fool the other MR into believing a fake route?

More comments inside:

Pascal Thubert (pthubert) wrote:
> I wonder if there's not also a security issue there, if we start 
> doing dynamic advertisements from the MR to the HA.
> 
> Scenario is this:
> 

A topology like this:?

                            ---------
                          /          |
               ----------/           |
   -------    |          |           |
-| HA/BR |---| Internet |           |
   -------    |          |           |
               ----------\           |
                          \          |
                           \         |
                            |        |
                            |        |
                          -----    -----
                         | AR1 |  | AR2 |
                          -----    -----
                            |        |

                            |        |
                          -----    -----
                         | MR1 |  | MR2 |
                          -----    -----
                            |        |
                           ------------
                                     |
                                  -----
                                 | LFN |
                                  -----
> 
> MR1 -> prefix 1 MR2 -> prefix 2
> 
> prefix 1 and prefix 2 are now both present and advertised in RAs on
>  the Mobile Network.

Ok, and both prefixes come from the home domain, right?, not from the
visited domain.

> MR1 will allocate an address out of P2 AND install a connected 
> route to P2 via the ingress interface.

I don't understand this, why would MR1 configure itself ("allocate?")
an address out of P2?  P2 is advertised on the RAs sent by the ingress
interface by MR2, not by MR1 right?

Also, why would MR1 install a connected route to P2 via its ingress
interface?

> If MR1 redistributes its connected routes over the routing protocol
>  with the HA, and if in turn the HA redistributes that, now we end 
> up with a situation where HA1 advertises P2.

Do you mean "a situation where MR2 advertises P2"?  If you mean so,
then even if MR1 claims to HA that is being capable to route to p1 (as
a directly connected interface), and that HA runs dynamic routing
protocol both with MR1 and MR2, you might fear of ending up with three
routers (HA, MR1 and MR2) that exchange routing information.  So I
assume they do it right, that's the job of routing protocols.

On another hand, if you assume that among these three routers, one is
rogue and pretends a prefix that it does not actually own, and injects
a route there where it shouldn't, then this can be probably reduced
from a model with three routers MR1, MR2 and HA1 to a model with two
routers MR and HA.

In that case, yes, please clarify?

Alex