Subject: [OPSEC] [Technical Errata Reported] RFC6192 (4851)

From: RFC Errata System <[email-masked]>
Date: Tue, 1 Nov 2016 08:59:57 -0700 (PDT)

The following errata report has been submitted for RFC6192,
"Protecting the Router Control Plane".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=6192&eid=4851

--------------------------------------
Type: Technical
Reported by: Hugo Leonardo Canalli <[email-masked]>

Section: A.2

Original Text
-------------
   term ebgp-reply {
                   from {
                       source-prefix-list {
                           EBGP-NEIGHBORS;
                       }
                       protocol tcp;
                       port bgp;
                   }
                   then accept;
               }

Corrected Text
--------------
   term ebgp-reply {
                   from {
                       source-prefix-list {
                           EBGP-NEIGHBORS;
                       }
                       protocol tcp;
                       tcp-established;
                       source-port bgp;
                   }
                   then accept;
               }

Notes
-----
Thare are a security question in that firewall relating to bgp reply.
Any neighbor that fake a tcp source port to 179 can access any router port, by example ssh.
Need to add the line tcp-established. Would be also better to add source-port bgp since bgp protocol uses the 179 port to destination. Add the fix to all bgps, including ipv6.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC6192 (draft-ietf-opsec-protect-control-plane-06)
--------------------------------------
Title               : Protecting the Router Control Plane
Publication Date    : March 2011
Author(s)           : D. Dugal, C. Pignataro, R. Dunn
Category            : INFORMATIONAL
Source              : Operational Security Capabilities for IP Network Infrastructure
Area                : Operations and Management
Stream              : IETF
Verifying Party     : IESG