[secdir] PRE enforcing message validity (was RE: Secdir review of draft-ohba-pana-relay)

["Alper Yegin" <[e-mail]>]

Hi Alan,

Thank you for the review.

> >    The Security Considerations section says:
> >
> >     Since the PRE does not maintain per-PaC state, the PRE is robust
> >     against resource consumption DoS (Deniable of Service) attack.
> >
> >    However, the PRE relays packets to the PaC.  This means that
> entities
> > on the PAA network can now send PANA messages to the PaC, when they
> > previously could not.  While the PaC is supposed to discard invalid
> > and/or unexpected messages (RFC 5191), the PRE can be used to send
> > messages to *arbitrary* UDP ports on the PaC or any other machine in
> the
> > PaC network.

Is the concern that a rogue PRE injecting bogus PANA messages towards the
PaC, or a legitimate PRE relaying bogus PANA messages injected by some rogue
PAA?



> >
> >    The same attack applies (but less so) in the inverse direction.  A
> > fake PaC can send the PAA arbitrary PANA messages.  Since this can
> > already happen today, there is no new issue here.
> >
> >    Having a stateful PRE would help address this attack.  It would
> not
> > prevent it, as the PANA messages are unsigned, and anyone can pretend
> to
> > be the PRE.
> >
> >    I would suggest requiring that the PRE enforce the Message
> Validity
> > checks of RFC 5191, Section 5.5.  If this cannot be done in its
> > entirety, this draft should add a new section entitled "Message
> Validty
> > checks for the PRE".
> >
> >    e.g. The PRE MUST relays only well-formed PANA messages to the
> PAA.
> > And before relaying messages back to the PaC, it ensures that the
> > Relayed-Message AVP contains a well-formed PANA message.  All
> malformed
> > messages MUST be discarded.

Why not let the PaC deal with this? It already performs such checks.


Alper