Re: [Status] Jari Arkko's BLOCK on charter-ietf-spring-00-06

[joel jaeggli <[e-mail]>]

On Oct 10, 2013, at 10:34 AM, Stewart Bryant <[e-mail]> wrote:

> On 10/10/2013 17:39, Jari Arkko wrote:
>> Thomas,
>> 
>>> I think a key point is that with IPv6, we are talking (potentially)
>>> end-to-end exposure of an attack vector. You can have arbitrary end
>>> nodes anywhere on the Internet injecting traffic that potentially
>>> directly invokes or impacts source routing. In contrast, one can view
>>> MPLS as an L2 technology below IP. That means it's deployed in a much
>>> more restricted setting and a normal sender of TCP/IP has a much more
>>> restricted attack vector for doing anything that impacts MPLS directly
>>> (this is key diffference). That means the threat surface for attacks
>>> on MPLS are very different than for IPv6 more generally.
>> Yes - a good point. That is one of those restricted cases where it is possible to provide a reasonably secure solution.
>> 
>> But my understanding is that SPRING was at IPv6 layer as well as on MPLS layer… although the charter does not explicitly say it. Just that it is not IPv4…
>> 
>> If SPRING is expected to run at the IPv6 layer, what is the plan to contain the vulnerability?
>> 
>> Jari
>> 
>> .
>> 
> The following was just posted on the STATUS list and clarifies
> intended IPv6 scope.
> All,
> 
> On the topic of MPLS vs IPv6 - one being L2 hence more secure then the
> other (L3) I would like to observe that any decently managed network
> would already today prohibit to accept any external packets which have
> as destination an infrastructure address of such network. That is the
> basic protection scheme against DOS/DDOS attacks to the
> infrastructure.
> 
Well… not really. we have a lovely document on control-plane protection which encapsulates what a number of operators consider good if not best practice RFC 6192.

One of the recommendations there is to allow but rate limit icmp necessary for for diagnostics. In some circles, icmp is considered an OAM diagnostic function. the operative observation though is the resource consumption potential is sufficicently trivial to understand that it can be managed with rather simple policing.

> When such packet is detected it should be dropped - not "stripped from
> explicit routes" like the above charter update would tend to suggest.
> 
> As some may recall in the past we have been working on automating such
> ACLs installation based in internal IGP addresses on all border
> routers under same administrative domain within single AS or number of
> ASes to ease operational burden. Not sure if all vendors support such
> automation today.
> 
> I think what needs to be understood that segment routing is not
> internet wide source routing technology. It is carefully crafted path
> engineering and packet encapsulation technique within controlled set
> of domains which really do not compare to the original issues and
> security concerns of source routing.
> 
> Best,
> R.
> 
> I could 
> 
> OLD
> The initial data planes that will be considered are MPLS
> and IPv6.
> NEW
> The initial data planes that will be considered are MPLS
> and IPv6 in constrained network scopes.
> 
> END
> 
> Stewart
> 
>