Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\))
From: Yoav Nir <ynir.ietf@gmail.com>
In-Reply-To: <001801d0a2fb$ef31e560$cd95b020$@huitema.net>
Date: Wed, 10 Jun 2015 00:47:23 +0300
Content-Transfer-Encoding: quoted-printable
Message-Id: <C4E282B5-8A30-420D-BA7C-03CCB590D57E@gmail.com>
References: <06A85300-7DD9-4AC4-A5F5-EE9FE77F7466@gmail.com>
 <001801d0a2fb$ef31e560$cd95b020$@huitema.net>
To: Christian Huitema <huitema@huitema.net>
Archived-At: <http://mailarchive.ietf.org/arch/msg/secdir/5j6SwedZJBEnk3Z0eSgESp3IZwo>
Cc: draft-ietf-pcp-anycast.all@tools.ietf.org, The IESG <iesg@ietf.org>,
 secdir <secdir@ietf.org>
Subject: Re: [secdir] SecDir Review of draft-ietf-pcp-anycast-06
Precedence: list


> On Jun 10, 2015, at 12:33 AM, Christian Huitema <huitema@huitema.net> =
wrote:
>=20
>> There are two specific concerns about this method (other than the =
usual
>> anycast or pcp concerns). The first is that information about the =
internal
>> network might leak to a PCP service outside the network.=20
>=20
> In fact, it is almost guaranteed to leak outside of the network. In =
the initial deployments, first hop routers will not be aware of the =
anycast address...
>=20
>> ... Whereas a failure of
>> a service whose address is given in DHCP will result in black-holed =
packets,
>> failure of a service with an anycast address will cause the packets =
to be
>> forwarded to some random PCP server on the Internet. Section 5.1 =
discusses
>> this and recommends filtering in perimeter gateways and reduced TTL. =
I
>> believe this addresses that threat adequately.
>=20
> I would find the TTL mitigation would be more convincing if the draft =
actually specified a recommended TTL value.

Doesn=E2=80=99t that depend on the depth (diameter?) of the network?  =
The TTL should be high enough to reach the legitimate service but no =
higher. It does seem like a very fiddly thing. You=E2=80=99d need to =
re-adjust the TTL sent by all clients if you rearranged your servers a =
bit. I can see operators not taking the risk and just using the OS =
default TTL that=E2=80=99s high enough to take a packet to any network =
on the Internet.

Expecting the NAT device / firewall to filter sounds more plausible to =
me.