--- 1/draft-ietf-lisp-threats-07.txt 2013-10-21 02:14:44.766950873 -0700 +++ 2/draft-ietf-lisp-threats-08.txt 2013-10-21 02:14:44.806951894 -0700 @@ -1,21 +1,21 @@ Network Working Group D. Saucez Internet-Draft INRIA Intended status: Informational L. Iannone -Expires: April 10, 2014 Telecom ParisTech +Expires: April 24, 2014 Telecom ParisTech O. Bonaventure Universite catholique de Louvain - October 07, 2013 + October 21, 2013 LISP Threats Analysis - draft-ietf-lisp-threats-07.txt + draft-ietf-lisp-threats-08.txt Abstract This document proposes a threat analysis of the Locator/Identifier Separation Protocol (LISP) if deployed in the Internet. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. @@ -23,71 +23,72 @@ Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." - This Internet-Draft will expire on April 10, 2014. + This Internet-Draft will expire on April 24, 2014. Copyright Notice Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. On-path Attackers . . . . . . . . . . . . . . . . . . . . . . 3 - 3. Off-Path Attackers: Reference Environment . . . . . . . . . . 3 + 3. Off-Path Attackers: Reference Environment . . . . . . . . . . 4 4. Attack vectors . . . . . . . . . . . . . . . . . . . . . . . 5 4.1. Configured EID-to-RLOC mappings . . . . . . . . . . . . . 5 4.2. EID-to-RLOC Cache . . . . . . . . . . . . . . . . . . . . 6 4.3. Attacks using the data-plane . . . . . . . . . . . . . . 6 - 4.3.1. Attacks not leveraging on the LISP header . . . . . . 7 + 4.3.1. Attacks not leveraging on the LISP header . . . . . . 6 4.3.2. Attacks leveraging on the LISP header . . . . . . . . 8 - 4.4. Attacks using the control-plane . . . . . . . . . . . . . 10 + 4.4. Attacks using the control-plane . . . . . . . . . . . . . 11 4.4.1. Attacks with Map-Request messages . . . . . . . . . . 11 4.4.2. Attacks with Map-Reply messages . . . . . . . . . . . 12 4.4.3. Attacks with Map-Register messages . . . . . . . . . 13 4.4.4. Attacks with Map-Notify messages . . . . . . . . . . 14 5. Attack categories . . . . . . . . . . . . . . . . . . . . . . 14 5.1. Intrusion . . . . . . . . . . . . . . . . . . . . . . . . 14 5.1.1. Description . . . . . . . . . . . . . . . . . . . . . 14 5.1.2. Vectors . . . . . . . . . . . . . . . . . . . . . . . 14 5.2. Denial of Service (DoS) . . . . . . . . . . . . . . . . . 14 5.2.1. Description . . . . . . . . . . . . . . . . . . . . . 14 - 5.2.2. Vectors . . . . . . . . . . . . . . . . . . . . . . . 14 + 5.2.2. Vectors . . . . . . . . . . . . . . . . . . . . . . . 15 5.3. Subversion . . . . . . . . . . . . . . . . . . . . . . . 15 5.3.1. Description . . . . . . . . . . . . . . . . . . . . . 15 5.3.2. Vectors . . . . . . . . . . . . . . . . . . . . . . . 15 - 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 15 - 7. Security Considerations . . . . . . . . . . . . . . . . . . . 16 - 8. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 16 - 9. References . . . . . . . . . . . . . . . . . . . . . . . . . 16 - 9.1. Normative References . . . . . . . . . . . . . . . . . . 16 - 9.2. Informative References . . . . . . . . . . . . . . . . . 17 - Appendix A. Document Change Log . . . . . . . . . . . . . . . . 18 - Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 20 + 6. Note on privacy . . . . . . . . . . . . . . . . . . . . . . . 16 + 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 16 + 8. Security Considerations . . . . . . . . . . . . . . . . . . . 16 + 9. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 17 + 10. References . . . . . . . . . . . . . . . . . . . . . . . . . 17 + 10.1. Normative References . . . . . . . . . . . . . . . . . . 17 + 10.2. Informative References . . . . . . . . . . . . . . . . . 18 + Appendix A. Document Change Log . . . . . . . . . . . . . . . . 19 + Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 21 1. Introduction The Locator/ID Separation Protocol (LISP) is defined in [RFC6830]. The present document assesses the security level and identifies security threats in the LISP specification if LISP is deployed in the Internet (i.e., a public non-trustable environment). As a result of the performed analysis, the document discusses the severity of the threats and proposes recommendations to reach the same level of security in LISP than in Internet today (e.g., without LISP). @@ -117,41 +118,43 @@ and does not discuss the difference, from a security viewpoint, between using IPv4 or IPv6. 