Subject: Re: [nemo] Section 8 comment in IESG review

From: Mattias Pettersson <[email-masked]>
Date: Thu, 01 Apr 2004 10:30:28 +0200

Hi Hesham,

Soliman Hesham wrote:
> I saw Steve Bellovin's comment on this section below.
> Since I've been wanting to raise the same point, I have 
> a short comment.
> 
> 8:      This text is unclear:
> 
>            When the Mobile Router and the Home Agent exchange routes
>            through a dynamic routing protocol, the Mobile Router
>            should be careful in including the same Mobile Network
>            Prefixes in the Binding Update to the Home Agent and in
>            the routing protocol updates.  The Home Agent depending
>            on its configuration might not add routes based on the
>            prefix information in the Binding Updates at all, and
>            might use only the routing protocol updates.  Moreover,
>            including the same prefix information in both the Binding
>            Update and the routing protocol update is redundant.
> 
>         Do you mean "be careful to include the same information in
>         both places" -- redunancy is sometimes good.  Or do you
>         mean "be careful to avoid doing this"?  Personally, I think
>         the former is more appropriate, because it allows a check
>         on the validity of the routing information.  Note that the
>         prefixes announced via binding updates are checked for
>         authorization; routing data generally is not.  I would thus
>         suggest that routing advertisements MUST NOT contain any
>         prefixes not known to the home agent by either implicit
>         mode configuration or explicit mode announcement.
> 
> => Basically I think we need to make sure that the HA
> checks the routing information exchanged and matches it 
> against the prefix information that it already knows from
> the MNP table/manual config/BCEs ..etc to make sure that
> MRs are authorised to advertise such prefix(es). 
> So we need tight coupling between the routing protocol
> content and the content in the BU/manual config.
> Otherwise Bad Guy could send a vaild BU and start announcing
> someone else's prefix. 
> 
> Note that in many cases today IGPs are authenticated with
> a single "domain key". To maintain this type of security
> we need to verify that the MRs are authorised to advertise
> reachability to the prefixes in question. 
> 
> I think a text change for this section will suffice.

I basically agree with you. I think there may be two use cases here with 
slightly different assumptions:

1. All MRs and HA belong to the same administrative domain. They can 
have a single trust level (domain key).

2. MRs belong to different administrative domains or the HA and the MRs 
belong to different domains. Obviously they don't trust each other.

In 1) it would be ok to separate BU authorization from routing protocol 
authorization. In 2) it wouldn't. What you propose is to always go with 
the assumption that entities don't trust each other and that we have 
multiple trust relationships.

I'm just curious how difficult one can consider it is 
(implementation-wise) to exchange information a RIPng process with the 
HA function inside the HA.

/Mattias

---

From: Mattias Pettersson <[email-masked]>
Date: Thu, 01 Apr 2004 10:30:28 +0200

Hi Hesham,

/Mattias

---

From: Alexandru Petrescu <[email-masked]>
Date: Thu, 01 Apr 2004 14:10:32 +0200

Steve Bellovin wrote about section 8 draft-02 in IESG review:
> Do you mean "be careful to include the same information in both 
> places" -- redunancy is sometimes good.  Or do you mean "be careful 
> to avoid doing this"?  Personally, I think the former is more 
> appropriate, because it allows a check on the validity of the routing
>  information.

I also think the text should be along the lines of "careful with that
prefix, include same information in both places", and not "careful to
avoid doing this".

> Note that the prefixes announced via binding updates are checked for
>  authorization; routing data generally is not.  I would thus suggest
>  that routing advertisements MUST NOT contain any prefixes not known
>  to the home agent by either implicit mode configuration or explicit
>  mode announcement.

Basically, I agree with this; this is a useful check.

My preferred way to solve this potential conflicting information between
the prefixes advertised by NEMO and the ones advertised by rt protocol
is to have NEMO _not_ have prefixes in the BU, that is: implicit mode.
Let only the rt protocol make do about prefixes.

Moreover, there are at least three ways by which a host learns routes
(rt protocol, icmp redirects, static config). Adding NEMO as a fourth
means only complicates the picture: one wants all four means to
distribute the same routing information; why not let NEMO just do the
Home-Address - Care-of-Address binding.

Alex

---

From: Alexandru Petrescu <[email-masked]>
Date: Thu, 01 Apr 2004 14:10:32 +0200

Alex

---

From: Vijay Devarapalli <[email-masked]>
Date: Fri, 02 Apr 2004 11:39:44 -0800

> Otherwise Bad Guy could send a vaild BU and start announcing

we actually wanted to avoid exactly this kind of tight
coupling between running an IGP and NEMO basic support
protocol.

consider two fixed routers running an IGP inside a
domain. is it possible for one router to advertise routes
to prefixes that it acutally does not own? if yes, I
dont think we need to fix it in NEMO if a mobile router
lies to its Home Agent. if no, use the same mechanism
that is used in the domain for verification also between
the mobile router and the home agent.

the bi-directional tunnel between the MR and the HA
actually extends the IGP domain to include the MR. thats
all. NEMO basic support protocol only creates the
bi-directional tunnel (and few more things). we dont want
NEMO to do the verification for routing protocol updates.

comments?

Vijay

> Hesham
> ========================================================
> This email may contain confidential and privileged material for the sole
> use of the intended recipient.  Any review or distribution by others is 
> strictly prohibited.  If you are not the intended recipient please contact
> the sender and delete all copies.
> ========================================================
> 
>

---

From: Vijay Devarapalli <[email-masked]>
Date: Fri, 02 Apr 2004 11:39:46 -0800

Mattias Pettersson wrote:
>> Since I've been wanting to raise the same point, I have a short comment.
>>
>> 8:      This text is unclear:
>>
>> checks the routing information exchanged and matches it against the 
>> prefix information that it already knows from
>> MRs are authorised to advertise such prefix(es). So we need tight 
>> coupling between the routing protocol

I would rather not run a routing protocol at all between
MR and HA in case there isnt sufficient trust between the
MR and the HA. we can make this more explicit if needed
in the NEMO basic support spec.

Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Fri, 02 Apr 2004 11:39:46 -0800

Vijay