Subject: [savi] A query and a kind of potential attack in draft-bagnulo-savi-fcfs-01

From: ZhangDong <[email-masked]>
Date: Fri, 13 Mar 2009 14:56:36 +0800

Hi Marcelo,

You mentioned special cases in section2.4 in fcfs-01. One of the special cases is o  Anycast i.e. multiple hosts using the same source address to send packets.
I am puzzled.  As described in RFC2460:
   o  An anycast address must not be used as the source address of an
      IPv6 packet.

   o  An anycast address must not be assigned to an IPv6 host, that is,
      it may be assigned to an IPv6 router only.
How does the case that multiple hosts using the same source address to send packets happen?
In fcfs-01, the word "anycast" means the case that multiple link-layer addresses (such as MAC)use one IP address?

The section 3.3.1 ARP-based Neighbor Unreachability Detection procedure in fcfs-01 designs a mechanism of NUD based on arp. The savi device sends an ARP REQUEST packet as the NUD message. Suppose that an attacker has initiated arp cheating. The attacker responds the arp request whic is the NUD message. In this case, when the user really changes another IP address with the same MAC, because of  the NUD response of the attacker, the binding o
f IP and MAC in savi device wiil not be update. And then, the packets sent by the new IP address of the user will be discard by savi device.

Will this problem happen?  Do i have misunderstanding?

Thank you very much.

Dong Zhang

---

From: marcelo bagnulo braun <[email-masked]>
Date: Fri, 13 Mar 2009 10:31:10 +0100

Hi Zhang,

thanks for you comments.

please note that there is a new version of the draft 
http://www.ietf.org/internet-drafts/draft-ietf-savi-fcfs-01.txt
this has importnat modifications from the version you reviewed.
Especially, it only covers IPv6

> How does the case that multiple hosts using the same source address to send packets happen?
AFAIU, irrespectivelly whatever the RFC says, anycast is widely used in 
IPv4 in particular in dns servers (especially root and tld servers)

> In fcfs-01, the word "anycast" means the case that multiple link-layer addresses (such as MAC)use one IP address?
well, anycast means that multiple hosts use the same IP address

> The section 3.3.1 ARP-based Neighbor Unreachability Detection procedure in fcfs-01 designs a mechanism of NUD based on arp.
This section is no longer avialbale in the new version, please check if 
your concern is valid for the IPv6 version only

regards, marcelo

>  The savi device sends an ARP REQUEST packet as the NUD message. Suppose that an attacker has initiated arp cheating. The attacker responds the arp request whic is the NUD message.In this case, when the user really changes another IP address with the same MAC, because of  the NUD response of the attacker, the binding o
>

---

From: marcelo bagnulo braun <[email-masked]>
Date: Mon, 16 Mar 2009 08:44:00 +0100

ZhangDong escribió:
> Dear Marcelo,
>
> You changes fcfs only for IPv6.
> Then what about IPv4?
>   
i think the idea is to use dhcp based solution in ipv4, since there is
no stateless autconf in ipv4

> I'am sorry for missing some discussion in ml perhaps.
>
>
> Dong Zhang
>
>
> ----- 原始邮件 -----
> 发件人: marcelo bagnulo braun <[email-masked]>
> 日期: 2009年 3月 13日, 星期五,  下午5:56
> 主题: Re: A query and a kind of potential attack in draft-bagnulo-savi-fcfs-01
> 收件人: ZhangDong <[email-masked]>
> 抄送: SAVI Mailing List <[email-masked]>
>
>
>   
>> Hi Zhang,
>>  
>>  thanks for you comments.
>>  
>>  > You mentioned special cases in section2.4 in fcfs-01. One of the 
>> special cases is o  Anycast i.e. multiple hosts using the same source 
>> address to send packets.
>>  > In fcfs-01, the word "anycast" means the case that multiple 
>> link-layer addresses (such as MAC)use one IP address?
>>  >
>>  >   
>>  > The section 3.3.1 ARP-based Neighbor Unreachability Detection 
>> procedure in fcfs-01 designs a mechanism of NUD based on arp.
>>  >  The savi device sends an ARP REQUEST packet as the NUD message. 
>> Suppose that an attacker has initiated arp cheating. The attacker 
>> responds the arp request whic is the NUD message.In this case, when 
>> the user really changes another IP address with the same MAC, because 
>> of  the NUD response of the attacker, the binding o
>>  >   
>>  > f IP and MAC in savi device wiil not be update. And then, the 
>> packets sent by the new IP address of the user will be discard by savi 
>> device.
>>  >