Re: [sidr] AD Review of sidr-origin-validation-signaling-09

[Chris Morrow <[e-mail]>]

At Tue, 29 Nov 2016 20:23:55 -0500,
"John G. Scudder" <[e-mail]> wrote:
> 
> On Nov 13, 2016, at 1:40 AM, Alvaro Retana (aretana)
> <[e-mail]> wrote:
> > C1. The reference to rfc7607 should be Informative.
> 
> Done (in -10 candidate source).
>  
> > C2. [Major] Security Considerations.  I think that there is one
> > consideration that should be mentioned in this section: Given that
> > the largest value is preferred (2 = invalid), there is an attack
> > vector where a router in the path (yes, even an internal router) can
> > inject a community indicating that the route is invalid; the
> > communities are not protected.  This action could result in
> > inconsistent routing or in even a DoS.  I know the document is not
> > explicit about what to do with the validation state (which is ok),
> > but the clear intention (from rfc6811 and rfc7115) is that it will
> > be used to make routing decisions.  Please add some text about this
> > potential issue.
> 
> I started to write something about this and then realized I don't
> understand what you mean. At first I thought you were saying that an
> attacker that can forge an OV community can bias route
> selection. While this is true of course, it's also not unique to OV
> (Localpref has this property for example). It probably wouldn't be
> hard to write a sentence to summarize this, if necessary.
> 
> However, you specifically refer to the invalid state: "a router in the
> path ... can inject a community indicating that the route is
> invalid". This makes me think you think there's something special
> about "invalid", and I don't know what it is. You also say something
> about the sorting order, which I'm also not sure why that would
> matter.

I read this with the implicit: "Of course 'invalid == drop'."

So, if between an edge/core nodes you marked the edge -> core prefix
stream (mid-stream) with 'invalid' the core may discard all routes
seen and so marked.

This COULD move traffic away from a single edge node (or nodes) and
bias traffic across longer/other paths OR it could isolate folk behind
the edge node(s).

Of course, just wiping out the prefixes in flight and stitching back
together the tcp session... same effect.

-chris