[pim] last-hop threats by hosts to PIM

Hi,

Based on the discussions on the list, and encouragement from a couple 
of people, plus a suggestion that it might make sense to try to attack 
this problem separately from the IGMP/MLD perspective, I've written a 
short I-D (only 10 pages, including the boilerplates!) on the last-hop 
threats by hosts to PIM:

Abstract
    Security threats analysis has been done on some parts of the
    multicast infrastructure, but the threats specific to the last-hop
    attacks by hosts on the PIM routing protocol have not been well
    described in the past.  This memo aims to fill that gap.

It has been submitted, but in the interim, available at:

http://www.netcore.fi/pekkas/ietf/draft-savola-pim-lasthop-threats-00.txt

This complements I-D.ietf-mboned-mroutesec and 
I-D.daley-magma-smld-prob.

Feedback is welcome!

In particular, I would be interested in getting expert opinion on the 
following XXX points:

    It seems that a DR can send PIM messages (like Prune/Join) to the
    non-DR to be forwarded upstream on behalf of directly connected (to
    both DR and non-DR) sources.  In other words, a host on a stub LAN
    can be elected as a DR and act as a "man-in-the-middle" between the
    other hosts and the real PIM router.  [XXX: Is this correct?  Should
    non-DRs reject forwarding upstream messages from downstream LAN's
    DRs, because a real DR should have its own upstream connectivity?]
...
    With a PIM Assert, a router can be elected to be in charge of
    handling all traffic from a particular (S,G) (where S might also be
    all of S? [XXX: true?]).  This overrides DR behaviour.
...
    As noted before, it is also possible to spoof an Assert on someone
    else's behalf to cause a temporary disruption on the LAN.  However,
    it is not 100% clear what happens when the router which was spoofed
    receives "it's own assert" and CouldAssert(S,G,I) is False?  [XXX: a
    PIM expert should say something?  Is this an issue in the state
    machine?]

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

_______________________________________________
pim mailing list
pim@ietf.org
https://www1.ietf.org/mailman/listinfo/pim