Subject: Re: [mpls] Spencer Dawkins' No Objection on draft-ietf-mpls-self-ping-05: (with COMMENT)

From: Ronald Bonica <[email-masked]>
Date: Thu, 15 Oct 2015 21:14:49 +0000

Hi Spencer,

Thanks for your thoughtful review.

In the Security Considerations section, you will find the following text:

"LSP Self-ping messages are easily forged.  Therefore, an attacker can send the ingress LSR a forged LSP Self-ping message, causing the ingress LSR to terminate the LSP Self-ping session prematurely.  In order to mitigate these threats, implementations SHOULD NOT assign Session-ID's in a predictable manner. Furthermore, operators SHOULD filter LSP Self-ping packets at network ingress points."

The assignment of all LSP Self-ping traffic to UDP Port 8503 facilitates the above-mentioned filtering.

                                                                                             Ron

------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> I was looking at
> 
>    o  The UDP Destination Port MUST be lsp-self-ping (8503) [IANA.PORTS]
> 
> and wondering why this is a MUST. Is the answer that this mechanism works
> within an administrative domain, so you can just tell the other end what the
> port number needs to be?
> 
> 
> 
> 
> ------------------------------
>

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Thu, 15 Oct 2015 16:43:47 -0500

Hi, Ron,

On Thu, Oct 15, 2015 at 4:14 PM, Ronald Bonica <[email-masked]> wrote:

> "LSP Self-ping messages are easily forged.  Therefore, an attacker can
> send the ingress LSR a forged LSP Self-ping message, causing the ingress
> LSR to terminate the LSP Self-ping session prematurely.  In order to
> mitigate these threats, implementations SHOULD NOT assign Session-ID's in a
> predictable manner. Furthermore, operators SHOULD filter LSP Self-ping
> packets at network ingress points."
>

You were answering a different question than the one I was asking (I was
thinking of collisions on port numbers), but you provided an answer that
makes my question go away.

Good job! Were you once an AD?

;-)

Spencer

---

From: Ronald Bonica <[email-masked]>
Date: Fri, 16 Oct 2015 15:44:05 +0000

Hi Spence,

I guess you deserve a better answer ;-)

In LSP Self-ping, the ingress LSR:

-          Formats a packet addressed to itself

-          Sends the packet through the LSP under test

-          Waits for the packet to return to it

The ingress LSR is both the producer and consumer of the packet.

In an earlier version of the draft, the ingress LSR selected a UDP port from the dynamic range (49152- 65535). Implementations could pick a single port and use it all the time or pick a port for each LSP Self-ping session. However, if an implementation did this, it would be difficult to identify and filter LSP Self-ping packets at the domain edge. So, the WG decided to put all LSP Self-ping traffic on UDP port 8503, so it could be easily identified and filtered.

                                                 Ron

From: Spencer Dawkins at IETF [mailto:[email-masked]]
Sent: Thursday, October 15, 2015 5:44 PM
To: Ronald Bonica <[email-masked]>
Cc: [email-masked]; [email-masked]
Subject: Re: [mpls] Spencer Dawkins' No Objection on draft-ietf-mpls-self-ping-05: (with COMMENT)

Hi, Ron,

On Thu, Oct 15, 2015 at 4:14 PM, Ronald Bonica <[email-masked]<mailto:[email-masked]>> wrote:
Hi Spencer,

You were answering a different question than the one I was asking (I was thinking of collisions on port numbers), but you provided an answer that makes my question go away.

;-)

Spencer

                                                                                             Ron

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Fri, 16 Oct 2015 11:12:45 -0500

Hi, Ron,

On Fri, Oct 16, 2015 at 10:44 AM, Ronald Bonica <[email-masked]> wrote:

> In an earlier version of the draft, the ingress LSR selected a UDP port
> from the dynamic range (49152- 65535). Implementations could pick a single
> port and use it all the time or pick a port for each LSP Self-ping session.
> However, if an implementation did this, it would be difficult to identify
> and filter LSP Self-ping packets at the domain edge. So, the WG decided to
> put all LSP Self-ping traffic on UDP port 8503, so it could be easily
> identified and filtered.
>
>
>
>                                                  Ron
>

I was reading your first answer that way, but I didn't have the history
that the WG had considered this in detail, and appreciate you providing
that pointer.

Thanks,

Spencer