[OPSEC] [Errata Verified] RFC6192 (4851)
RFC Errata System <rfc-editor@rfc-editor.org> Wed, 29 March 2017 18:22 UTC
Return-Path: <wwwrun@rfc-editor.org>
X-Original-To: opsec@ietfa.amsl.com
Delivered-To: opsec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DDFE3128854; Wed, 29 Mar 2017 11:22:00 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.202
X-Spam-Level:
X-Spam-Status: No, score=-4.202 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xpgO44vJ9kj1; Wed, 29 Mar 2017 11:21:58 -0700 (PDT)
Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 742521267BB; Wed, 29 Mar 2017 11:21:58 -0700 (PDT)
Received: by rfc-editor.org (Postfix, from userid 30) id BF8F8B80D6F; Wed, 29 Mar 2017 11:21:47 -0700 (PDT)
To: hugocanalli@gmail.com, dave@juniper.net, cpignata@cisco.com, rodunn@cisco.com
X-PHP-Originating-Script: 30:errata_mail_lib.php
From: RFC Errata System <rfc-editor@rfc-editor.org>
Cc: joelja@bogus.com, iesg@ietf.org, opsec@ietf.org, rfc-editor@rfc-editor.org
Content-Type: text/plain; charset="UTF-8"
Message-Id: <20170329182147.BF8F8B80D6F@rfc-editor.org>
Date: Wed, 29 Mar 2017 11:21:47 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/opsec/e9Iok_fBFklg138C3m1cmzIx7XY>
Subject: [OPSEC] [Errata Verified] RFC6192 (4851)
X-BeenThere: opsec@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: opsec wg mailing list <opsec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/opsec>, <mailto:opsec-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/opsec/>
List-Post: <mailto:opsec@ietf.org>
List-Help: <mailto:opsec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/opsec>, <mailto:opsec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 29 Mar 2017 18:22:01 -0000
The following errata report has been verified for RFC6192, "Protecting the Router Control Plane". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata_search.php?rfc=6192&eid=4851 -------------------------------------- Status: Verified Type: Technical Reported by: Hugo Leonardo Canalli <hugocanalli@gmail.com> Date Reported: 2016-11-01 Verified by: joel jaeggli (IESG) Section: A.2 Original Text ------------- term ebgp-reply { from { source-prefix-list { EBGP-NEIGHBORS; } protocol tcp; port bgp; } then accept; } Corrected Text -------------- term ebgp-reply { from { source-prefix-list { EBGP-NEIGHBORS; } protocol tcp; tcp-established; source-port bgp; } then accept; } Notes ----- There is a security question in that firewall relating to bgp reply. Any neighbor that fakes a tcp source port to 179 can access any router port, for example, ssh. Need to add the line tcp-established. Would also be better to add source-port bgp since bgp protocol uses the 179 port to destination. Add the fix to all bgps, including ipv6. -------------------------------------- RFC6192 (draft-ietf-opsec-protect-control-plane-06) -------------------------------------- Title : Protecting the Router Control Plane Publication Date : March 2011 Author(s) : D. Dugal, C. Pignataro, R. Dunn Category : INFORMATIONAL Source : Operational Security Capabilities for IP Network Infrastructure Area : Operations and Management Stream : IETF Verifying Party : IESG
- [OPSEC] [Errata Verified] RFC6192 (4851) RFC Errata System
- Re: [OPSEC] [Errata Verified] RFC6192 (4851) Smith, Donald
- Re: [OPSEC] [Errata Verified] RFC6192 (4851) Dave Dugal