Re: [Anima-bootstrap] Can the proxy add information during bootstrap?

[Toerless Eckert <[e-mail]>]

Michael:

As MichaelB mentioned, it is quite normal that backend devices
try to match up new devices to some port on the connecting device,
eg: When a client connects to a switch and sends a DHCP request,
the switch adds into the request a DHCP option 82 with the name
of the switch port to which the client is connected. That triggers
on the DHCP server some policies built against the location that
client connects to.

I agree that we can not have the proxy break into the TLS connection,
but Max was mentioning that there is some data that clients add
in some initial TLS setup packet to help a proxy determine which
TLS server to connect to (connect-server ??). So there seemingly are
parts of the initial connection setup where information can be
added in the clear. So why could we not also use this trick and have
the proxy add an "option 82" type information piece to the setup packet
it sends to the registrar ? The proxy can ensure that it overrides/fixes
up any such option 82 if it receives it from the client, and the
registrar can trust the option 82 because it receives it via the
ACP.

Imagine the proxy switch has links to totally different client-side
locations.  It would be a perfect policy to reject enrollment if the device
was mixed up and sent to the wrong location.

Cheers
    toerless

On Tue, Apr 12, 2016 at 08:14:18PM -0400, Michael Richardson wrote:
> 
> Michael Behringer (mbehring) <[e-mail]> wrote:
>     > When a new device enrols, an operator will want to know WHERE this
>     > device is connecting. This includes the proxy identity, plus the
>     > interface on the proxy. (Potentially more)
> 
>     > The proxy identity can be figured out by looking at the source address
>     > of the incoming packets; but the interface information needs to be
>     > added explicitly, somehow.
> 
> Yes, source address of encapsulating packet, and since it's an ACP, and since
> the proxy negotiated via GRASP with the registrar, the registrar already
> knows everything.
> 
> I don't see the problem.
> 
>     > Can our enrolment process as described today support such proxy
>     > options? If not, I think we need to re-think...
> 
> I think it's a MITM attack for the proxy to add any information to the secure part.
> Any information not under the security enclosure may be untrustworthy.
> 
> --
> Michael Richardson <[e-mail]>, Sandelman Software Works
>  -= IPv6 IoT consulting =-
> 
> 
> 



> _______________________________________________
> Anima-bootstrap mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/anima-bootstrap


-- 
---
Toerless Eckert, [e-mail]