Re: [manet] Stephen Farrell's No Objection on draft-ietf-manet-dlep-26: (with COMMENT)

[Rick Taylor <[e-mail]>]

Hi Stephen,

Thanks for the comments, some answers inline...

On Thu, 2016-12-15 at 06:39 -0800, Stephen Farrell wrote:
> Stephen Farrell has entered the following ballot position for
> draft-ietf-manet-dlep-26: No Objection
> 
> - 5.1: Is a modem supposed to ignore peer discovery
> signals from routers with which the modem does not have a
> TCP connection?

Peer Discovery is a UDP-based mechanism that is designed to run before
a TCP-based session is established, much like UPnP or mDNS.

> 
> - 10.7: This says: "If the modem is capable of
> understanding and forwarding this information (via
> mechanisms not defined by DLEP)," I don't get why that's
> here, can you explain? If modem-modem comms is part of
> DLEP deployments (even if not fully spec'd) then that does
> change the security model.

DLEP only defines the conversation between a local router/modem pair.
 How or what a modem sends over the air to another modem is
intentionally out of scope.

> 
> - 10.9 and elsewhere: none of these messages have anything
> like a cookie. Why not? That'd help mitigate potential off
> path attacks, where we currently depend solely on TTL=255
> (and TLS, which seems to not be some people's favourite;-)

To be frank - we never considered a cookie as a security mechanism.
 Personally I considered an attacker capable of successfully injecting
octets into an existing TCP stream would probably be able to hijack a
cookie mechanism.

However, I am not a security expert, and if this is a viable
alternative to TLS (which is unpopular with implementers, and has open
questions over certification) then it is definitely something that
should be considered.

> 
> - 11.8/9: are there any special addresses that MUST NOT
> occur here? E.g. ::1, 127.0.0.10? What about the addresses
> IANA allocates for you from 13.14/15?

From a DLEP perspective, no destination address or subnet is
prohibitted.  Obviously a user can configure their network stupidly and
then it wont work, but from a functional perspective, DLEP doesn't
care.  And it doesn't add any further restriction on addresses beyond
the regular IPv4/6 rules.

> 
> - 11.10/11: what does prefix=0 mean?

Prefix 0 was left in to allow announcement of a default route.

> 
> - I agree with Alexey's DISCUSS#3, the TLS stuff needs
> more work to be usable. Maybe recommend PSK?

None of the authors are self-confessed security experts, and we do need
advice here.

Thanks,

Rick