Subject: [OSPF] Doubt in RFC 4552 - Authentication/Confidentiality for OSPFv3

From: "Bhatia, Manav \(Manav\)" <[email-masked]>
Date: Mon, 24 Nov 2008 14:19:11 +0530

Hi,

RFC 4552 mandates the use of ESP (sec 3), while defines the use of AH
for authenticating OSPFv3 packets as optional (it's a MAY).

I might be stating the obvious but AFAIK, ESP isn't really router (or
even firewall) friendly. The router cant deep inspect the ESP protected
packet and filter out the ones not needed or offer prioritized treatment
to OSPF packets, since it'll never know whether the payload, following
the ESP header, is encrypted or not. 

Now, isn't this a problem? 

Wouldn't using AH, as opposed to ESP, help in such cases? I understand
that ESP also offers encryption in addition to data integrity
protection. But, is encryption really required for a routing protocol?

Cheers, Manav

_______________________________________________
OSPF mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ospf

---

From: "Vishwas Manral" <[email-masked]>
Date: Mon, 24 Nov 2008 05:41:13 -0800

Hi Manav,

For IPsec support AH itself is a MAY and ESP is a MUST support (if I
remember correctly).

Thanks,
Vishwas

---

From: Acee Lindem <[email-masked]>
Date: Mon, 24 Nov 2008 08:55:06 -0500

Hi Vishwas, Manav,

That is my understanding as well. Note that since OSPF is an IGP, the  
OSPF routing domain is normally under a single administrative  
domain.  Hence, firewall considerations normally shouldn't come into  
play.

Thanks,
Acee

---

From: "Bhatia, Manav \(Manav\)" <[email-masked]>
Date: Mon, 24 Nov 2008 20:42:43 +0530

Hi Acee,

I was more interested in the issue of the receiving router being unable
to identify and classify (basically prioritize) OSPFv3 packets when ESP
encapsulation is being used (which is a MUST in 4552). The only way a
router can do this is, if it assumes OSPF traffic over ESP-NULL SA.
Imposing such a restriction would obviously be a trifle odd. However, if
AH is used, then there are no such issues, as its easy to identify, and
thus offer preferential treatment to OSPFv3 packets.

> domain.  Hence, firewall considerations normally shouldn't come into  

I agree. However, in some exceptional cases (mostly very secure
environments) we can have firewalls being used within the network as
well as the edges. Anyways, we can leave the firewalls aside as what I
am more interested in is the former case (prioritizing OSPFv3 packets).

Cheers, Manav 

> -----Original Message-----
> From: Acee Lindem [mailto:[email-masked]] 
> Sent: Monday, November 24, 2008 7.25 PM
> To: Vishwas Manral
> Cc: Bhatia, Manav (Manav); [email-masked]
> Subject: Re: [OSPF] Doubt in RFC 4552 - 
> Authentication/Confidentiality for OSPFv3
> 
> Hi Vishwas, Manav,
>

---

From: "Vishwas Manral" <[email-masked]>
Date: Mon, 24 Nov 2008 08:52:31 -0800

Hi Manav,

Now that is confusing.

Before I get into the specifics let me tell you that IPsecme WG is
working on seeing if it will be helpful to make ESP middlebox friendly
(firewall is not the only middlebox). That said we can use hueristic
mechanisms to look deeper into the packet and then figure out if the
packet is an encrypted/ unencrypted packet. We use something similar
in the case of MPLS ECMP case. There are a couple of proposals in
IPsecme already on having middlebox friendly ESP.

> thus offer preferential treatment to OSPFv3 packets.
The idea of having the priority in the IP layer is that the
application does not need to look deeper into the packet to figure out
the priority. Why is it not possible to have different priority of
OSPF packets in the IP header? That said the receiving router has the
SA configured and can figure out if the packet is encrypted or not and
then prioritize after that.

>> domain.  Hence, firewall considerations normally shouldn't come into
I guess we have discussed this further.

Thanks,
Vishwas

---

From: "Vishwas Manral" <[email-masked]>
Date: Mon, 24 Nov 2008 08:54:25 -0800

Hi Acee,

On Mon, Nov 24, 2008 at 5:55 AM, Acee Lindem <[email-masked]> wrote:
> Hi Vishwas, Manav,
>
> That is my understanding as well. Note that since OSPF is an IGP, the OSPF
> routing domain is normally under a single administrative domain.  Hence,
> firewall considerations normally shouldn't come into play.
This is not totally correct in my view. An OSPF packet sent from
outside the domain should be identifiable and dropped.

Thanks,
Vishwas

---

From: "Bhatia, Manav \(Manav\)" <[email-masked]>
Date: Mon, 24 Nov 2008 23:01:53 +0530

Hi Vishwas,

> OSPF packets in the IP header? That said the receiving router has the

Yup, works in theory but I have seldom seen OSPF packets being sent with
a unique TOS/Traffic value that sets them apart from other packets in
the network. Moreover, you would want to prioritize OSPF traffic without
any explicit configuration. Setting a unique traffic class/TOS for OSPF
entails explicit user config. 

> then prioritize after that.

