Subject: [Anima-bootstrap] Anima bootstrap: discover protocol multicast notes

From: Toerless Eckert <[email-masked]>
Date: Tue, 17 Jan 2017 18:17:32 +0100

Hi folks

I have added my gist wrt to the discovery protocol detail i am
interested in to the etherpad

http://etherpad.tools.ietf.org:9000/p/anima-boostrapping?useMonospaceFont=true

 lines 368  - 407

Hope this explains it better than my feeble verbal attempts during the call.

Cheers
    Toerless

---

From: Toerless Eckert <[email-masked]>
Date: Tue, 17 Jan 2017 18:28:24 +0100

Oh, and just read mDNS RFC and found the place where it prohibits
periodic unsolicited announcements, so added that at the end.

Michael: Would be great if you
can figure out what you see in your network. Worst case we'll have
to ask Stewart...

Cheers
    Toerless

-- 
---
[email-masked]

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 18 Jan 2017 12:13:59 +1300

Hi Toerless,

> (R)ight: L2 discovery protocol requirement:
> proxy needs to periodically (unsolicited) announce its proxy service via L2 multicast/broadcast
> pledge only accepts reply if it was multicast/broadcast
> pledge should then try to register via such discovered proxies.
> if multiple proxies discovered, parallel and/or sequential -> more difficult discussion

I take that as a vote for M_FLOOD

> The security of (R)ight depends on pledge being able to see if received packet from proxy was L2
> unicast or multicasted. 

Why? If a malicious node knows that pledges might be checking this, they will
multicast their bogus announcements. And how could they know the address of
a targetted pledge anyway, in order to send the bogus announcement unicast?

> This information is typically ignored in existing network protocol stacks
> and is also typically unavailable on the socket-API. This IMHO makes it highly beneficial to
> use a very lightweight protocol (like the subset of GRASP dedicate to this) that can specifically
> be implemented to do this security check.

Presumably you have to use a raw socket. I don't see any other way to get the
destination address out of the packet.

Regards
   Brian