Re: [Detnet] Magnus Westerlund's Discuss on draft-ietf-detnet-mpls-12: (with DISCUSS)

[Stewart Bryant <[e-mail]>]

> On 14 Sep 2020, at 07:33, Magnus Westerlund <[e-mail]> wrote:
> 
> Hi,
> 
> On Fri, 2020-09-11 at 19:44 -0700, Benjamin Kaduk wrote:
>> Hi Stewart, Magnus,
>> 
>> On Thu, Sep 10, 2020 at 02:37:41PM +0100, Stewart Bryant wrote:
>>> 
>>> 
>>>> On 10 Sep 2020, at 14:23, Magnus Westerlund via Datatracker <
>>>> [e-mail]> wrote:
>>>> 
>>>> D. Denial of service risk with attacker modifying sequence number or
>>>> performing
>>>> packet injection between ingress and egrees.
>>>> 
>>>> Based on what is written in C I would also note that there exist a serious
>>>> Denial of Service attack on the Detnet flow.
>>>> 
>>>> If the attacker is capable of either periodically modify the sequence
>>>> number of
>>>> an MPLS packet for a particular S-label or inject a MPLS packet into the
>>>> system
>>>> that will traverse to the S-Labels PEF or POF at egress with a crafted
>>>> sequence
>>>> number. In either of these cases the attacker can advance the acceptance
>>>> window
>>>> periodically so that the actual traffic falls into the range that is
>>>> discarded
>>>> by the PEF and POF. Thus, cheaply accomplishing a total denial of service.
>>>> 
>>>> I think this risk due to the PEF and POF should be made explicit in the
>>>> security considerations. Mitigations needs to be in place to prevent
>>>> packet
>>>> modification or injection inside the MPLS network. Some of these appears
>>>> to be
>>>> already discussed.
>>> 
>>> Where the s/n is provided outside the MPLS domain, the security issues are
>>> by definition outside the scope of this text.
>>> 
>>> Once inside the MPLS domain the normal MPLS security rules and constrains
>>> apply. An attacker inside the MPLS domain can do many things to harm the
>>> network, of which this is just one. MPLS operators know that they need to
>>> secure their network dataplanes and control planes, but but they also know
>>> that no packet gets to enter their network without their explicit
>>> permission.
>>> 
>>> There is the potential for similar threats to pseudo wires, (interference
>>> with in flight packets) but no such issue has ever been reported to the
>>> PWE3/PALS WGs.
>>> 
>>> So I think that this is at best one of many theoretical attacks that could
>>> occur, but is unlikely to ever materialise in a practical network.
>> 
>> I agree -- an attacker that could inject a sequence number would have to be
>> able to control the contents of one or more labels, which would cause much
>> bigger problems than DoS by trashing the sequence-number window.  It's
>> pretty inherent in how MPLS works that everything is tightly orchestrated
>> and locked-down at the boundary, so this seems basically theoretical.
>> 
> 
> Okay, so your view that this is so theoretical that it doesn't even need to be
> mentioned? 
> 
> Cheers
> 
> Magnus Westerlund 
> 


I think the standard precautions used to protect an MPLS network would prevent this attack, and so it serves no purpose to highlight the issue in the RFC.

Stewart