Subject: [rbridge] draft protocol-10 WGLC Security Considerations BPDU/Hello DoS addition

From: "Donald Eastlake" <[email-masked]>
Date: Wed, 26 Nov 2008 17:26:33 -0500

This is the last of my three comments on the draft.
I propose to add a section to the Security Considerations of the protocol-10
draft as pasted at the end of this message. Comments welcome.

Thanks,Donald
=============================
Donald E. Eastlake 3rd   +1-508-634-2066 (home)
155 Beaver Street
Milford, MA 01757 USA
[email-masked]

The TRILL protocol requires that an appointed forwarder on an RBridge port
be temporarily inhibited if it sees a Hello from another RBridge claiming to
be the appointed forwarder or sees a root bridge change out that port. Thus
it would seem that forged BPDUs showing repeated root bridge changes and
forged Hellos with the Appointed Forwarder flag set could represent a
significant denial of service attack. However, the situation is not as bad
as it seems.

The best defense against forged Hellos or other IS-IS messages is the use of
IS-IS security [RFC5304]. Rogue end-stations would not normally have access
to the required IS-IS keying material needed to forge authenticatible
messages.

Authentication similar to IS-IS security is usually unavailable for BPDUs.
However, it is also the case that in typical modern wired LANs, all the
links are point-to-point. If you have an all RBridged campus, then the worst
that an end-station can do by forging BPDUs is to deny itself service. This
could be either through falsely inhibiting the forwarding of native frames
by the RBridge to which it is connected or by falsely activating the
optional decapsulation check (see Section 4.2.3.3).

However, when an RBridge campus contains bridged LANs, those bridged LANs
appear to any connected RBridges to be multi-access links. The forging of
BPDUs by an end-station attached to such a bridged LAN could affect service
to other end-stations attached to the bridged LAN. Note that bridges do not
forward BPDUs but process them, although this processing may result in the
issuance of further BPDUs. Thus, for an end-station to forge BPDUs to cause
continuing changes in the root bridge as seen by an RBridge through
intervening bridges would typically require it to cause root bridge
thrashing throughout the bridged LAN which would be disruptive even in the
absence of RBridges.

Some bridges can be configured to ignore BPDUs on particular ports and
RBridges can be configured not to inhibit appointed forwarding on a port;
however, such configuration should be used with caution as it can be unsafe.
_______________________________________________
rbridge mailing list
[email-masked]
http://mailman.postel.org/mailman/listinfo/rbridge