Re: [OSPF] FYI on draft-kini-ospf-fast-notification-01
Wenhu Lu <wenhu.lu@ericsson.com> Wed, 30 March 2011 12:19 UTC
Return-Path: <wenhu.lu@ericsson.com>
X-Original-To: ospf@core3.amsl.com
Delivered-To: ospf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 715CD28C146 for <ospf@core3.amsl.com>; Wed, 30 Mar 2011 05:19:51 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.228
X-Spam-Level:
X-Spam-Status: No, score=-6.228 tagged_above=-999 required=5 tests=[AWL=0.370, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KA4mp2SpIe3K for <ospf@core3.amsl.com>; Wed, 30 Mar 2011 05:19:50 -0700 (PDT)
Received: from imr3.ericy.com (imr3.ericy.com [198.24.6.13]) by core3.amsl.com (Postfix) with ESMTP id 0E8E028C17F for <ospf@ietf.org>; Wed, 30 Mar 2011 05:19:49 -0700 (PDT)
Received: from eusaamw0707.eamcs.ericsson.se ([147.117.20.32]) by imr3.ericy.com (8.13.8/8.13.8) with ESMTP id p2UCLRse028550 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Wed, 30 Mar 2011 07:21:28 -0500
Received: from EUSAACMS0703.eamcs.ericsson.se ([169.254.1.203]) by eusaamw0707.eamcs.ericsson.se ([147.117.20.32]) with mapi; Wed, 30 Mar 2011 08:21:27 -0400
From: Wenhu Lu <wenhu.lu@ericsson.com>
To: "Bhatia, Manav (Manav)" <manav.bhatia@alcatel-lucent.com>, Sriganesh Kini <sriganesh.kini@ericsson.com>
Date: Wed, 30 Mar 2011 08:21:26 -0400
Thread-Topic: [OSPF] FYI on draft-kini-ospf-fast-notification-01
Thread-Index: AcvuKPPJkEhNbNnJQRC0V7XzEph3oQAhNhvgAAjMLrAAAFgioAAANE8w
Message-ID: <8249B703AE8442429AF89B86E8206AA26EF567C39D@EUSAACMS0703.eamcs.ericsson.se>
References: <5A5E55DF96F73844AF7DFB0F48721F0F5701F43A9B@EUSAACMS0703.eamcs.ericsson.se> <7C362EEF9C7896468B36C9B79200D8350CFCF66A60@INBANSXCHMBSA1.in.alcatel-lucent.com> <8249B703AE8442429AF89B86E8206AA26EF567C38D@EUSAACMS0703.eamcs.ericsson.se> <7C362EEF9C7896468B36C9B79200D8350CFCF66AF9@INBANSXCHMBSA1.in.alcatel-lucent.com>
In-Reply-To: <7C362EEF9C7896468B36C9B79200D8350CFCF66AF9@INBANSXCHMBSA1.in.alcatel-lucent.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US
Content-Type: multipart/alternative; boundary="_000_8249B703AE8442429AF89B86E8206AA26EF567C39DEUSAACMS0703e_"
MIME-Version: 1.0
Cc: "ospf@ietf.org" <ospf@ietf.org>
Subject: Re: [OSPF] FYI on draft-kini-ospf-fast-notification-01
X-BeenThere: ospf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: The Official IETF OSPG WG Mailing List <ospf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/ospf>, <mailto:ospf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ospf>
List-Post: <mailto:ospf@ietf.org>
List-Help: <mailto:ospf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ospf>, <mailto:ospf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 30 Mar 2011 12:19:51 -0000
Hi Manav, If I read it correctly, your original message said there would be a hole if we don't do verification in data plane. Now you are saying you never asserted it would, I'm confused. As Sri mentioned, the rate limiting should solve the problem easily. Thanks, -wenhu ________________________________ From: Bhatia, Manav (Manav) [mailto:manav.bhatia@alcatel-lucent.com] Sent: Wednesday, March 30, 2011 5:05 AM To: Wenhu Lu; Sriganesh Kini Cc: ospf@ietf.org Subject: RE: [OSPF] FYI on draft-kini-ospf-fast-notification-01 Hi Wenhu, I never asserted they would - If you claim to do auth verification in HW then you would presumably take care of this