Re: [pcp] WGLC: draft-ietf-pcp-anycast-02 comments due by NOV 10

[🔓Dan Wing <[e-mail]>]

On Oct 30, 2014, at 1:33 AM, Markus Stenberg <[e-mail]> wrote:

> On 27.10.2014, at 22.23, Dave Thaler <[e-mail]> wrote:
>> This email initiates a Working Group Last Call on : draft-ietf-pcp-anycast-02 to conclude on
>> Monday, November 10th at the PCP WG meeting in Honolulu.  Please send comments to the list.
>> 
>> As a reminder, when responding to a WGLC, what we chairs are looking for is a statement about
>> document quality (not really about whether the mechanism should move forward).  That is,
>> state whether you think the document is ready as is, or if not, what issues you see.
> 
> I think the document (and the mechanism) is mostly fine and needed.
> 
> What I am wondering about is security considerations section; given implementations not aware of this draft, a host on the inner side can also advertise the anycast address, and potentially get traffic meant for first-hop PCP server. Given the scheme defined in section 2.1 (SHOULD use first-hop first), it is possible, although not probable. But still, I would say the same problem is both on local network(s) _and_ on the other side of the firewall.

I agree such an attack would work if the PCP client (or the router) listen to a routing protocol and the attacker advertises the PCP anycast address's network using that routing protocol.  But on the local network the PCP client won't ARP for an address beyond its own subnet, so the attack seems limited to where a routing protocol is being used?

> (It could also state that finding (platform independently) next-hop gateway programmatically can be hard for pure ‘applications’ sometimes, but I wonder if this is too much detail.

Earlier in PCP's development I recall some sample code was rolling around for how to find first-hop gateway on several OSs.

> But if app just chose anycast address, the above SHOULD would not be followed and the security considerations problems would be more severe.)
> 
> Also.. Is there actually defined mechanism to redirect or provide list of PCP servers that is mentioned in the introduction?

There isn't; that sentence should be removed.

-d