Re: Éric Vyncke's Discuss on draft-ietf-bfd-vxlan-09: (with DISCUSS and COMMENT)

[Jeffrey Haas <[e-mail]>]

Carlos,

On Thu, Dec 19, 2019 at 03:22:28AM +0000, Carlos Pignataro (cpignata) wrote:
> > 2019/12/18 午後4:41、Jeffrey Haas <[e-mail]>のメール:
> > But given that point, what precisely is the objection to the inner IP header
> > of the BFD for vxlan having a TTL of 1?
> 
> The intent would be to protect of potential attacks beyond the encapsulating endpoint (i.e., packet coming into the VTEP vs. sourced, off-link spoofing).

I'm sorry if I'm seeing oblivious, but I'm missing something.

The encapsulated packet's outer IP header, if single hop, could certainly
benefit from GTSM procedures.

But once you're more than one hop away, and you're vulnerable to general
attacks against packet insertion that the base vxlan PDUs have, how exactly
does setting the TTL one way or the other provide protection?

> > I think this is partially a matter of attack spaces varying depending on
> > whether we're targeting the management VNI vs. a tenant.  In the case of the
> > management VNI, we (should) have very strong control over what BFD traffic
> > is getting encapsulated.  
> > 
> > However, for tenant VNI mode, is the argument that depending on what the
> > other vxlan PDU parameters look like, tenant sourced BFD PDUs may be
> > indistinguishable from ones sourced by the management infrastructure?  And
> > if so, how would GTSM help us here?
> 
> Tenant sourced BFD PDUs would not use host loopback dest addresses. Scanning through S6 of draft-ietf-bfd-vxlan-09, "MAY support the use of the Management VNI”.
> 
> And if there are already protections for not over-forwarding the BFD pak, the flip-question is “what does TTL = 1 bug you?”
> 
> My assumption was that if the base BFD specs say “GSTM is useful”, why not here?

Personally, I'm mostly ambivalent if it helps.  

If my observation above above about insertion attacks is valid, then using
GTSM for the inner IP packet isn't helpful for protecting against what GTSM
is intended for.  This leave us with roughly two modes:

- With GTSM, enforce the usual related BFD procedure.  If packets aren't
  "caught" by BFD, they have the potential to bounce around until they
  expire.  Either way, BFD should go Down and the max damage is a number of
  BFD packets eventually settling back to the 1/sec timer.
- Without GTSM, exactly the same, just with less distance.

So, presuming my observation is valid:
It doesn't help.
It doesn't hurt (much).
If we want to require it, go for it.

But it doesn't help your security story at all and using it perhaps confuses
people about it actually helping.  So, don't insist on it for security
reasons.

-- Jeff