Re: [Detnet] Magnus Westerlund's Discuss on draft-ietf-detnet-mpls-12: (with DISCUSS)

[Benjamin Kaduk <[e-mail]>]

Hi Stewart, Magnus,

On Thu, Sep 10, 2020 at 02:37:41PM +0100, Stewart Bryant wrote:
> 
> 
> > On 10 Sep 2020, at 14:23, Magnus Westerlund via Datatracker <[e-mail]> wrote:
> > 
> > D. Denial of service risk with attacker modifying sequence number or performing
> > packet injection between ingress and egrees.
> > 
> > Based on what is written in C I would also note that there exist a serious
> > Denial of Service attack on the Detnet flow.
> > 
> > If the attacker is capable of either periodically modify the sequence number of
> > an MPLS packet for a particular S-label or inject a MPLS packet into the system
> > that will traverse to the S-Labels PEF or POF at egress with a crafted sequence
> > number. In either of these cases the attacker can advance the acceptance window
> > periodically so that the actual traffic falls into the range that is discarded
> > by the PEF and POF. Thus, cheaply accomplishing a total denial of service.
> > 
> > I think this risk due to the PEF and POF should be made explicit in the
> > security considerations. Mitigations needs to be in place to prevent packet
> > modification or injection inside the MPLS network. Some of these appears to be
> > already discussed.
> 
> Where the s/n is provided outside the MPLS domain, the security issues are by definition outside the scope of this text.
> 
> Once inside the MPLS domain the normal MPLS security rules and constrains apply. An attacker inside the MPLS domain can do many things to harm the network, of which this is just one. MPLS operators know that they need to secure their network dataplanes and control planes, but but they also know that no packet gets to enter their network without their explicit permission.
> 
> There is the potential for similar threats to pseudo wires, (interference with in flight packets) but no such issue has ever been reported to the PWE3/PALS WGs.
> 
> So I think that this is at best one of many theoretical attacks that could occur, but is unlikely to ever materialise in a practical network.

I agree -- an attacker that could inject a sequence number would have to be
able to control the contents of one or more labels, which would cause much
bigger problems than DoS by trashing the sequence-number window.  It's
pretty inherent in how MPLS works that everything is tightly orchestrated
and locked-down at the boundary, so this seems basically theoretical.

-Ben