Subject: [RTG-DIR] Rtgdir telechat review of draft-ietf-idr-bgp-gr-notification-15

From: Bruno Decraene <[email-masked]>
Date: Fri, 13 Apr 2018 03:12:23 -0700

Reviewer: Bruno Decraene
Review result: Ready

Hello,

I have been selected as the Routing Directorate reviewer for this draft. The
Routing Directorate seeks to review all routing or routing-related drafts as
they pass through IETF last call and IESG review, and sometimes on special
request. The purpose of the review is to provide assistance to the Routing ADs.
For more information about the Routing Directorate, please see
​http://trac.tools.ietf.org/area/rtg/trac/wiki/RtgDir

Although these comments are primarily for the use of the Routing ADs, it would
be helpful if you could consider them along with any other IETF Last Call
comments that you receive, and strive to resolve them through discussion or by
updating the draft.

Document: draft-ietf-idr-bgp-gr-notification-15
Reviewer: Bruno Decraene
Review Date: 2018-04-13
IETF LC End Date: 2018-04-24
Intended Status: Standards Track

=====
Summary: No issues found. This document is ready for publication.

=====
Comments:

The document is very clear. I have particularly appreciated the high level
summary of the document in the introduction section. Thanks to the authors. The
security consideration section adequately consider the security impacts of this
specification. I had already reviewed the document twice (WGLC, AD review)
hence I really needed to push in order to find some comments. In this
nitpicking context, any comment is really up to the authors.

=====
Major Issues: No major issues found.

=====
Minor Issues:

I would not call these "minor issue", but it's beyond editorial so do not
qualify as "Nits". Please find below 2 comments, on the nitpicking far side.

"If the "N" bit has not been exchanged with the peer, then to
        deal with possible consecutive restarts, a route (from the peer)
        previously marked as stale MUST be deleted."
[...]
"To put an upper bound on the amount of time a router retains the
        stale routes, an implementation MUST support a (configurable)
        timer, called the "stale timer", that imposes this upper bound."

In order to fully respect the semantic, in case of consecutive restarts (with
partial route readvertisement), it seems that the stale timer would need to be
on a per route basis. I don't think that this is the intention of the authors
(nor that this is desirable). Altough this is a local consideration, hence not
affecting the peer, the "MUST" make this statement strong. Eventually, a text
could be added saying that the timer only needs to be on a per session basis.
e.g., :s/this upper bound/this upper bound on a per session basis. ---- "This
specification doesn't change the basic security model inherent
   in [RFC4724], with the exception that the protection against repeated
   resets is relaxed. To mitigate the consequent risk that an attacker
   could use repeated session resets to prevent stale routes from ever
   being deleted, we make the stale routes timer mandatory (in practice
   it is already ubiquitous)."

FYI, I'm not completely sure to see why this document change (i.e. negatively
impacts) the security in case of repeated NOTIFICATION as I would assume that
if an attacker could sends such NOTIFICATION, it could already advertise the
routes that it wished were never deleted. Also this risk would be covered via
an adequate protection against illegitimate messages (e.g. crypto checksum,
GTSM for EBGP) However I do see an increased risk with regards to Hold Time
expiration which remains an attack vector even with the use of a crypto
checksum protection, by simply filtering some BGP packets. Especially in
deployments when the BGP session crosses a long distance or multiple links and
nodes (e.g. IBGP, layer 2 network within an IXP cf RFC 8327). May be I would
propose to raise this point or slightly rephrase on the Hold Time expiration
side, rater than the NOTIFICATION side.

=====
Nits:

§1.1
RFC 2119 has been updated by RFC 8174.
OLD:
   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in RFC 2119 [RFC2119].

NEW:
      The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
      NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED",
      "MAY", and "OPTIONAL" in this document are to be interpreted as
      described in BCP 14 [RFC2119] [RFC8174] when, and only when, they
      appear in all capitals, as shown here.

+ New ref to RFC8174
----
§2
"("N") is defined as the BGP Graceful Notification bit"
[...]
"its Graceful NOTIFICATION bit set (value 1)"

Nitpicking, naming is not consistent.

---
" This also implies support for the format for a BGP NOTIFICATION Cease message
defined in [RFC4486]."

I'm not completely sure to see what this sentence is exactly saying. I feel
that the sentence would benefit from beeing more specific. e.g. NEW:  This also
implies support for the new "Hard Reset" subcode of the BGP NOTIFICATION Cease
message, its new behavior and new encoding of the Data field. ---- §8 "the
reference this document and [RFC4724]"

OLD:
       +--------------+------------------+------------+-----------+
       | Bit Position |       Name       | Short Name | Reference |
       +--------------+------------------+------------+-----------+
       |      0       | Forwarding State |     F      | [RFC4724] |
       |     1-7      |    unassigned    |            |           |
       +--------------+------------------+------------+-----------+

NEW:
       +--------------+------------------+------------+---------------+
       | Bit Position |       Name       | Short Name |   Reference   |
       +--------------+------------------+------------+---------------+
       |      0       | Forwarding State |     F      |   [RFC4724]   |
       |     1-7      |    unassigned    |            | This document |
       +--------------+------------------+------------+---------------+

---

From: "John G. Scudder" <[email-masked]>
Date: Tue, 17 Apr 2018 15:06:45 -0400

Hi Bruno,

Thanks for the further review. Some discussion in line below.

