Subject: [rbridge] Possible new attacks to add for security considerations document

From: Greg.Daley at eng.monash.edu.au (Greg Daley)
Date: Thu, 10 Mar 2005 20:05:28 +0000 (GMT)

Hi,

I think there are two possible attacks which need
adding or clarifying.

1) That a device with multiple ports on the
   VLAN can advertise in order to become a
   root bridge, in a way which makes it on the
   path for connecting two parts of a network.
   It can then not forward packets passing
   between those network fractions.

2) A possible denial of service attack is to
   cycle destination addresses for unicast 
   packets.  This will cause flooding on all
   ports continually (consuming bandwidth, hitting
   back planes), until frame dropping occurs.

*troll warning*

Also I don't think that any keying mechanisms
for IEEE are generally applicable, since I
guess that the unmanaged network case needs consideration and support
from rbridge as well.

We shouldn't assume that new to be developed
techniques are deployed or even applicable in this
case.

I'd certainly welcome statements about the 
applicability and use of these techniques
in the document.  The security issues stand
today in exsiting networks, and will continue
in many environments.

Comments on this issue are welcome.

Greg

---

From: erik.nordmark at sun.com (Erik Nordmark)
Date: Thu, 10 Mar 2005 19:10:20 -0800

> techniques are deployed or even applicable in this

I suspect things are a bit more nuanced.

While we want to provide a plug&play way to do things (which means that 
no meaningful key/secret/passwd based security can be required), it is 
still useful to allow for added security, at the cost of needing to 
configure things.

    Erik

---

From: Radia.Perlman at Sun.COM (Radia Perlman)
Date: Fri, 11 Mar 2005 19:44:54 -0800

Margaret asked me a question at the BOF which I did not think about 
carefully enough
before answering and probably gave
the wrong answer. She theorized that each VLAN must be a separate IP 
subnet, and
she was right. Since the point of VLANs is to separate traffic, each 
VLAN would have
to have its own prefix (so that an endnode in VLAN A won't mistakenly
thing that an endnode in VLAN B was actually a neighbor).
Traffic from one VLAN can only get to another VLAN if forwarded
through a router. And if an endnode moves from one VLAN to another it 
must change
its IP address. This is true today with bridges, and wouldn't change 
with RBridges.

Radia