Subject: Re: [lisp] On piggyback map rec handling

From: [email-masked] (Noel Chiappa)
Date: Sun, 7 Jul 2013 11:17:58 -0400 (EDT)

> From: Dino Farinacci <[email-masked]>

    > The way you avoid RLOC spoofing is the same way you avoid any source
    > spoofing which is by use of uRPF operationally.

Yes, but if that's the primary defense, that means you have to rely on other
people to filter out source-spoofed packets (since uRPF near the destination
is nowhere near as good at filtering out source-spoofed packets as uRPF near
their source).

I would prefer not to out-source my cracker detection/prevention; the system
ought to be robust even without other people doing source spoof filtering.

If I'm understanding the question (and context) correctly, I think an
Internet-connected xTR should never wholly trust a piggybacked mapping (it may
be safe in local-only applications), and_always_ send a "verifying
Map-Request" to ensure they it's not being spoofed.

The request's nonce (and LISPSEC, if that's in use) will help make sure any
mapping(s) in reply to that request are authentic.

(And if any attempt at spoofing _is_ detected, it ought to ring an alarm bell,
not just silently discard it; although of course the bell should be
temporarily disable-able.)

	Noel