> On Apr 13, 2018, at 6:12 AM, Bruno Decraene <[email-masked]> wrote:
> 
> Reviewer: Bruno Decraene
> Review result: Ready
> 
> Hello,
> 
> ​https://urldefense.proofpoint.com/v2/url?u=http-3A__trac.tools.ietf.org_area_rtg_trac_wiki_RtgDir&d=DwIDaQ&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=hLt5iDJpw7ukqICc0hoT7A&m=gDChh7wheTA_cW1uNH2O1ZzaT4Ni4sju5OjDqAYKXII&s=CoXU6i3CuhDJ37j7puwilN_1e9W2p0HoSzX-veANZ2w&e=
> 
> e.g., :s/this upper bound/this upper bound on a per session basis.

I'll give this some thought, thanks.

> ---- "This
> routes that it wished were never deleted.

Well, an attacker might cause a session reset without the ability to insert data into the TCP stream I guess, e.g. with a RST attack. You are correct that there are other mitigations against such attacks, of course.

> Also this risk would be covered via

If I understand you correctly, your point is that (a) an attacker can cause a holdtime expiration by filtering BGP traffic and (b) this technique provides some mitigation of that by additionally retaining the routes for the restart time? I'm a little hesitant to claim this as a real security benefit because for an attacker to be in position to filter BGP traffic, they presumably would also be in a position to filter user traffic. Furthermore, if they can do it for the duration of the holdtime they can probably also do it for the duration of the holdtime plus the restart time. 

But security sections are an exercise in speculative thinking. 

>      appear in all capitals, as shown here.

Thanks!

> Nitpicking, naming is not consistent.

OK.

> message, its new behavior and new encoding of the Data field.

I think the point of that sentence is that RFC 4271 doesn't talk about subcodes for Cease, and now we are defining a new subcode, so in principle we need support for both 4271 and 4486 (which does define subcodes). That said, the sentence doesn't really add much and perhaps it's perfectly obvious, so even deleting it might be fine. I'll think about it.

> ---- §8 "the

Right, thanks.

--John

---

From: <[email-masked]>
Date: Wed, 18 Apr 2018 12:59:38 +0000

Hi John,

Thanks for the reply.
TL;DR: I'm all fine.

Some discussion inline below.

> From: John G. Scudder [mailto:[email-masked]]  > Sent: Tuesday, April 17, 2018 9:07 PM
> 
 > Hi Bruno,
 > 
 > > ​https://urldefense.proofpoint.com/v2/url?u=http-
 > 3A__trac.tools.ietf.org_area_rtg_trac_wiki_RtgDir&d=DwIDaQ&c=HAkYuh63rsuhr6Scbfh0UjBXe
 > MK-
 > ndb3voDTXcWzoCI&r=hLt5iDJpw7ukqICc0hoT7A&m=gDChh7wheTA_cW1uNH2O1ZzaT4Ni4sju
 > 5OjDqAYKXII&s=CoXU6i3CuhDJ37j7puwilN_1e9W2p0HoSzX-veANZ2w&e=
 > >
 > Well, an attacker might cause a session reset without the ability to insert data into the TCP stream I
 > guess, e.g. with a RST attack. You are correct that there are other mitigations against such attacks,
 > of course.
 
You are right. I had missed that.
 
 > If I understand you correctly, your point is that (a) an attacker can cause a holdtime expiration by
 > filtering BGP traffic and (b) this technique provides some mitigation of that by additionally retaining
 > the routes for the restart time? I'm a little hesitant to claim this as a real security benefit because for
 > an attacker to be in position to filter BGP traffic, they presumably would also be in a position to filter
 > user traffic. Furthermore, if they can do it for the duration of the holdtime they can probably also do
 > it for the duration of the holdtime plus the restart time.

In sync on "a)"
Regarding "b)" I actually meant the opposite: as indicated in the security section, draft-ietf-idr-bgp-gr-notification does introduce a new security consideration by adding the possibility to keep BGP routes. Plus "usual" security measures at the TCP/BGP session level does not mitigate.
But coming back to the document, the existing "security considerations" looks good to me. Sorry about my comment. (I guess that by "repeated reset" I read "active reset" (notification) and felt that "passive reset" (hold time expiration) was not raised)

I also agree with your above text. Yet, there may be other attack vectors. e.g. an attacker could also triggers an hold time expiration remotely by (D)DOSing the (BGP) control plane of the router. There may be local protection but I've also seen some local protection finally dropping legitimate control traffic, in an effort to protect the control plane CPU. But in this regards, I'm clearly experiencing the survivorship bias as I tend to only see the very few problems that have not been catched by implementations.

 > But security sections are an exercise in speculative thinking.

Yes, for the good ones.
 
