[multipathtcp] This shim6 part of the answer (was Re: High-level design decisions /architecture

[marcelo bagnulo braun <[e-mail]>]

I am splitting the answer in the shim6 part and the mptcp part, so that 
people not interested in shim6 (which i guess are plenty since this is 
the mptcp ml, can simply drop this email)

William Herrin escribió:
> On Mon, Nov 2, 2009 at 6:45 PM, marcelo bagnulo braun
> <[e-mail]> wrote:
>   
>>> I'm concerned about this idea. One of the corner cases where shim6
>>> falls apart is: once the connection migrates away from the original
>>> addresses, how do the endpoints decide whether a new connection
>>> request for the original addresses means the migrated addresses or the
>>> current holder of the addresses? Think: FTP.
>>>
>>>       
>> could you expand on this?
>> I wasn't aware shim6 falls apart in any case neither this particular
>> approach...
>>     
>
> Hi Marcelo,
>
> Consider the following scenario:
>
> Host A comes online with 1.2.3.4.
> Host A requests a new TCP connection to 5.6.7.8.
> Established with host B at 5.6.7.8.
> Host B adds 8.7.6.5
> Host B removes 5.6.7.8
> Host C comes online with 5.6.7.8.
> Host A requests a new TCP connection to 5.6.7.8.
>   
> Which host does A connect to?
>
>   

first of all Shim6, as one may guess from the acronym :-) only works for 
IPv6 identifiers.

So, non of them apply to shim6

Second, due to large space of IPv6 iid, the situation you describe there 
is very unlikely to happen by a coincidence.
It may be due to an attack, where the attacker is host C, agree?
 
assuming that above were IPv6 addresses, the host you actually connect 
to depends whether you are using forking or not.
But in general, you will be connecting to host B, as long as the shim6 
state is on host A


> If the answer is C, protocols like FTP which initiate multiple TCP
> connections to the same IP address fail once an endpoint gives up its
> original address. That'll also impact web browsers which employ dns
> pinning.
>
> If the answer is B, I can hijack hotmail's IPs with respect to your
> mail server for the few fractions of a second it takes to establish
> and move a TCP connection over to an IP address I legitimately
> control. You'll then indefinitely send subsequent hotmail-addressed
> email to me. If I diligently pass it on to hotmail, you may never even
> know.
>   
No, In order to do that you would have had to generate an HBA for that 
address, which in computationally impossible in a reasonable timer frame.
So, no hijacking attacks in shim6

If you do think there is the possibility of a hijacking attack, please 
describe it.

So, i don't see shim6 breaking in this case...

Regards, marcelo


> If we identify the connection by the original IP address even after
> that address is gone, effectively lying to the application, we can
> induce it to incorrect behavior. That can have security implications
> that may be hard to get a handle on.
>
> Regards,
> Bill Herrin
>
>