Subject: [mpls] Poll closed - Re: poll on draft-beckhaus-ldp-dod-01

From: Loa Andersson <[email-masked]>
Date: Wed, 04 Jan 2012 14:44:04 +0100

Working Group,

this poll has ended, and we have a new working group document.

Could the authors please re-publish the document as
draft-ietf-mpls-ldp-dod-00.

Without any other changes than the administrative information and
the file name.

Loa
for the mpls wg chairs

On 2011-12-09 12:16, Loa Andersson wrote:
> Working Group,
>
> this is to start a two week poll to see if there is support to make
> draft-beckhaus-ldp-dod-01 an mpls working group draft.
>
> Pleased send your comments to the mpls working group mailing list
> ([email-masked]).
>
> This poll ends Dec 23, 2011!
>
> Loa
> for the mpls wg chairs

-- 

Loa Andersson                         email: [email-masked]
Sr Strategy and Standards Manager            [email-masked]
Ericsson Inc                          phone: +46 10 717 52 13
                                              +46 767 72 92 13

---

From: Yaakov Stein <[email-masked]>
Date: Wed, 4 Jan 2012 16:01:04 +0000

Draft authors, 

Now that this draft has become a WG item,
I really would like to hear how you intend addressing the security issues.

Let's start with a simple one.

As I have said in earlier emails, 
devices in the access network are unguarded,
and it is relatively easy to subvert one or to concatenate new devices.

In particular, it is not hard to reprogram a L2 device
or insert a small device somewhere that transparently passes everything except LDP KeepAlives.
Presumably I would only intermittently trigger this discarding of KeepAlives 
and leave it on for only a minute or so
in order to make the problem hard to diagnose and localize.

When the LDP peers detect the loss they terminate the session 
and discard all label mappings, thus producing a total denial of service.

I am interested in hearing how you would deal with this scenario.

Y(J)S

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Loa Andersson
Sent: Wednesday, January 04, 2012 15:44
To: [email-masked]
Cc: Ross Callon; [email-masked]
Subject: [mpls] Poll closed - Re: poll on draft-beckhaus-ldp-dod-01

Working Group,

Loa
for the mpls wg chairs

-- 

Loa Andersson                         email: [email-masked]
Sr Strategy and Standards Manager            [email-masked]
Ericsson Inc                          phone: +46 10 717 52 13
                                              +46 767 72 92 13
_______________________________________________
mpls mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mpls

---

From: <[email-masked]>
Date: Wed, 11 Jan 2012 13:43:21 +0100

Yaakov,

as you have mentioned in the earlier mail, I understand your security concerns not as a protocol (LDP-DoD) related topic but an issue based on the (seamless mpls architecture) scenario. I agree: if somebody wants to extends MPLS behind the "trusted" part of the network, we have to consider additional security requirements (But there is no difference, wether I put such a mentioned L2-device between an LER and an LSR in the traditional MPLS deployment ot between an Access Node and an AGN1 in seamless-mpls).

I spoke to the authors of the Seamless MPLS draft and the next version of the draft will include an update to the security section to address the issues you raised regarding the Seamless MPLS architecture.

Therefore, my understanding is that there are no additional security requirements of LDP DoD based on the proposed protocol behaviour.

Thomas

> From: Yaakov Stein [mailto:[email-masked]]
> Sent: Wednesday, January 04, 2012 5:01 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: RE: [mpls] Poll closed - Re: poll on
> draft-beckhaus-ldp-dod-01
>
> Draft authors,
>

---

From: Yaakov Stein <[email-masked]>
Date: Sun, 15 Jan 2012 07:59:25 +0000

Thomas

I respectfully disagree.

Yes, the seamless MPLS draft needs a security section,
but that does not free this draft from one.

The security section of 5036 has language which makes it clear
that the authors did not really consider the non-walled garden scenario.

For example, in 5.3
      An LSR administrator can address the threat of DoS attacks via
      Basic Hellos by ensuring that the LSR is directly connected only
      to peers that can be trusted to not initiate such an attack.
      ...
      An administrator can reduce that threat by connecting the LSR only
      to exterior peers that can be trusted to not initiate a Basic
      Hello attack.

Because of the assumption that MPLS can be easily walled off,
the authors did not consider many relatively simple attacks,
including the one I mentioned.

Thus any proposal to use LDP in the seamless MPLS environment
requires a significantly strengthened security section,
explaining what to do about the attack I mentioned,
and several other attacks that become available in this environment.

Y(J)S

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Wednesday, January 11, 2012 14:43
To: Yaakov Stein
Cc: [email-masked]; [email-masked]
Subject: RE: [mpls] Poll closed - Re: poll on draft-beckhaus-ldp-dod-01

Yaakov,

Thomas

---

From: Maciek Konstantynowicz <[email-masked]>
Date: Mon, 16 Jan 2012 12:35:11 +0000

Yaakov,

Please note that Thomas response was not commenting directly regarding the presence or content of security section in the ldp-dod draft, nor regarding the DoS attack you described in the previous message.

The problem you highlighted is understood, and myself and other co-authors are in the process of writing the security section for ldp-dod draft. The content of that section will also apply to seamless-mpls draft as per Thomas note.
In case of any inconsistency or ambiguity in regards to the security use case scenario you have described, we will contact you directly.

Give us few weeks, and we will post an updated version of ldp-dod draft. 

Hope this clarifies.

Thanks,
Maciek.