[Pana] FW: PRE enforcing message validity (was RE: Secdir review of draft-ohba-pana-relay)

"Alper Yegin" <alper.yegin@yegin.org> Tue, 14 December 2010 08:38 UTC

From: Alper Yegin <alper.yegin@yegin.org>
To: pana@ietf.org
Date: Tue, 14 Dec 2010 10:40:30 +0200
Message-ID: <002d01cb9b6a$93c3ea40$bb4bbec0$@yegin>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Thread-Index: AcuYPqjxXV+rcKfeSK63xsDrVdaSlACYEgOgADLmH+A=
Content-Language: en-us
Subject: [Pana] FW: PRE enforcing message validity (was RE: Secdir review of draft-ohba-pana-relay)
Precedence: list

Resending to the list.....

-----Original Message-----
From: Alper Yegin [mailto:alper.yegin@yegin.org] 
Sent: Monday, December 13, 2010 10:28 AM
To: 'Yoshihiro Ohba'; 'Alan DeKok'
Cc: 'secdir@ietf.org'; 'draft-ohba-pana-relay@tools.ietf.org';
'margaretw42@gmail.com'; 'Ralph Droms'; 'paduffy@cisco.com';
'samitac@ipinfusion.com'; 'robert.cragie@gridmerge.com'; 'pana@ietf.org'
Subject: PRE enforcing message validity (was RE: Secdir review of
draft-ohba-pana-relay)

Hi Alan,

Thank you for the review.

> >    The Security Considerations section says:
> >
> >     Since the PRE does not maintain per-PaC state, the PRE is robust
> >     against resource consumption DoS (Deniable of Service) attack.
> >
> >    However, the PRE relays packets to the PaC.  This means that
> entities
> > on the PAA network can now send PANA messages to the PaC, when they
> > previously could not.  While the PaC is supposed to discard invalid
> > and/or unexpected messages (RFC 5191), the PRE can be used to send
> > messages to *arbitrary* UDP ports on the PaC or any other machine in
> the
> > PaC network.

Is the concern that a rogue PRE injecting bogus PANA messages towards the
PaC, or a legitimate PRE relaying bogus PANA messages injected by some rogue
PAA?



> >
> >    The same attack applies (but less so) in the inverse direction.  A
> > fake PaC can send the PAA arbitrary PANA messages.  Since this can
> > already happen today, there is no new issue here.
> >
> >    Having a stateful PRE would help address this attack.  It would
> not
> > prevent it, as the PANA messages are unsigned, and anyone can pretend
> to
> > be the PRE.
> >
> >    I would suggest requiring that the PRE enforce the Message
> Validity
> > checks of RFC 5191, Section 5.5.  If this cannot be done in its
> > entirety, this draft should add a new section entitled "Message
> Validty
> > checks for the PRE".
> >
> >    e.g. The PRE MUST relays only well-formed PANA messages to the
> PAA.
> > And before relaying messages back to the PaC, it ensures that the
> > Relayed-Message AVP contains a well-formed PANA message.  All
> malformed
> > messages MUST be discarded.

Why not let the PaC deal with this? It already performs such checks.


Alper

[Pana] FW: PRE enforcing message validity (was RE… Alper Yegin