Re: [secdir] secdir review of draft-ietf-ospf-encapsulation-cap-06

[Robert Raszuk <[e-mail]>]

Hi David,

This draft inherits RFC 5565 security considerations so I was hoping this
would be sufficient. However I have no objection to add extra text directly
to this section 8 to recommend filtering/policy when flooded information is
passed to data plane explicitly listing the allowed range of encapsulation
destinations.

Thx,
R.


On Fri, Sep 15, 2017 at 6:17 PM, David Mandelberg <[e-mail]>
wrote:

> On 09/15/2017 12:02 PM, Robert Raszuk wrote:
>
>> David,
>>
>> But how would an external attacker inject this information into OSPF ?
>>
>
> By (partially) compromising a router, for example. I know an attacker with
> that capability can already do a lot of bad stuff, but it's not clear to me
> whether or not this extension gives them any additional capabilities.
>
>
> Also note that this information is opaque to OSPF itself and it is highly
>> recommended that set of policy rules (protecting from misuse or even
>> accidental mistakes) to be applied on it when reaching the destination code
>> (here encapsulation and forwarding subsystem).
>>
>
> That sounds like a simple and secure way to address my concerns. If the
> document already contains text recommending that local policy be used to
> prevent forwarding outside of the authorized network, then apologies for
> missing/forgetting it. If not, would you mind adding something to the
> security considerations about it?
>
>
>
> --
> Freelance cyber security consultant, software developer, and more
> https://david.mandelberg.org/
>