Re: [Status] Jari Arkko's BLOCK on charter-ietf-spring-00-06

[Stewart Bryant <[e-mail]>]

On 10/10/2013 17:39, Jari Arkko wrote:
> Thomas,
>
>> I think a key point is that with IPv6, we are talking (potentially)
>> end-to-end exposure of an attack vector. You can have arbitrary end
>> nodes anywhere on the Internet injecting traffic that potentially
>> directly invokes or impacts source routing. In contrast, one can view
>> MPLS as an L2 technology below IP. That means it's deployed in a much
>> more restricted setting and a normal sender of TCP/IP has a much more
>> restricted attack vector for doing anything that impacts MPLS directly
>> (this is key diffference). That means the threat surface for attacks
>> on MPLS are very different than for IPv6 more generally.
> Yes - a good point. That is one of those restricted cases where it is possible to provide a reasonably secure solution.
>
> But my understanding is that SPRING was at IPv6 layer as well as on MPLS layer… although the charter does not explicitly say it. Just that it is not IPv4…
>
> If SPRING is expected to run at the IPv6 layer, what is the plan to contain the vulnerability?
>
> Jari
>
> .
>
The following was just posted on the STATUS list and clarifies
intended IPv6 scope.

All,

On the topic of MPLS vs IPv6 - one being L2 hence more secure then the
other (L3) I would like to observe that any decently managed network
would already today prohibit to accept any external packets which have
as destination an infrastructure address of such network. That is the
basic protection scheme against DOS/DDOS attacks to the
infrastructure.

When such packet is detected it should be dropped - not "stripped from
explicit routes" like the above charter update would tend to suggest.

As some may recall in the past we have been working on automating such
ACLs installation based in internal IGP addresses on all border
routers under same administrative domain within single AS or number of
ASes to ease operational burden. Not sure if all vendors support such
automation today.

I think what needs to be understood that segment routing is not
internet wide source routing technology. It is carefully crafted path
engineering and packet encapsulation technique within controlled set
of domains which really do not compare to the original issues and
security concerns of source routing.

Best,
R.

I could

OLD
The initial data planes that will be considered are MPLS
and IPv6.

NEW
The initial data planes that will be considered are MPLS
and IPv6 in constrained network scopes.


END

Stewart