Re: [secdir] PRE enforcing message validity (was RE: Secdir review of draft-ohba-pana-relay)

[Alan DeKok <[e-mail]>]

Alper Yegin wrote:
>>> While the PaC is supposed to discard invalid
>>> and/or unexpected messages (RFC 5191), the PRE can be used to send
>>> messages to *arbitrary* UDP ports on the PaC or any other machine in
>> the
>>> PaC network.
> 
> Is the concern that a rogue PRE injecting bogus PANA messages towards the
> PaC, or a legitimate PRE relaying bogus PANA messages injected by some rogue
> PAA?

  A legitimate PRE relaying bogus PANA messages.  Or even non-PANA
messages.  From my reading of the draft, the reply from the PAA is a
PANA message with a PANA message carried as a TLV.  But there is *no*
requirement that the TLV actually carries a real PANA message.  So it
can be anything.

>>>    e.g. The PRE MUST relays only well-formed PANA messages to the
>> PAA.
>>> And before relaying messages back to the PaC, it ensures that the
>>> Relayed-Message AVP contains a well-formed PANA message.  All
>> malformed
>>> messages MUST be discarded.
> 
> Why not let the PaC deal with this? It already performs such checks.

  The PaC discards invalid PANA messages sent to the port from which it
sent PANA messages.

  Since the PRE is stateless, it can be coerced into sending messages to
*any* port on the PaC.  Since the PRE has no requirement to verify the
relayed message, it doesn't even have to be PANA.

  The PRE can be convinced to relay arbitrary data to arbitrary UDP
ports on the PaC.  This can't be a good thing.

  Alan DeKok.