Obviously there are other proprietary ways to prioritize ESP protected
OSPFv3 packets, but they've got their own issues .. 

Cheers, Manav

---

From: "Vishwas Manral" <[email-masked]>
Date: Mon, 24 Nov 2008 09:36:44 -0800

Hi Manav,

> entails explicit user config.
User config - why would anyone require user config? Well it will be
done when the need for it really comes, because the mechanism to do it
exists.

> OSPFv3 packets, but they've got their own issues ..
Ok.

Thanks,
Vishwas

---

From: "Bhatia, Manav \(Manav\)" <[email-masked]>
Date: Mon, 24 Nov 2008 23:24:02 +0530

Hi Vishwas,

> done when the need for it really comes, because the mechanism to do it

How else would you assign a unique priority to all OSPF packets? There
isn't any standard value that disambiguates OSPFv3 from other v6
packets. Or are you proposing that we use one?

Cheers, Manav

---

From: "Vishwas Manral" <[email-masked]>
Date: Mon, 24 Nov 2008 09:57:25 -0800

Hi Manav,

Just as the hardware does not see OSPFv3 each kind of packet and then
prioritizes it. We will just set the field in the IPv6 header by
calling the right socket API's.

To do that you can use the standard library cmsg interface - which is
really flexible unlike the older socket interfaces we had. You do not
need to do anything at the IP layer at all.

Thanks,
Vishwas

---

From: "Bhatia, Manav \(Manav\)" <[email-masked]>
Date: Mon, 24 Nov 2008 23:29:48 +0530

Hi Vishwas,

> calling the right socket API's.

Yes, but for interoperability all the vendors need to use the same
value, which means it needs to get standardized.

Cheers, Manav

---

From: "Vishwas Manral" <[email-masked]>
Date: Mon, 24 Nov 2008 10:01:38 -0800

Hi Manav,

I am confused.

> value, which means it needs to get standardized.
I guess we are clearer about the user interface now. What needs to be
standardized and why?

Thanks,
Vishwas

---

From: "Bhatia, Manav \(Manav\)" <[email-masked]>
Date: Mon, 24 Nov 2008 23:42:35 +0530

Hi Vishwas,

> I am confused.

So am I! :-)

> I guess we are clearer about the user interface now. What needs to be

I have a feeling that we're talking about different things here. Lets
take this offline and do our bit to reduce our carbon footprint!

Cheers, Manav

---

From: "Abuse 007" <[email-masked]>
Date: Tue, 25 Nov 2008 23:34:39 +1100

If a user was to set up OSPFv3 protected by ESP and wanted to
prioritize OSPFv3 traffic, then they can use pre-classify QoS, the
outer IP header will be marked based on the contents inside the ESP
payload. Priority / low-latency queuing can then be used based on the
markings on the outer header, despite the payload being encrypted.

---

From: "Stan Ratliff (sratliff)" <[email-masked]>
Date: Tue, 25 Nov 2008 09:25:51 -0500

I understand that IPsec ESP could be used. But the additional header
is a very unwelcome thing in a MANET (not to mention the additional
configuration complexity).

Regards,
Stan

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Abuse 007
Sent: Tuesday, November 25, 2008 7:35 AM
To: Bhatia, Manav (Manav)
Cc: [email-masked]
Subject: Re: [OSPF] Doubt in RFC 4552 - Authentication/Confidentiality
forOSPFv3

---

From: "Vishwas Manral" <[email-masked]>
Date: Tue, 25 Nov 2008 09:14:13 -0800

Hi Stan,

Are you talking about using IPsec in the tunnel mode (which is a MUST
for IPsec) or are you talking about the ESP header itself?

Thanks,
Vishwas

---

From: "Stan Ratliff (sratliff)" <[email-masked]>
Date: Tue, 25 Nov 2008 13:11:43 -0500

Vishwas, 

The short answer is "yes"... ;-)  With MANETs running 
on bandwidth-constrained, high loss links, any increase
in packet size increases the probability of an error during
transmission.  

So from my perspective, I'd like to be able to authenticate
OSPF packets, but do so with the smallest possible increase
in packet size, and the smallest amount of configuration on
the router. 

Regards,
Stan

-----Original Message-----
From: Vishwas Manral [mailto:[email-masked]] 
Sent: Tuesday, November 25, 2008 12:14 PM
To: Stan Ratliff (sratliff)
Cc: Abuse 007; Bhatia, Manav (Manav); [email-masked]
Subject: Re: [OSPF] Doubt in RFC 4552 - Authentication/Confidentiality
forOSPFv3

Hi Stan,

Thanks,
Vishwas

---

From: Acee Lindem <[email-masked]>
Date: Tue, 25 Nov 2008 14:11:41 -0500

Hi Stan,

> in packet size increases the probability of an error during

Then I suppose you don't like IPsec AH any better :^)

> in packet size, and the smallest amount of configuration on

I don't know if you've followed MIP6, (now MEXT), but a similar  
discussion keeps recurring there. Heretofore, the result has been to  
stay with IPsec although other authentication mechanisms have been  
implemented to the chagrin of the Security area (see RFC 4285).

Thanks,
Acee