Re: [secdir] secdir review of draft-ietf-ospf-encapsulation-cap-06

[David Mandelberg <[e-mail]>]

Thanks!

On 09/15/2017 12:28 PM, Robert Raszuk wrote:
> Hi David,
> 
> This draft inherits RFC 5565 security considerations so I was hoping 
> this would be sufficient. However I have no objection to add extra text 
> directly to this section 8 to recommend filtering/policy when flooded 
> information is passed to data plane explicitly listing the allowed range 
> of encapsulation destinations.
> 
> Thx,
> R.
> 
> 
> On Fri, Sep 15, 2017 at 6:17 PM, David Mandelberg <[e-mail] 
> <mailto:[e-mail]>> wrote:
> 
>     On 09/15/2017 12:02 PM, Robert Raszuk wrote:
> 
>         David,
> 
>         But how would an external attacker inject this information into
>         OSPF ?
> 
> 
>     By (partially) compromising a router, for example. I know an
>     attacker with that capability can already do a lot of bad stuff, but
>     it's not clear to me whether or not this extension gives them any
>     additional capabilities.
> 
> 
>         Also note that this information is opaque to OSPF itself and it
>         is highly recommended that set of policy rules (protecting from
>         misuse or even accidental mistakes) to be applied on it when
>         reaching the destination code (here encapsulation and forwarding
>         subsystem).
> 
> 
>     That sounds like a simple and secure way to address my concerns. If
>     the document already contains text recommending that local policy be
>     used to prevent forwarding outside of the authorized network, then
>     apologies for missing/forgetting it. If not, would you mind adding
>     something to the security considerations about it?
> 
> 
> 
>     -- 
>     Freelance cyber security consultant, software developer, and more
>     https://david.mandelberg.org/
> 
> 


-- 
Freelance cyber security consultant, software developer, and more
https://david.mandelberg.org/