Subject: Re: [mobile-ip] Mobile Routers support without optimization

From: James Kempf <[email-masked]>
Date: Mon, 20 Aug 2001 13:11:16 -0700 (PDT)

>It's probably useful to go back to first
>principles here. That is, who in the triangular
>path between MN, HA and CN actually knows whether
>MN should be allowed to assert the prefix it is
>trying to bind (assuming no global prefix PKI, of
>course)? One thing is for certain, it's not
>necessarily the HA. In fact, I'm going to guess
>that it's probably at the edge of the CN's BGP AS
>that you really have concrete knowledge. Ie does
>the HA's AS advertise this (summarized) prefix or
>not?
>

Hmm, good point. 

>Indeed, it's not entirely clear that the CN is
>really the one that should be the target of the
>BU.
>

I guess what I'd question is why the CN's border router 
is any more authoritative than the HA.

Here's what I think might be an answer. BGP updates are
authenticated, so the CN's border router can trust
the routing table updates it receives from the HA's 
AS. And the CN can trust its own border router, so
a transitive chain of trust, is established between
the HA's AS and the CN's AS. Is that enough?

The only issue is that if the BGP routes are aggregated,
the MR's prefix won't show up in the CN AS routing
tables, though some superprefix will. If as per my
followup message to Erik, one constrains the MR subnet
prefix to be a subprefix of the HA 's prefix, and the HA prefix
to be a subprefix of a prefix in the BGP routing tables,
then would that be enough to let the CN validate?

The only issue I can think of is that the HA might send
out a message with a bogus return address that had
the prefix for another subnet in order to spoof the
CN. But, similarly, the MR could send out a bogus
prefix in the BU. In either case, the bogus prefix
would be a prefix that was routable via the BGP routing
tables for CN's AS, but neither HA nor MR would be
authorized to route it. 

I think this problem would similarly hold if the BU
was sent to the BGP border router, unless the BU
has the same level of authentication as the BGP
route updates.

Basically, I don't see any way around requiring some
out-of-band exchange of security material if we want
to verify that the MR and HA are allowed to route
a particular prefix.

		jak

---

From: Erik Nordmark <[email-masked]>
Date: Mon, 20 Aug 2001 23:02:17 +0200 (CEST)

> then would that be enough to let the CN validate?

How about an example where this breaks.
At home I have a small subnet from my ISP (a /48 with IPv6).
The ISP advertises a large chunk (because it is a large ISP)
so it might be a /19 that is visible in BGP.

I then have a /64 for e.g. my PAN carved out from from my /64.

Then it seems like, even given the BGP information, a CN could pontentially
think my MR has authority to express binding for the whole /19 that the ISP
advertises in BGP.

So I frankly can't see how you can use this approach unless you remove
the route aggregation used in the Internet.
What am I missing?

  Erik

---

From: Michael Thomas <[email-masked]>
Date: Tue, 21 Aug 2001 15:14:04 -0700 (PDT)

> is any more authoritative than the HA.

   As I've mentioned in earlier mail, it's not necessarily
   in the CN's AS (I've had a bit more time to think about
   this since I wrote the previous note). It is a router
   which has a stake in enforcing sanity on its subnet
   delegations. I'm thinking that it is either
   router who summarizes the subnet at an
   administrative domain or a top level BGP route.
 
 > AS. 

   Not quite. The authentication just keeps outsiders
   out. If you're part of the BGP club though, anything
   is possible; if I want to advertise something ridiculous,
   nothing prevents me from doing that (that I know of).
   Same thing with RIP/OSPF/IS-IS...
   
   [disclaimer: BGP may have more safeguards than this,
    but the real point is that if you're part of the 
    BGP club, you can do significant damage to the routing
    system which is ultimately only enforceable by 
    other BGP's refusing to peer with you. If
    somebody knows otherwise, I'm all ears about
    how this is done.]

 > then would that be enough to let the CN validate?

   I believe that we can delink this problem from the
   particular routing protocols; indeed, if there
   were a solution it ought to work equally well
   with static routes. I think that the important
   property is that is the router which summarizes
   the prefix on the trusted side of the
   delegation boundary.

 > to verify that the MR and HA are allowed to route

   Right. See my straw proposal I sent this
   morning.

		Mike

---

From: Erik Nordmark <[email-masked]>
Date: Thu, 23 Aug 2001 09:48:35 +0200 (CEST)

>     somebody knows otherwise, I'm all ears about

This is gettting a bit off topic but ...

It is possible to manually define lists of prefixes that are acceptable
from routing peers, indepedent of the routing protocol as far as I know.
Thus X could configure its BGP speakers that talk to Y to only accept
prefixes P1, P2, etc.

I don't know if this is in operational use at all.

I've heard of an effort to explore automating this based on the IPv4 address
assignments done by the RIRs somehow, but a lot of the IPv4 address space
was assigned by the IANA before the RIRs arrived.

   Erik