Subject: Re: [mpls] [MPLS] HELP: Need your opinion on LDP security

From: [email-masked]
Date: Thu, 28 Oct 2010 18:59:28 +0800

Hi Mach,
LDP Hello's function is to establish session and keepalive. After session 
is established, node should not be allowed to change hold time or 
transport address dynamically (although not explicitly said in RFC5036). 
If operator wants to change the hello hold time, it is reasonable to bring 
down the session.
If we do not allow hello parameters to be changed dynamically (that's easy 
to implement), is there any other security threat?

Thanks
Lizhong

> 
> 
> ------------------------------
> 
> Message: 2
> Date: Wed, 27 Oct 2010 11:40:18 -0400
> From: Eric Rosen <[email-masked]>
> Subject: Re: [mpls] [MPLS] HELP: Need your opinion on LDP security
> To: Mach Chen <[email-masked]>
> Cc: [email-masked], Lamberto Sterling <[email-masked]>
> Message-ID: <8822.1288194018@erosen-linux>
> 
> 
> > if there is no hello authentication,  an established LDP session can 
be 
> > torn down by a spoofing Hello with a smaller Hold Time interval 
ordifferent 
> > Transport Address.
> 
> Do you think we really need replay protection to protect against this? 
To
> exploit this vulnerability with a replay attack, an attacker would have 
to
> wait patiently until a router is reconfigured with a longer hold time 
and
> hello interval, and then replay that router's old hellos.  This would be 
a
> very sophisticated attack.
> 
> If we do want router R1 to be able to discard replays of old Hellos from
> router R2, I don't think the proposed mechanism is adequate.  At any 
moment
> when R1 does not have a Hello adjacency to R2, the replays of R2's old
> packets would be acceptable to R1, unless the shared secret has changed.
> For targeted LDP Hellos, it might be better to have each peer include
> something it learned from the other peer's recent Hellos.  E.g., R2 
could
> include in its Hello the sequence number from R1's most recent Hello. 
Then
> R1 could easily distinguish recently generated R2-Hellos from replayed
> R2-Hellos, and it wouldn't have to know anything about R2's hello 
interval
> or sequence number selection algorithm.  (A few details to be worked 
out.)
> Of course, something like this wouldn't work on a LAN, but the LAN
> environment is not where the vulnerability is.
> 
> I am also curious as to why your proposal does not include the IP source 
and
> destination addresses, or the transport (UDP) header, in the hash.  Most
> similar proposals seem to do so, but I don't understand all the security
> issues well enough to know whether that is required or desirable in this
> case. 
> 
> Frankly, I don't think there is enough security expertise on this 
mailing
> list to be able to properly a security proposal of this sort.  If the WG
> decides to pursue the issue of LDP Hello authentication, the chairs 
should
> ask the Security ADs to assign a security advisor.  But then we'd 
probably
> be told that this work conflicts with the KARP WG ;-)
> 
> 

--------------------------------------------------------
ZTE Information Security Notice: The information contained in this mail is solely property of the sender's organization. This mail communication is confidential. Recipients named above are obligated to maintain secrecy and are not permitted to disclose the contents of this communication to others.
This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the originator of the message. Any views expressed in this message are those of the individual sender.
This message has been scanned for viruses and Spam by ZTE Anti-Spam system.

---

From: Mach Chen <[email-masked]>
Date: Thu, 28 Oct 2010 20:13:28 +0800

Hi Lizhong,

If allowing operators to change parameters, the potential attackers also can 
change it by sending spoofing hellos, then security threat is there.

If changing hello parameters can not tear an existing LDP session, how do 
the operators make the changes to take effect?  I guess you probably have to 
disable all relevant configuration, then change the parameters, afterward 
enable again. IMHO, this is not what the operators want.

In addition, normally, changing hold time will not tear down the existing 
session and is natural thing.

Best regards,
Mach

--------------------------------------------------
From: <[email-masked]>
Sent: Thursday, October 28, 2010 6:59 PM
To: <[email-masked]>; <[email-masked]>; <[email-masked]>
Cc: <[email-masked]>
Subject: Re: [mpls] [MPLS] HELP: Need your opinion on LDP security

> ZTE Information Security Notice: The information contained in this mail is 
> solely property of the sender's organization. This mail communication is 
> confidential. Recipients named above are obligated to maintain secrecy and 
> are not permitted to disclose the contents of this communication to 
> others.
> This email and any files transmitted with it are confidential and intended 
> solely for the use of the individual or entity to whom they are addressed. 
> If you have received this email in error please notify the originator of 
> the message. Any views expressed in this message are those of the 
> individual sender.

---

From: [email-masked]
Date: Thu, 28 Oct 2010 20:38:41 +0800

Hi Mach,
Yes, I think it is it is reasonable to bring down the session, if operator 
wants to change the hello parameter after the session is already setup. 
Anyway, need more comments from operators.

Thanks.
Lizhong

---

From: Nitin Bahadur <[email-masked]>
Date: Fri, 29 Oct 2010 13:33:20 -0700

The draft says..

"Spoofed Hello messages is observed and reported as real problem in
production networks."

Is this really true? If yes, then service providers who are scared of the
security issue should chime in here and make their case.

Thanks
Nitin

---

From: "Adrian Farrel" <[email-masked]>
Date: Fri, 29 Oct 2010 23:01:12 +0100

Nitin,

I see where you are coming from, but it may be a bit much to hope that SPs will
pop up and say "Hey, our network is being successfully attacked."

Hope we can get some input from SPs. If not directly, hope they will contact
their vendors and get them to speak up.

Cheers,
Adrian

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Nitin
> Bahadur
> Sent: 29 October 2010 21:33
> To: Mach Chen; [email-masked]; [email-masked];
> [email-masked]
> Cc: [email-masked]
> _______________________________________________
> mpls mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mpls

---

From: Eric Gray <[email-masked]>
Date: Sat, 30 Oct 2010 05:05:04 -0400

Adrian

The problem here is that nobody ever believes the vendors, when their
customers ask them to "speak up."

For example, in this case, the draft authors are speaking up.  Could
be that they are doing so because they were asked to.

Yet the default assumption is that they're making things up.  Unless, 
of course, they are willing to give their potential competitors a list 
of those customers that are having issues - while at the same time 
giving these same cutomers reason to break-off relationships with them 
(and maybe even sue them).

Instead of asking service provider to step up to the microphone, maybe
it would be useful to ask the people speaking if they actually see the
problem in a customer's network (without expecting them to say which
customer or customers - because that is just silly).

--
Eric

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Adrian Farrel
Sent: Friday, October 29, 2010 6:01 PM
To: 'Nitin Bahadur'; 'Mach Chen'; [email-masked]; [email-masked]; [email-masked]
Cc: [email-masked]
Subject: Re: [mpls] [MPLS] HELP: Need your opinion on LDP security

Nitin,

Cheers,
Adrian

---

From: Vero Zheng <[email-masked]>
Date: Sat, 30 Oct 2010 17:52:48 +0800

> customer or customers - because that is just silly).

Since we are asked...
YES, as said in the draft,the spoofed Hello problem *IS* reported by our customer, not to the authors of course, to our operation department instead.

BR,
Vero

--------------------------------------------------
From: "Eric Gray" <[email-masked]>
Sent: Saturday, October 30, 2010 5:05 PM
To: <[email-masked]>; "'Nitin Bahadur'" <[email-masked]>; "'Mach Chen'" <[email-masked]>; <[email-masked]>; <[email-masked]>; <[email-masked]>
Cc: <[email-masked]>
Subject: Re: [mpls] [MPLS] HELP: Need your opinion on LDP security