Re: [Idr] Kathleen Moriarty's No Objection on draft-ietf-idr-add-paths-14: (with COMMENT)

["John G. Scudder" <[e-mail]>]

Hi Kathleen,

On May 11, 2016, at 10:29 AM, Kathleen Moriarty <[e-mail]> wrote:
> On Wed, May 11, 2016 at 10:32 AM, Jeffrey Haas <[e-mail]> wrote:
>> Kathleen,
>> 
>> On Mon, May 02, 2016 at 10:58:01AM -0700, Kathleen Moriarty wrote:
>>> 1. I'd like to see the security considerations explicitly state that this
>>> could result in a denial of service attack.  The resource consumption is
>>> stated nicely, but it would be good (following RFC3552) to state the type
>>> of attack.
>>> 
>>>  "This document defines a BGP extension that allows the advertisement
>>>   of multiple paths for the same address prefix without the new paths
>>>   implicitly replacing any previous ones.  As a result, multiple paths
>>>   for a large number of prefixes may be received by a BGP speaker
>>>   potentially depleting memory resources or even causing network-wide
>>>   instability."
>>> 
>>> Adding something like: "This could result in a denial of service
>>> attack."
>> 
>> The considerations of a BGP peer's normal protocol interactions with a BGP
>> speaker - with or without add-paths - being considered a Denial of Service
>> seems to be unnecessary scare words.
>> 
>> While the add-paths case does permit a much larger number of paths to be
>> propagated, the same issue may apply to simply sending along a much larger
>> amount of some routing table than expected.  This could include sending a
>> full Internet routing table to a router scaled for a few thousands of
>> routes.
>> 
>> I recommend against this change.
> 
> This is just a comment, so it's up to the shepherd and AD, but adding
> this would be in line with the guidance from RFC3552.
> 
> https://tools.ietf.org/html/rfc3552

Looking at RFC 3552 S. 2.3.3 ("Denial of Service") it does suggest that DoS be considered and identified when relevant. I think Jeff's point (which I agree with) is that add-path doesn't change the fundamentals of BGP with respect to DoS -- the peer can send me a bazillion routes, differentiating them by prefix, or by path-id, or both. It just comes down to which bits in the NLRI are used to make the routes unique.

Anyway, point taken that we should think about this more before making any definite conclusion, and if add-path does create any new DoS vulnerability we should identify it.

Regards,

--John