Subject: Re: [mpls] [MPLS] HELP: Need your opinion on LDP security

From: "Rajiv Asati (rajiva)" <[email-masked]>
Date: Tue, 2 Nov 2010 07:02:56 -0500

Hi Mach,

> In addition, in case of LDP is not enabled on the edge devices, even if the
> LDP implementation can do source address and UDP port check, then the
> spoofing hellos will not be blocked at the edge devices by LDP, unless you

If LDP is not enabled on an interface, then link hello must not be accepted on that interface. Otherwise, it is a violation of RFC 5036 section 3.5.2.1.

It is orthogonal to whether the hellos are spoofed or not.

Cheers,
Rajiv

> -----Original Message-----
> From: Mach Chen [mailto:[email-masked]]
> Sent: Friday, October 29, 2010 9:49 PM
> To: Rajiv Asati (rajiva); Ronald Bonica; Vishwas Manral
> Cc: [email-masked]; Lamberto Sterling
> Subject: Re: [mpls] [MPLS] HELP: Need your opinion on LDP security
> 
> Hi Rajiv,
> 
> Thanks for your prompt response!
> 
> Please see inline...
> --------------------------------------------------
> From: "Rajiv Asati (rajiva)" <[email-masked]>
> Sent: Friday, October 29, 2010 9:44 PM
> To: "Mach Chen" <[email-masked]>; "Ronald Bonica" <[email-masked]>;
> "Vishwas Manral" <[email-masked]>
> Cc: <[email-masked]>; "Lamberto Sterling" <[email-masked]>
> Subject: RE: [mpls] [MPLS] HELP: Need your opinion on LDP security
> 
> > Hi Mach,
> >
> > Pls see inline,
> >
> >> > As far as network boundary/edge is concerned, if LDP is not enabled on
> >> > the
> >> > outside interfaces, then the implementation should allow any LDP packet
> >> > (IP packet with UDP/TCP port=646) to be ignored. This should not
> >> > require
> >> > any filtering.
> >> >
> >> Not all the implmentations will do such check and drop the LDP packets
> >> (Target hello) , and I know there are at least two implmentations do not
> >> do
> >> this.
> >
> > Aah!! Such an implementation would be susceptible to a bigger DoS attack,
> > IMO.
> >
> > It is a bad idea to accept and process a packet on a port/socket whose
> > protocol is not enabled yet.
> >
> > In fact, that's a violation of RFC 5036 section 3.5.2.1
> >
> > <excerpt>
> >      A Link Hello is acceptable if the interface on which it was
> >      received has been configured for label switching.
> >
> >      A Targeted Hello from source address A is acceptable if either:
> >
> >      -  The LSR has been configured to accept Targeted Hellos, or
> >      -  The LSR has been configured to send Targeted Hellos to A.
> > </excerpt>
> 
> Recently, we did experiments in lab and found that the result of most of the
> major implmentations are alike on this. Actually, this does not violate the
> rules for Targeted Hello as you excerpted. If an LSR has established a
> Target session with A, it should have been configured to accept/send
> Targeted Hellos from/to A, and a spoofing Hello can easily to be made up as
> if sending from A.
> 
> >
> >
> >
> >> In addition, in case of LDP is enabled on the outside interfaces, then
> >> you
> >> can't lie on such mechanism.
> >
> > Ditto. If LDP is enabled (for things such as Inter-AS), then the problem
> > may happen.
> 
> Yes, this one of the scenarios that the draft tries to solve.
> 
> In addition, in case of LDP is not enabled on the edge devices, even if the
> LDP implementation can do source address and UDP port check, then the
> spoofing hellos will not be blocked at the edge devices by LDP, unless you
> configure the other necessay filtering rules on the edges.
> 	
> Best regards,
> Mach

---

From: "Rajiv Asati (rajiva)" <[email-masked]>
Date: Tue, 2 Nov 2010 07:06:56 -0500

Vero,
       
Ilya's point is that the man-in-the-middle attack device can simply drop
the 3 hellos (instead of having to change the content of the packet) to
force the session to go down. Hello authentication doesn't provide any
protection.

Cheers,
Rajiv

> From: [email-masked] [mailto:[email-masked]] On Behalf
Of Vero Zheng
> Sent: Friday, October 29, 2010 10:11 PM
> To: iLya
> Cc: [email-masked]
> Hi iLya,
> Thanks for your comment.
> If there is no hello authentication, an established LDP session can be
tore down by a spoofing
> Hello with a smaller Hold Time interval or different Transpot Address.
This is the problem our
> mechanism try to solve. If we didnt make this clear in the draft, we
will clarify it in the
> later version.
> BR,
> Vero
> From: "iLya" <[email-masked]>
> Sent: Friday, October 29, 2010 10:10 PM
> To: "Rajiv Asati (rajiva)" <[email-masked]>; "Mach Chen"
<[email-masked]>; "Ronald Bonica"
> <[email-masked]>; "Vishwas Manral" <[email-masked]>
> > Sent: Friday, October 29, 2010 3:44 PM
> >>> And that the 'Configuration Sequence Number' TLV is an optional
TLV.
> >>
> >> Optional should not be an issue. Most security related options are
> >> optional. :) Even the proposed 'Cryptographic Authentication TLV'
is
> >> optional. :)
> >>
> >
> > In my opinion if Man-in-the-middle is determined to break some
session down
> > nothing will stop this - they can simply drop hello packets and that
will
> > suffice. So Hello Auth and sequence numbers won't provide usable
protection,
> > only false sence of security.
> >
> > Kind regards,
> > iLya
> >
> >
> > _______________________________________________
> > mpls mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/mpls
> _______________________________________________
> mpls mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mpls