Re: [secdir] secdir review of draft-ietf-ospf-encapsulation-cap-06

[David Mandelberg <[e-mail]>]

On 09/15/2017 12:02 PM, Robert Raszuk wrote:
> David,
> 
> But how would an external attacker inject this information into OSPF ?

By (partially) compromising a router, for example. I know an attacker 
with that capability can already do a lot of bad stuff, but it's not 
clear to me whether or not this extension gives them any additional 
capabilities.


> Also note that this information is opaque to OSPF itself and it is 
> highly recommended that set of policy rules (protecting from misuse or 
> even accidental mistakes) to be applied on it when reaching the 
> destination code (here encapsulation and forwarding subsystem).

That sounds like a simple and secure way to address my concerns. If the 
document already contains text recommending that local policy be used to 
prevent forwarding outside of the authorized network, then apologies for 
missing/forgetting it. If not, would you mind adding something to the 
security considerations about it?


-- 
Freelance cyber security consultant, software developer, and more
https://david.mandelberg.org/