[OPSEC] [Technical Errata Reported] RFC6192 (4851)

RFC Errata System <rfc-editor@rfc-editor.org> Tue, 01 November 2016 16:00 UTC

To: dave@juniper.net, cpignata@cisco.com, rodunn@cisco.com, bclaise@cisco.com, joelja@bogus.com, gunter@vandevelde.cc, evyncke@cisco.com
From: RFC Errata System <rfc-editor@rfc-editor.org>
Message-Id: <20161101155957.0B82BB81C85@rfc-editor.org>
Date: Tue, 01 Nov 2016 08:59:57 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/opsec/u9oy2j3A6iSyvrz0cZnkxU1IoC0>
Cc: opsec@ietf.org, hugocanalli@gmail.com, rfc-editor@rfc-editor.org
Subject: [OPSEC] [Technical Errata Reported] RFC6192 (4851)
Precedence: list

The following errata report has been submitted for RFC6192,
"Protecting the Router Control Plane".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=6192&eid=4851

--------------------------------------
Type: Technical
Reported by: Hugo Leonardo Canalli <hugocanalli@gmail.com>

Section: A.2

Original Text
-------------
term ebgp-reply {
from {
source-prefix-list {
EBGP-NEIGHBORS;
}
protocol tcp;
port bgp;
}
then accept;
}

Corrected Text
--------------
term ebgp-reply {
from {
source-prefix-list {
EBGP-NEIGHBORS;
}
protocol tcp;
tcp-established;
source-port bgp;
}
then accept;
}

Notes
-----
Thare are a security question in that firewall relating to bgp reply.
Any neighbor that fake a tcp source port to 179 can access any router port, by example ssh.
Need to add the line tcp-established. Would be also better to add source-port bgp since bgp protocol uses the 179 port to destination. Add the fix to all bgps, including ipv6.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party
can log in to change the status and edit the report, if necessary.

--------------------------------------
RFC6192 (draft-ietf-opsec-protect-control-plane-06)
--------------------------------------
Title : Protecting the Router Control Plane
Publication Date : March 2011
Author(s) : D. Dugal, C. Pignataro, R. Dunn
Category : INFORMATIONAL
Source : Operational Security Capabilities for IP Network Infrastructure
Area : Operations and Management
Stream : IETF
Verifying Party : IESG

[OPSEC] [Technical Errata Reported] RFC6192 (4851) RFC Errata System