Re: [MBONED] Eric Rescorla's Discuss on draft-ietf-mboned-mtrace-v2-22: (with DISCUSS and COMMENT)

Eric Rescorla <> Mon, 09 July 2018 12:37 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 104CC130FBB for <>; Mon, 9 Jul 2018 05:37:18 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -0.008
X-Spam-Status: No, score=-0.008 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, NORMAL_HTTP_TO_IP=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id L23I_mbakhzl for <>; Mon, 9 Jul 2018 05:37:14 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:4002:c05::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 02767130FC7 for <>; Mon, 9 Jul 2018 05:37:14 -0700 (PDT)
Received: by with SMTP id p129-v6so6464237ywg.7 for <>; Mon, 09 Jul 2018 05:37:13 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=8wK1SRVltqMU4GVFxX7aEUrsg/cJSLnys4cSs8a+G+g=; b=G2oIsGhl3fpMk/9yjvJyYU1zmThrdAVmh/S0AsYsCEHhn1XTGH9EaaPvQcLWJWwB+g b2maoz+BZC2lXtAcysg4PlsTJfxAn5UxEtV76zQYJr26IqWdM+cQ6nyF0weyS5brKLx2 nj2uJ8DR1nRVdZUEA41I2rHaaY5cpJyjbluDtY8YJ5pSXfVNYJIF65ad9sVtB3NOScwn MYjUWyPTcQQND6hkpnx+DU1UHSkW/rEY0Qd606Tvn2GZwaVE/L9ZpmcF+Oh1FcsW4gh8 Vllw5kXwJ6a4w8KD4mZlySgyw8ymMmGuXMNhrDqQPKEXgxKYRTWuhc/yGu7U+79TIp0S dsVw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=8wK1SRVltqMU4GVFxX7aEUrsg/cJSLnys4cSs8a+G+g=; b=N/QDm/7LTNnb40zc+10PE2esp1YQRtMfLT7PgH0YVgkZZLS37GIwpTbt+G7oTknY+L xeh7urINDb6MILcAJzKQdBfkPmnkdFk+4QlhszL1dwk4ye/fFiSevNicrQiagK+GWbLY GfIKPLn+LnEqhYpIwTzU8+QywicdRAdMYSqmsCfbziCojrLnbZSBgIAoZsRjiu6iKpPL TMXTrvZyehvbTaMIdb+0KdBPPMognBRG9rLgPZAp3hL7SglMqm2K5Qrt1sK3cU9IiLt0 rm3RBzbeOtqnkBbvolJ/vrNDvX5MaRuEW+yGc+TZ2abrukKiHoBSxcOEnLhN5VAkx7vJ FE7Q==
X-Gm-Message-State: APt69E3+Yy155JzPXy8Dgema5LYU6/8YVipncfuNRLSBZUKGoEabKaib UV+SdGmndBWHPz8na9O+BzqhTu/DFEr4LpmStZ1EUA==
X-Google-Smtp-Source: AAOMgpdP1n65CGw9BS7KA6ICSTdVG5Y8c4AkxmAfuSgP+AUXbqZ1pYRzghoYQ3vxkBgIBDD+Bm2/g1V8TOPV2p1g28s=
X-Received: by 2002:a81:b642:: with SMTP id h2-v6mr9940501ywk.102.1531139833007; Mon, 09 Jul 2018 05:37:13 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a81:6b83:0:0:0:0:0 with HTTP; Mon, 9 Jul 2018 05:36:32 -0700 (PDT)
In-Reply-To: <>
References: <> <> <> <>
From: Eric Rescorla <>
Date: Mon, 9 Jul 2018 05:36:32 -0700
Message-ID: <>
To: Hitoshi Asaeda <>
Cc: Kerry Meyer <>,, The IESG <>, MBONED WG <>,
Content-Type: multipart/alternative; boundary="000000000000d92e1c0570904524"
Archived-At: <>
Subject: Re: [MBONED] Eric Rescorla's Discuss on draft-ietf-mboned-mtrace-v2-22: (with DISCUSS and COMMENT)
X-Mailman-Version: 2.1.27
Precedence: list
List-Id: Mail List for the Mboned Working Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 09 Jul 2018 12:37:19 -0000