as well. I'm saying that either ways you have an issue. Cheers, Manav ________________________________ From: Wenhu Lu [mailto:wenhu.lu@ericsson.com] Sent: Wednesday, March 30, 2011 5.31 PM To: Bhatia, Manav (Manav); Sriganesh Kini Cc: ospf@ietf.org Subject: RE: [OSPF] FYI on draft-kini-ospf-fast-notification-01 Hi Manav, How would the data-plane auth verification prevent such DoS attacks? Any replayed packets will go through. Thanks, -wenhu ________________________________ From: ospf-bounces@ietf.org [mailto:ospf-bounces@ietf.org] On Behalf Of Bhatia, Manav (Manav) Sent: Wednesday, March 30, 2011 12:55 AM To: Sriganesh Kini Cc: ospf@ietf.org Subject: Re: [OSPF] FYI on draft-kini-ospf-fast-notification-01 Hi Sri, This is regarding the point that i had raised yesterday - If the routers flood the "LSAs" in the data plane without verifying them, then we're leaving a hole open for DoS attacks, as any packet masquerading as a legitimate OSPF packet will get flooded on all routers. This is different from data packets flooding as these packets will be occupying the higest priority queues in both the ingress, egress and the CPU. Second, what happens if the control packet is carrying an OSPF authentication digest? Would you still flood it without verifying the contents or would those be flooded regardless? I guess, you said that it would be the former. If thats the case, then this is not easy to do it in the HW as you would (i) need to parse the OSPF payload first to determine that its carrying a digest (ii) you would then need to verify it, which means you would be running HMAC-SHA in HW on the packet (given the Apad stuff that we have added in RFC5709 i dont think you can easily do this in HW) (iii) once the digest is verified you would need to flood it out on all the valid OSPF interfaces. Cheers, Manav ________________________________ From: ospf-bounces@ietf.org [mailto:ospf-bounces@ietf.org] On Behalf Of Sriganesh Kini Sent: Tuesday, March 29, 2011 9.20 PM To: ospf@ietf.org Subject: [OSPF] FYI on draft-kini-ospf-fast-notification-01 Just an FYI to the list This draft http://tools.ietf.org/html/draft-kini-ospf-fast-notification-01 was presented at the OSPF WG mtg today. Thanks for the comments/questions at the mic. We will submit a new version addressing the comments. Note that the other drafts related to Fast Notification (FN) are draft-lu-fn-transport and draft-lu-fast-notification-framework. These were presented in RTGWG. Thanks - Sri
- [OSPF] FYI on draft-kini-ospf-fast-notification-01 Sriganesh Kini
- Re: [OSPF] FYI on draft-kini-ospf-fast-notificati… Greg Mirsky
- Re: [OSPF] FYI on draft-kini-ospf-fast-notificati… Sriganesh Kini
- Re: [OSPF] FYI on draft-kini-ospf-fast-notificati… Bhatia, Manav (Manav)
- Re: [OSPF] FYI on draft-kini-ospf-fast-notificati… Sriganesh Kini
- Re: [OSPF] FYI on draft-kini-ospf-fast-notificati… Bhatia, Manav (Manav)
- Re: [OSPF] FYI on draft-kini-ospf-fast-notificati… Wenhu Lu
- Re: [OSPF] FYI on draft-kini-ospf-fast-notificati… Bhatia, Manav (Manav)
- Re: [OSPF] FYI on draft-kini-ospf-fast-notificati… Wenhu Lu
- Re: [OSPF] FYI on draft-kini-ospf-fast-notificati… Bhatia, Manav (Manav)
- Re: [OSPF] FYI on draft-kini-ospf-fast-notificati… Wenhu Lu
- Re: [OSPF] FYI on draft-kini-ospf-fast-notificati… Bhatia, Manav (Manav)
- Re: [OSPF] FYI on draft-kini-ospf-fast-notificati… Wenhu Lu