Re: WG LC: draft-ietf-l3vpn-2547bis-mcast-bgp

[Marshall Eubanks <[e-mail]>]

On Dec 14, 2008, at 8:59 PM, NAPIERALA, MARIA H, ATTLABS wrote:

> Hi Marshall,
>
>> Might there be situations where receivers want to set up a multicast
>> route for
>> source regardless of whether the source is currently active, to  
>> reduce
>> the time for source data to propagate ? So in that case this would be
>> legitimate.
>>
>> Otherwise, joins to sources that are not active will generally stop.
>> Or are you worried about
>> DOS attacks ?
>>
>
> Yes, I think that triggering Source Active A-D routes when receiving
> (S,G) Joins without the knowledge that S is actually "active"  
> creates a
> security issue.  A single end-user PC can generate a lot of spurious
> IGMP (S,G) joins that could trigger lots of BGP updates and  
> potentially
> useless S-PMSIs in VPN core.
>

This is of course true for normal (non L3VPN) multicasts, and has  
largely been dealt with
by a combination of filtering and rate limiting - see, e.g.,

http://www.juniper.net/solutions/literature/app_note/350051.pdf

I would think that the VPN situation would be even easier to control  
(it should be easier to
determine what is and isn't authorized, for example).

Are you saying that you have seen these kinds of DOS attacks in  
practice, or are
you just worried about the principle ?

Wearing no hats of any kind;
Marshall


> Maria
>
>> -----Original Message-----
>> From: Marshall Eubanks [mailto:[e-mail]]
>> Sent: Sunday, December 14, 2008 8:33 AM
>> To: NAPIERALA, MARIA H, ATTLABS
>> Cc: Danny McPherson; [e-mail]
>> Subject: Re: WG LC: draft-ietf-l3vpn-2547bis-mcast-bgp
>>
>> Dear Maria;
>>
>> On Dec 12, 2008, at 4:17 PM, NAPIERALA, MARIA H, ATTLABS wrote:
>>
>>> PIM-SM/RFC 4601 permits, quote, "a receiver to join a group and
>>> specify
>>> that it only wants to receive traffic for a group if that traffic
>>> comes
>>> from a particular source. If a receiver does this, and no other
>>> receiver
>>> on the LAN requires all the traffic for the group, then the DR may
>>> omit
>>> performing a (*,G) join to set up the shared tree, and instead issue
>> a
>>> source-specific (S,G) join only."
>>>
>>> Such behavior of end systems in PIM-SM means that a PE can receive
>>> Join
>>> (C-S, C-G) even for sources that are not active.
>>>
>>> Section 13.1 of draft-ietf-l3vpn-2547bis-mcast-bgp-05 requires that
>>> "whenever a PE creates an <C-S,C-G> state as a result of receiving a
>>> Source Tree Join C-multicast route for <C-S, C-G> from some other
> PE,
>>> the PE that creates the state MUST originate a Source Active A-D
>>> route."
>>>
>>> The procedure as described in section 13.1 might lead to useless S-
>>> PMSI
>>> creation for C-sources operating in sparse groups which are not
>>> active.
>>> This procedure should be enhanced to prevent triggering of S-PMSIs
> in
>>> such cases.
>>
>> Might there be situations where receivers want to set up a multicast
>> route for
>> source regardless of whether the source is currently active, to  
>> reduce
>> the time for source data to propagate ? So in that case this would be
>> legitimate.
>>
>> Otherwise, joins to sources that are not active will generally stop.
>> Or are you worried about
>> DOS attacks ?
>>
>> Regards
>> Marshall
>>
>>>
>>>
>>> Maria
>>>
>>>> -----Original Message-----
>>>> From: [e-mail] [mailto:[e-mail]] On
>>>> Behalf
>>>> Of Danny McPherson
>>>> Sent: Friday, November 21, 2008 8:52 AM
>>>> To: [e-mail]
>>>> Subject: WG LC: draft-ietf-l3vpn-2547bis-mcast-bgp
>>>>
>>>>
>>>> Please consider today the start of a 2-week last call
>>>> for draft-ietf-l3vpn-2547bis-mcast-bgp, available here:
>>>>
>>>> http://tools.ietf.org/html/draft-ietf-l3vpn-2547bis-mcast-bgp-05
>>>>
>>>> Input on this draft's suitability for publication as an
>>>> Internet Standards Track document is solicited, feedback
>>>> ends December 9, 2008.
>>>>
>>>> Thanks in advance for your feedback!
>>>>
>>>> Danny & Marshall
>