Re: [secdir] Issue with PCEP

[Brian Weis <[e-mail]>]

Hi Julien,

It's not clear to me that there would be any security issue with relaxing this restriction. A PCE application should be concerned with accepting only PCE sessions from authorized peers, and should apply integrity protection to the segments to ensure that only segments from those peers are accepted, but restricting the source port number for the TCP segments received from authorized peers doesn't seem particularly valuable to me.

Hope that helps,
Brian

On Jul 13, 2011, at 8:04 AM, Julien Meuric wrote:

> Dear Security Directorate,
> 
> In the PCE WG, an issue had been reported by several implementers of PCEP, the "Path Computation Element communication Protocol" specified in RFC 5440 (cf. the thread on http://www.ietf.org/mail-archive/web/pce/current/msg02426.html or http://tools.ietf.org/agenda/80/slides/pce-0.pdf).
> 
> This issue is related to the fact that the TCP source port of a PCEP session is fixed. To summarize, some operating systems (including Linux) are not that flexible when it comes to assigning a fixed source port.
> 
> A reasonable solution to this issue is to remove that restriction on the source port of a PCEP session. It is backward compatible with current RFC 5440 and has been agreed with the Tranport Area ADs.
> 
> From a security perspective, do you issue any blocking issue in moving forward with this solution?
> 
> Thank you,
> 
> Julien, PCE co-chair
> 
> _______________________________________________
> secdir mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/secdir


-- 
Brian Weis
Security Standards and Technology, SRTG, Cisco Systems
Telephone: [phone]
Email: [e-mail]