Subject: [mpls-tp] Potential per-platform label space security issue

From: Maarten Vissers <[email-masked]>
Date: Thu, 29 Jan 2009 16:38:16 +0100

Section 3.3 in MPLS-TP Framework document describes: 
"Per-platform or the per-interface label space can be selected."

When per-platform label space would be deployed in a MPLS-TP node it means
that the label space is node-wide and assigned from a unique pool of labels
in the node; the label can be used on ANY interface. When the LFIB has no
information about the incoming interfaces over which this label should be
received, a MP2P connection will effectively be present inside this node.
I.e. packets with this label value received on any of the input ports will
be forwarded to the specified output port.

A P2P connection build up in a network with ndoes using per-platform label
space, will effectively be a MP2P Network Connection that supports a P2P
Trail. I.e. when there would be N input ports on this MP2P connection, only
one of those input ports will be connected with a Trail Termination
function; the other N-1 input ports will be normally not-connected to any
source function.

This behaviour constitutes a potential security risk in my understanding. It
is in this case possible that an intruder connects to one of those N-1
unused input ports and sends additional packets into the connection via such
input port.

There are two methods to prevent intruders access to a P2P connection in
this case:
I) operate MPLS-TP with per-interface label space only;
II) apply ingress filtering to all packets received on an input port; allow
only packets with a label value in the list of expected label values on this
port to pass through. I.e. a mechanism that is similar with the "Enable
Ingress Filtering" mechanism in 802.1Q.

Two questions:

1) Is my understanding of per-platform label space correct?

2) How do we best resolve this security risk? Using per-interface label
space only, or using Ingress Filtering?

Regards,
Maarten

_______________________________________________
mpls-tp mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mpls-tp

---

From: <[email-masked]>
Date: Thu, 29 Jan 2009 16:14:53 -0000

IMO we should only use per interface labels in MPLS-TP.  regards, Neil 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Maarten Vissers
> Sent: 29 January 2009 15:38
> To: [email-masked]
> Subject: [mpls-tp] Potential per-platform label space security issue
> 
> 
> When per-platform label space would be deployed in a MPLS-TP 
> node it means that the label space is node-wide and assigned 
> from a unique pool of labels in the node; the label can be 
> used on ANY interface. When the LFIB has no information about 
> the incoming interfaces over which this label should be 
> I.e. packets with this label value received on any of the 
> input ports will be forwarded to the specified output port.
> 
> A P2P connection build up in a network with ndoes using 
> per-platform label space, will effectively be a MP2P Network 
> Connection that supports a P2P Trail. I.e. when there would 
> be N input ports on this MP2P connection, only one of those 
> input ports will be connected with a Trail Termination 
> function; the other N-1 input ports will be normally 
> not-connected to any source function.
> 
> This behaviour constitutes a potential security risk in my 
> understanding. It is in this case possible that an intruder 
> connects to one of those N-1 unused input ports and sends 
> additional packets into the connection via such input port.
> 
> There are two methods to prevent intruders access to a P2P 
> connection in this case:
> II) apply ingress filtering to all packets received on an 
> input port; allow only packets with a label value in the list 
> of expected label values on this port to pass through. I.e. a 
> mechanism that is similar with the "Enable Ingress Filtering" 
> mechanism in 802.1Q.
> 
> Two questions:
> 
> 2) How do we best resolve this security risk? Using 
> per-interface label space only, or using Ingress Filtering?
> 
> Regards,
> Maarten
>

---

From: <[email-masked]>
Date: Thu, 29 Jan 2009 16:43:01 -0000

Thanks Francesco....but if MPLS-TP cannot do this then I suggest it
should not claim to be a *transport* network.

regards, Neil

> From: Francesco Fondelli [mailto:[email-masked]] 
> Sent: 29 January 2009 16:40
> To: Harrison,N,Neil,CXM R
> Cc: [email-masked]; [email-masked]
> Subject: Re: [mpls-tp] Potential per-platform label space 
> security issue
> 
> On Thu, Jan 29, 2009 at 5:14 PM,  <[email-masked]> wrote:
> Agree, if LSP == connection, you have no choice.  A couple of notes
> though:
> 
> a) Probably, there are some LSRs out there that do not support per
>    interface label space.
> 
> b) The PW label MUST be allocated from the per-platform
>    label space [RFC 4447].
> 
> c) Not sure if RFC 3031 imposes per interface label space
>    support (I think it doesn't).
> 
> Ciao
> FF
>

---

From: Francesco Fondelli <[email-masked]>
Date: Thu, 29 Jan 2009 17:40:14 +0100

Ciao
FF