Re: [Idr] Kathleen Moriarty's No Objection on draft-ietf-idr-add-paths-14: (with COMMENT)

[Kathleen Moriarty <[e-mail]>]

On Thu, May 12, 2016 at 12:08 PM, John G. Scudder <[e-mail]> wrote:
> Hi Kathleen,
>
> On May 11, 2016, at 10:29 AM, Kathleen Moriarty <[e-mail]> wrote:
>> On Wed, May 11, 2016 at 10:32 AM, Jeffrey Haas <[e-mail]> wrote:
>>> Kathleen,
>>>
>>> On Mon, May 02, 2016 at 10:58:01AM -0700, Kathleen Moriarty wrote:
>>>> 1. I'd like to see the security considerations explicitly state that this
>>>> could result in a denial of service attack.  The resource consumption is
>>>> stated nicely, but it would be good (following RFC3552) to state the type
>>>> of attack.
>>>>
>>>>  "This document defines a BGP extension that allows the advertisement
>>>>   of multiple paths for the same address prefix without the new paths
>>>>   implicitly replacing any previous ones.  As a result, multiple paths
>>>>   for a large number of prefixes may be received by a BGP speaker
>>>>   potentially depleting memory resources or even causing network-wide
>>>>   instability."
>>>>
>>>> Adding something like: "This could result in a denial of service
>>>> attack."
>>>
>>> The considerations of a BGP peer's normal protocol interactions with a BGP
>>> speaker - with or without add-paths - being considered a Denial of Service
>>> seems to be unnecessary scare words.
>>>
>>> While the add-paths case does permit a much larger number of paths to be
>>> propagated, the same issue may apply to simply sending along a much larger
>>> amount of some routing table than expected.  This could include sending a
>>> full Internet routing table to a router scaled for a few thousands of
>>> routes.
>>>
>>> I recommend against this change.
>>
>> This is just a comment, so it's up to the shepherd and AD, but adding
>> this would be in line with the guidance from RFC3552.
>>
>> https://tools.ietf.org/html/rfc3552
>
> Looking at RFC 3552 S. 2.3.3 ("Denial of Service") it does suggest that DoS be considered and identified when relevant. I think Jeff's point (which I agree with) is that add-path doesn't change the fundamentals of BGP with respect to DoS -- the peer can send me a bazillion routes, differentiating them by prefix, or by path-id, or both. It just comes down to which bits in the NLRI are used to make the routes unique.
>
> Anyway, point taken that we should think about this more before making any definite conclusion, and if add-path does create any new DoS vulnerability we should identify it.

Thanks, John!

>
> Regards,
>
> --John



-- 

Best regards,
Kathleen