Re: [Detnet] Magnus Westerlund's Discuss on draft-ietf-detnet-mpls-12: (with DISCUSS)

[Magnus Westerlund <[e-mail]>]

Hi,

On Fri, 2020-09-11 at 19:44 -0700, Benjamin Kaduk wrote:
> Hi Stewart, Magnus,
> 
> On Thu, Sep 10, 2020 at 02:37:41PM +0100, Stewart Bryant wrote:
> > 
> > 
> > > On 10 Sep 2020, at 14:23, Magnus Westerlund via Datatracker <
> > > [e-mail]> wrote:
> > > 
> > > D. Denial of service risk with attacker modifying sequence number or
> > > performing
> > > packet injection between ingress and egrees.
> > > 
> > > Based on what is written in C I would also note that there exist a serious
> > > Denial of Service attack on the Detnet flow.
> > > 
> > > If the attacker is capable of either periodically modify the sequence
> > > number of
> > > an MPLS packet for a particular S-label or inject a MPLS packet into the
> > > system
> > > that will traverse to the S-Labels PEF or POF at egress with a crafted
> > > sequence
> > > number. In either of these cases the attacker can advance the acceptance
> > > window
> > > periodically so that the actual traffic falls into the range that is
> > > discarded
> > > by the PEF and POF. Thus, cheaply accomplishing a total denial of service.
> > > 
> > > I think this risk due to the PEF and POF should be made explicit in the
> > > security considerations. Mitigations needs to be in place to prevent
> > > packet
> > > modification or injection inside the MPLS network. Some of these appears
> > > to be
> > > already discussed.
> > 
> > Where the s/n is provided outside the MPLS domain, the security issues are
> > by definition outside the scope of this text.
> > 
> > Once inside the MPLS domain the normal MPLS security rules and constrains
> > apply. An attacker inside the MPLS domain can do many things to harm the
> > network, of which this is just one. MPLS operators know that they need to
> > secure their network dataplanes and control planes, but but they also know
> > that no packet gets to enter their network without their explicit
> > permission.
> > 
> > There is the potential for similar threats to pseudo wires, (interference
> > with in flight packets) but no such issue has ever been reported to the
> > PWE3/PALS WGs.
> > 
> > So I think that this is at best one of many theoretical attacks that could
> > occur, but is unlikely to ever materialise in a practical network.
> 
> I agree -- an attacker that could inject a sequence number would have to be
> able to control the contents of one or more labels, which would cause much
> bigger problems than DoS by trashing the sequence-number window.  It's
> pretty inherent in how MPLS works that everything is tightly orchestrated
> and locked-down at the boundary, so this seems basically theoretical.
> 

Okay, so your view that this is so theoretical that it doesn't even need to be
mentioned? 
 
Cheers

Magnus Westerlund 


----------------------------------------------------------------------
Networks, Ericsson Research
----------------------------------------------------------------------
Ericsson AB                 | Phone  [phone]
Torshamnsgatan 23           | Mobile [phone]
SE-164 80 Stockholm, Sweden | mailto: [e-mail]
----------------------------------------------------------------------