 > I think the point of that sentence is that RFC 4271 doesn't talk about subcodes for Cease, and now
 > we are defining a new subcode, so in principle we need support for both 4271 and 4486 (which
 > does define subcodes). That said, the sentence doesn't really add much and perhaps it's perfectly
 > obvious, so even deleting it might be fine. I'll think about it.

Thanks for the clarification.
FWIW, I don't believe that the sentence is needed. I would personally argue that RFC 4271 defines the subcode field, and the subcode 0, for all BGP NOTIFICATIONS, including Cease. https://tools.ietf.org/html/rfc4271#section-4.5 while RFC 4486 simply defines additional subcodes.

Thanks,
Regards,
--Bruno

 > --John

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

---

From: John Scudder <[email-masked]>
Date: Wed, 18 Apr 2018 14:31:48 -0400

Hi Bruno,

I have a -16 in preparation that takes in the various nits you raised, including removal of the sentence with reference to RFC 4486 (I always like it when I can take something out and make the document better. :-) With respect to the security section I think we came to the conclusion to leave well enough alone. That leaves me with one unresolved comment:

> On Apr 17, 2018, at 3:06 PM, John G. Scudder <[email-masked]> wrote:
> 

Having done that, I'm not sure the suggested text clarifies things, although I think it was a good point to raise. I'm not sure what it would mean to run the timer on a "per session basis"? Does that mean that I only age stale routes when the session is down, and when the session is re-established the timer gets reset? If so, I think the imagined attack could indeed work -- if my attack lets the session re-establish, but then knocks it over again before it can send EoR, then the timer wouldn't ever fire. 

FWIW I think you are right that a good implementation would age routes on a per route basis. IMHO this is OK. The other alternative I can think of besides that, or the option I argue against above, is to have a per-peer stale timer that once started, is only reset if it expires or if EoR is received for the associated session (but it's not reset by session restarts). When it expires it purges all stale routes ("stale" could be a single bit flag per route, in any case the stale state has to be kept somehow already). This would bound the lifetime of stale routes to no more than the timer duration, which I suppose is the definition of an "upper bound". Possibly the text as written already implies this, although maybe that's asking too much of the reader.

For now I will leave the text as written, pending further discussion. I'll also hold back from publishing -16 pending any more input from the IETF LC or IESG.

Thanks,

--John

---

From: <[email-masked]>
Date: Thu, 19 Apr 2018 15:58:11 +0000

Hi John

Thanks for the follow up.
Please see inline [Bruno]

From: John Scudder [mailto:[email-masked]]
Sent: Wednesday, April 18, 2018 8:32 PM
To: DECRAENE Bruno IMT/OLN
Cc: [email-masked]; idr@ietf. org; [email-masked]; [email-masked]
Subject: Re: Rtgdir telechat review of draft-ietf-idr-bgp-gr-notification-15

Hi Bruno,

I have a -16 in preparation that takes in the various nits you raised, including removal of the sentence with reference to RFC 4486 (I always like it when I can take something out and make the document better. :-) With respect to the security section I think we came to the conclusion to leave well enough alone.

[Bruno] Thanks (and agreed).

That leaves me with one unresolved comment:

On Apr 17, 2018, at 3:06 PM, John G. Scudder <[email-masked]<mailto:[email-masked]>> wrote:

Having done that, I'm not sure the suggested text clarifies things, although I think it was a good point to raise. I'm not sure what it would mean to run the timer on a "per session basis"? Does that mean that I only age stale routes when the session is down, and when the session is re-established the timer gets reset?

[Bruno] That's not what I had in mind

If so, I think the imagined attack could indeed work -- if my attack lets the session re-establish, but then knocks it over again before it can send EoR, then the timer wouldn't ever fire.

[Bruno] Agreed

FWIW I think you are right that a good implementation would age routes on a per route basis. IMHO this is OK.

[Bruno] If it's ok for you, it's also ok for me. I originally felt that that was too much to track using N timers, but now I guess that there are more intelligent ways to track this using a single timer (per session)

The other alternative I can think of besides that, or the option I argue against above, is to have a per-peer stale timer that once started, is only reset if it expires or if EoR is received for the associated session (but it's not reset by session restarts).

[Bruno] That's the one I had in mind.

When it expires it purges all stale routes ("stale" could be a single bit flag per route, in any case the stale state has to be kept somehow already). This would bound the lifetime of stale routes to no more than the timer duration, which I suppose is the definition of an "upper bound".

[Bruno] That's good enough to me.
Nitpicking again, this does set an upper bound for the routes, but as an operator being asked to configure the value, I would have assumed that the configured timer value was exactly this limit and would be surprised to see the route disappear before. (although in a real conditions, I'm not sure the operator would easily track which routes had been re-advertised in a previous restart)
Again, that behavior works for me but if this is the intended behavior, it could be useful to explain it to the network operator, e.g. using your above text.

Possibly the text as written already implies this, although maybe that's asking too much of the reader.

[Bruno] My comment was that the text may be understood both ways (per route, or per session as per your latest alternative). Now does it really matter?? (except for not understanding it as per the first "per session" interpretation). I leave this to you.

In all cases, thanks for the follow up, on this level of nitpicking, at this late stage.
--Bruno

Thanks,

--John