Re: [savi] A few comments on draft-vogt-savi-framework

[Eric Levy-Abegnoli <elevyabe at cisco.com>]

Christian Vogt a écrit :

On Nov 2, 2009, Eric Levy-Abegnoli wrote:

  

A savi device not SEND-capable breaks RFC3971.
    

Let's be a bit more specific here.  In what way would a non-SEND-capable
SAVI device break RFC 3971?  Alberto has mentioned one case -- when a
SEND host's DAD fails for the second time due to an unsecured Neighbor
Advertisement, then the SEND host will configure the IP address, yet a
non-SEND-capable SAVI device would block the IP address.  Is this the
issue you are referring to?  Then we should discuss whether or not this
is acceptable.  Or are there more issues you are thinking of?
  

The sole purpose of CGA is to enable a CGA-capable node to prefer CGA-prooved NDP message over a none prooved one.
If the savi device does first-come-first-serve, and is not able to verify (and prefer) CGA credentials, then there are plenty of scenarios
where it will keep the non CGA owner entry and discard traffic from the legitimate: basically all scenarios where the non-CGA came first.

But I consider keeping the bogus entry is not the worse. It also prevents CGA-capable nodes to make a RFC3971 proper decision, by not
showing them messages from the legitimate owner, provided that it came second.

This is **not** a theoritical issue. I'll give you one scenario (you asked for it :)):

1) A CGA-capable node N (typically a critical host, such as a server or a router) gets its address X in the savi binding table
2) an attacker M spots X -easy, it's multicast in NA -. He sends DAD NS every minute for target X. As long as N is there,
   he gets the NS, responds with NA and that's legal.
- In parallel, M computes X' (easy), the sibling CGA address of X (with colision = 1) and DAD it. The savi device installs it in the table
- At some point N go silent (pretty common, for maintenance, move, etc). Attacker M sends its periodic DAD NS for X. The savi device thinks
it's a move and replace the legitimate owner by the attacker.
- Here is the funny part. N comes back. Do DAD for X. M responds. N tries a second address X'. It's in the binding table! M responds.
- N ignores the response (that's 3971) and start sourcing with X'. All its traffic is dropped. Including the unsolicited NA to all-nodes
- Every node on the link, including the CGA-capable now have M as X and X' owner.  And the savi device is dropping all N traffic.

That's what I call highjacking.
While this is not worse than before for non-CGA capable nodes, any CGA-capable nodes on the link should have prefered  N to M.
But they don't have chance to see N. So CGA (RFC3971) become pointless, useless.
Eric

- Christian