On Mon, Jul 9, 2018 at 12:51 AM, Hitoshi Asaeda <> wrote:

> Eric,
> (snip)
> >> Section 4.2.1, however (see below), prohibits processing of a Request
> that is not sent from an adjacent router. Also, it is worth considering
> that this problem hypothesis supposes that a DoS attack is launched from a
> trusted router address. Even for this scenario, however, the document does
> provide protection. The normative descriptions to which the quote above
> refers are:
> >>
> >> -  The previous paragraph from section 9.2 (requirement for use of
> ACLs; slightly reworded later in this email to the new proposed text):
> >>
> >> ----------
> >>   A router MUST support an access control list (ACL) mechanism to
> >>   filter out Queries from clients and Requests from peer router
> >>   addresses that are unauthorized or that are beyond a specified
> >>   administrative boundary.  This filtering could, for example, be
> >>   specified via a list of allowed/disallowed client and peer addresses
> >>   or subnets for the Mtrace2 protocol port.  If a Query or Request is
> >>   received from an unauthorized address or one beyond the specified
> >>   administrative boundary, the Query/Request MUST NOT be processed.
> >>   The router MAY, however, perform rate limited logging of such events.
> >> ----------
> >>
> >> and
> >>
> >>  - Section 4.2.1 (required validity checks to force rejection of a
> Request message from a source that is not an adjacent router):
> >>
> >> ----------
> >> 4.2.1.  Request Packet Verification
> >>
> >>   If the Mtrace2 Request does not come from an adjacent router, or if
> >>   the Request is not addressed to this router, or if the Request is
> >>     addressed to a multicast group which is not a link-scoped group
> >>   (i.e., for IPv4, FFx2::/16 [3] for IPv6), it MUST be
> >>   silently ignored.  The Generalized TTL Security Mechanism (GTSM) [14]
> >>   SHOULD be used by the router to determine whether the router is
> >>   adjacent or not.
> >> ----------
> >
> > Unless I'm missing something, this just restricts things to a *node*
> which is adjacent. But if I'm a device that's on the same LAN as a router
> (which isn't a crazy proposition, ISTM), then why can't I mount this attack?
> Only an adjacent *multicast router* can send requests, because a request
> is transformed from a query initiated by a downstream node/device and
> forwarded toward the source/RP

But the difference between a request and a response is just some bits in
the packet. And so what stops some other host on the LAN from sending
something that claims to be a request.

> In your example, you are a valid *user (or device)* and send Request, and
> can attack someone. But in our definition, you cannot send any Requests
> because you are not a valid *multicast router*.

Yes, but that needs to be technically enforced, not just stated.

The problem you may think here is that the ACLs in general do not validate
> the Request is traversed from valid (or invalid) routers as the message
> types cannot be specified in ACLs, right?
> If we define a *particular* ACL entry to specify accepted/non-accepted IP
> addresses (or ranges) or admin boundaries for each of three mtrace message
> types, Query/Request/Reply, will your concern be disappeared?

I think so, if you require its use.

> To protect against spoofing of Request packet, as Kerry said,
> > > NOTE:  To protect against spoofing of Request packets by a trusted
> host, some authentication mechanism such as use of an Authentication Header
> (AH) between routing peers should be also considered. However, discussion
> of such external authentication mechanisms is out of the scope of this
> document.
> Also, router validation is in general defined in the routing protocol
> specifications and routers can run the authentication mechanisms. We do not
> provide an mtrace unique/specific authentication mechanism for routers in
> this document. But as the example, we can describe the PIM case to verify
> adjacent PIM neighbor routers, if it's helpful.

I don't follow this.

> Given that we're a week from Montreal, it might be easier to just try to
> meet there. What say you?
> Although Kerry may not, I'll be there.
> I asked a slot to report the current situation in the Mboned WG meeting.
> Please come to the meeting.

I have to be at RTCWEB.

But before the f2f discussions or the meeting, I need to understand and
> clarify problems you have been thinking.

The point of the F2F discussion is to clarify the issue.


> Regards,
> Hitoshi
> (snip a lot)