Subject: Re: [Idr] change in draft-ietf-idr-bgp-vuln-00.txt

From: Sandy Murphy <[email-masked]>
Date: Tue, 11 May 2004 16:21:57 -0400 (EDT)

>A cease is a very temporary DoS.  In order to be effective the attack
>must be somewhat continuous.  Injection of bad routing is a
>semipermanent DoS which if successful would be hard to detect.
>Therefore the latter is far more dangerous.  Knowing that we are much
>more safe against the dangerous form of attack is significant and
>should be mentioned, unless the goal is just to bash BGP.

Curtis, are you saying that you think the draft should be amended to
discuss this attack?  (Which would mean not just a request to the RFC
Editor, but a new version, last call, etc.)

Presently, section 2 (Attacks) of the draft says:

     message insertion: BGP does not provide protection against
     insertion of messages.  However, because BGP uses TCP, when the
     connection is fully established, message insertion by an outsider
     would require accurate sequence number prediction (not entirely out
     of the question, but more difficult with mature TCP
     implementations) or session stealing attacks.

     message deletion: BGP does not provide protection against deletion
     of messages.  Again, more difficult against a mature TCP
     implementation but not entirely out of the question

     message modification: BGP does not provide protection against
     modification of messages.  A modification that did not change the
     length of the TCP payload would in general not be detectable.

In section 3.1.1 "Message Header", it says:

Event 21: Each BGP message starts with a standard header.  In all cases,
syntactic errors in the message header will cause the BGP speaker to
close the connection, release all associated BGP resources, delete all
routes learned through that connection and run its decision process to
decide on new routes.

If you do not think these are sufficient, given the tcpm-tcpsecure
draft discussion of blind data injection, then would something like
the following be what you would want to see?

3.2.  Vulnerabilities through Other Protocols

3.2.1.  TCP messages
...
3.2.1.1.  TCP SYN
3.2.1.2.  TCP SYN ACK
3.2.1.3.  TCP ACK
3.2.1.4.  TCP RST/FIN/FIN-ACK

add a new section:

3.2.1.5.  TCP Data Injection

A TCP segment is accepted if some of its sequence numbers fall within
the receive window.  If the sequence numbers do not match the left
edge of the window, then the segment may, in some implementations, be
queued for later processing.  There is a chance that this would allow
insertion of bogus data that would be delivered to BGP.  However,
later arriving in-order segments may partially or completely overwrite
the out-of-order segment.  In order for this feature to be used to
attack BGP, the attacker would not only have to predict a sequence
number lying in the receive window, but also be fortunate in the bogus
segment not being overwritten by later arriving authentic segments.
Furthermore, the BGP message header contains framing information
(length, etc.) that would make it difficult for any bogus inserted
data that did get delivered to BGP to pass the syntactic checks.  The
likely result would be a Message Header Error, causing the connection
to be closed, rather than acceptance of bogus routing information.  The
use of [5] will counter this attack.

(That's off the top of my head, but you get the idea.)

--Sandy

_______________________________________________
Idr mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/idr

---

From: Curtis Villamizar <[email-masked]>
Date: Tue, 11 May 2004 16:52:46 -0400

> Editor, but a new version, last call, etc.)

Its not worth upsetting the last call.  Please change it when/if you
make another iteration of the draft.

Thanks,

Curtis

---

From: Curtis Villamizar <[email-masked]>
Date: Tue, 11 May 2004 16:52:46 -0400

Thanks,

Curtis