Re: [Idr] Review of draft-ietf-idr-error-handling-18

["Alvaro Retana (aretana)" <[e-mail]>]

On 3/13/15, 8:40 AM, "Jeffrey Haas" <[e-mail]> wrote:

Jeff:

Hi!

>On Mon, Mar 09, 2015 at 05:45:13PM +0000, Alvaro Retana (aretana) wrote:
>>   5.  Security Considerations (Section 10).  It is true that malformed
>>optional transitive attributes should not cause remote session resets.
>>Are remote withdrawals a new threat?  Following the logic in the
>>introduction, an update with a malformed optional transitive attribute
>>may not be properly checked for several hops..but once the error is
>>detected then the NLRI may use Treat-as-withdraw..  Assuming an AS-level
>>granularity in checking, this won?t cause loops or major disruptions,
>>but nonetheless it can result in not everyone receiving the information
>>it should..
>
>I'm not sure one can really stretch this point to be an attack vector.
>Normal BGP operational policy permits an operator to advertise or not a
>given prefix.  If an upstream injects malformed information and some
>subset
>of routers are capable of announcing it and others are not the issue
>remains
>that the upstream reachability is invalid.

The inability to advertise (or receive) a prefix because of malformed
information is not normal BGP operational policy. That¹s all I¹m pointing
to: the local ability to advertise/receive is dictated by someone else
(the upstream)..which may result in a different transit or just simply not
having reachability what should be present.  As I mentioned in another
e-mail, not all prefixes are made the same.

Yes, I realize that all this depends on that upstream (I would even call
it an attacker) knowing what will happen potentially several hops
downstream..  The odds are obviously reduced as sw is hardened, people
implement this document, etc.

Thanks!

Alvaro.