Subject: Re: (ngtrans) Re: I-D ACTION:draft-ietf-ngtrans-bgp-tunnel-04.txt

From: [email-masked]
Date: Tue, 12 Feb 2002 16:03:34 +0100

Pekka Savola wrote:
> 
> On Tue, 12 Feb 2002 [email-masked] wrote:
> > > 8. Security considerations
> > >
> > >    This proposal can use the security features of BGP and any policy
> > >    defined in the ISP domain.
> > >
> > > ==> rather weak.  E.g. using IPv4 encapsulation will most probably subject
> > > the router to all autotunnel considerations.
> >
> > Would a reference to the security section of rfc2893 accomodate your
> > concern?
> 
> Not really, as autotunnel has been proven very broken from the security
> point of view and RFC2893 discussion is lacking.
> 
> > Additionally I will add a paragraph on when to discard
> > IP/GRE-encapsulated packets, something like:
> >
> > If an IP/GRE-encapsulated packet arrives with SA4 as IPv4 source address
> > in the outer header and DA6 as destination address in the inner header,
> > the IPv4-mapped IPv6 address of the BGP next-hop for DA6 in the BGP
> > table MUST match SA4.  If not, the packet MUST be discarded.
> 
> Did you mean DA6, not SA6 I suppose?

Sorry, seems that I'm not completely awake: DA6 should indeed be SA6:
If an IP/GRE-encapsulated packet arrives with SA4 as IPv4 source address
in the outer header and SA6 as source address in the inner header, the
IPv4-mapped IPv6 address of the BGP next-hop for SA6 in the BGP table
MUST match SA4.  If not, the packet MUST be discarded.

Alternatively the above could be positioned as a potential security
mechanism (as is done in rfc3056 for 6to4 decapsulation).

> 
> Did I understand correctly that you're forcing "RPF-like" properties here,
> often hazardous in the case of asymmetric routing or e.g. one-way route
> reflectors?

The underlying assumption is that inbound and outbound traffic use the
same PE.

> 
> If possible, it's better to match that SA4 matches SA6 and DA4 matches
> DA6.. but if multihop scenarios have to be supported also this might not
> work?

I don't understand why it wouldn't work for multi-hop.  Could you
elaborate?

dirk

> 
> --
> Pekka Savola                 "Tell me of difficulties surmounted,
> Netcore Oy                   not those you stumble over and fall"
> Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

-- 
Dirk Ooms                       mailto:[email-masked]
                                tel:+32 3 2404732
Network Strategy Group (NSG)    http://aww.alcatel.com/nsg
Alcatel                         http://www.alcatel.com

---

From: Pekka Savola <[email-masked]>
Date: Wed, 13 Feb 2002 10:48:25 +0200 (EET)

> I don't understand why it wouldn't work for multi-hop.  Could you

I meant scenarios where you wouldn't use direct PE to PE tunneling.  
This is out of scope, I beleive?