Subject: [mpls] Question on draft-ietf-mpls-ip-options-03.txt

From: Olen Stokes <[email-masked]>
Date: Fri, 8 Jan 2010 14:29:23 -0800

The following specific type of IP option-based security attack is cited in Section 5.1 of the draft:

       Crafted IP strict and loose source route option packets that
       belong to a prefix-based FEC yet bypass MPLS encapsulation at a
       ingress LER may allow an attacker to specify explicit IP
       forwarding path(s) across an MPLS network and, thereby, target
       specific LSRs with any of the DoS attacks outlined above.  This
       assumes, of course, that the MPLS network is enabled to process
       IP strict and loose source route options.

What is the intended action to be taken in cases where source routing is permitted?

Cheers,
Olen

---

From: "David Smith (djsmith)" <[email-masked]>
Date: Tue, 12 Jan 2010 20:13:51 -0600

>What is the intended action to be taken in cases where source routing
is permitted?
 
If the next address in the source route (which replaces the address in
the destination address) belongs to a prefix-based FEC, the LSR/SSR
packet should be MPLS encapsulated with the associated MPLS label.
Conversely, if the next address in the source route does not belong to a
prefix-based FEC, the LSR/SSR packet should be IP source routed.
 
These behaviors are consistent with the ingress LER requirements
described in Section 4 of the draft. 
 
Regards,
 
/dave 

________________________________

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Olen Stokes
Sent: Friday, January 08, 2010 5:29 PM
To: [email-masked]'
Subject: [mpls] Question on draft-ietf-mpls-ip-options-03.txt

The following specific type of IP option-based security attack is cited
in Section 5.1 of the draft:

What is the intended action to be taken in cases where source routing is
permitted?
 
Cheers,
Olen

---

From: Olen Stokes <[email-masked]>
Date: Wed, 13 Jan 2010 06:20:56 -0800

David, thanks for the reply.  Your response matches my initial feelings and is consistent with the actions that will be required for other IP options packets.

My concern was over the part of the quoted description where it says "and, thereby, target specific LSRs with any of the DoS attacks outlined above."  A method where the packet is sent to each node in the list via LSPs still allows the possibility of DoS attacks on those nodes.  I just wanted to make sure that there was not a requirement to reduce this exposure by using a LSP to send the packet directly to the ultimate destination.  

Cheers,
Olen

-----Original Message-----
From: David Smith (djsmith) [mailto:[email-masked]] 
Sent: Tuesday, January 12, 2010 9:14 PM
To: Olen Stokes; [email-masked]
Subject: RE: [mpls] Question on draft-ietf-mpls-ip-options-03.txt

 
 
Regards,
 
/dave 

 

Cheers,
Olen

---

From: "David Smith (djsmith)" <[email-masked]>
Date: Wed, 13 Jan 2010 10:15:39 -0600

Hi Olen,

>I just wanted to make sure that there was not a requirement to reduce
this exposure by using a LSP to send the packet directly to the ultimate
destination.   

Correct, no such requirement. If source routing is required on LERs,
mitigating the risk of LSR/SSR packets against downstream LSRs requires
(i) conformance to this draft to enforce MPLS encapsulation at ingress
LERs for destination addresses associated with a prefix-based FEC and
(ii) core hiding (for example, by disabling IP->MPLS TTL propagation at
ingress LERs) so that external sources cannot learn (eg, via traceroute)
and target the IP addresses of downstream LSRs within LSR/SSR packets.
(ii) core hiding (at least for option packets) is also dependent upon
(i).

Regards,

/dave

-----Original Message-----
From: Olen Stokes [mailto:[email-masked]] 
Sent: Wednesday, January 13, 2010 9:21 AM
To: David Smith (djsmith); [email-masked]
Subject: RE: [mpls] Question on draft-ietf-mpls-ip-options-03.txt

David, thanks for the reply.  Your response matches my initial feelings
and is consistent with the actions that will be required for other IP
options packets.

My concern was over the part of the quoted description where it says
"and, thereby, target specific LSRs with any of the DoS attacks outlined
above."  A method where the packet is sent to each node in the list via
LSPs still allows the possibility of DoS attacks on those nodes.  I just
wanted to make sure that there was not a requirement to reduce this
exposure by using a LSP to send the packet directly to the ultimate
destination.  

Cheers,
Olen

-----Original Message-----
From: David Smith (djsmith) [mailto:[email-masked]]
Sent: Tuesday, January 12, 2010 9:14 PM
To: Olen Stokes; [email-masked]
Subject: RE: [mpls] Question on draft-ietf-mpls-ip-options-03.txt

 
 
Regards,
 
/dave 

 

Cheers,
Olen

---

From: Najat Nassit <[email-masked]>
Date: Wed, 13 Jan 2010 19:00:22 +0000

hello every one,

i would like ta know if you can help me to find a state of the art about the
mpls vpn (specialy security).

najat.

2010/1/13 David Smith (djsmith) <[email-masked]>

> _______________________________________________
> mpls mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mpls
>