2. On-path Attackers On-path attackers are attackers that are able to capture and modify all the packets exchanged between an Ingress Tunnel Router (ITR) and an Egress Tunnel Router (ETR). To cope with such an attacker, cryptographic techniques such as those used by IPSec ([RFC4301]) are required. As with IP, LISP relies on higher layer cryptography to - secure packet payloads from on path attacks, so we do not consider - on-path attackers in this document. + secure packet payloads from on path attacks, so this document does + not consider on-path attackers in this document. Similarly, a time-shifted attack is an attack where the attacker is temporarily on the path between two communicating hosts. While it is on-path, the attacker sends specially crafted packets or modifies packets exchanged by the communicating hosts in order to disturb the packet flow (e.g., by performing a man in the middle attack). An important issue for time-shifted attacks is the duration of the attack once the attacker has left the path between the two communicating hosts. We do not consider time-shifted attacks in this document. 3. Off-Path Attackers: Reference Environment - Throughout this document we consider the reference environment shown - in the figure below. There are two hosts attached to LISP routers: - HA and HB. HA is attached to the two LISP xTRs LR1 and LR2, which in - turn are attached to two different ISPs. HB is attached to the two - LISP xTRs LR3 and LR4. HA and HB are the EIDs of the two hosts. - LR1, LR2, LR3, and LR4 are the RLOCs of the xTRs. PxTR is a proxy - xTR and MR/MS plays the roles of Map Server and/or Map Resolver. + + The reference environment shown in the figure below is considered + throughout this document. There are two hosts attached to LISP + routers: HA and HB. HA is attached to the two LISP xTRs LR1 and LR2, + which in turn are attached to two different ISPs. HB is attached to + the two LISP xTRs LR3 and LR4. HA and HB are the EIDs of the two + hosts. LR1, LR2, LR3, and LR4 are the RLOCs of the xTRs. PxTR is a + proxy xTR and MR/MS plays the roles of Map Server and/or Map + Resolver. +-----+ | HA | +-----+ | EID: HA | ----------------- | | +-----+ +-----+ | LR1 | | LR2 | @@ -242,24 +245,24 @@ 4.2. EID-to-RLOC Cache The EID-to-RLOC Cache (also called the Map-Cache) is the data structure that stores a copy of the mappings retrieved from a remote ETR's mapping via the LISP control-plane. Attacks against this data structure could happen either when the mappings are first installed in the cache or by corrupting (poisoning) the mappings already present in the cache. - In this document we call "cache poisoning attack", any attack that - alters the EID-to-RLOC Cache. Cache poisoning attacks are use to - alter (any combination of) the following parts of mapping installed - in the EID-to-RLOC Cache: + This document calls "cache poisoning attack", any attack that alters + the EID-to-RLOC Cache. Cache poisoning attacks are use to alter (any + combination of) the following parts of mapping installed in the EID- + to-RLOC Cache: o EID prefix o RLOC list o RLOC priority o RLOC weight o RLOC reachability @@ -686,70 +689,80 @@ requirement to carry out and eavesdropping attack. Indeed the attacker might be able, for instance through an intrusion attack on a weaker system, either to duplicate or even re-direct the traffic, in both cases having access to the raw packets. 5.3.2. Vectors Subversion attacks can be mounted using o Gleaning - o Locator Status Bits o Nonce-Present and the Echo-Nonce bits o Map-Request messages o Map-Reply messages -6. IANA Considerations +6. Note on privacy + + As presented by [RFC6973], universal privacy considerations are + impossible to establish as the privacy definition may vary from one + to another. As a consequence, this document does not aim at + identifying privacy issues related to the LISP protocol but it is + necessary to highlight that security threats identified in this + document could play a role in privacy threats as defined in section 5 + of [RFC6973]. + +7. IANA Considerations + This document makes no request to IANA. -7. Security Considerations +8. Security Considerations This document is devoted to threat analysis of the Locator/Identifier Separation Protocol and is then a piece of choice to understand the security risks at stake while deploying LISP in non-trustable environment. The purpose of this document is not to provide recommendations to protect against attacks, however most of threats can be prevented with careful deployment and configuration (e.g., filter) and also by applying the general rules in security that consist in activating only features that are necessary in the deployment and verifying the validity of the information obtained from third parties. More detailed recommendation are given in [book_chapter]. The control-plane is probably the most critical part of LISP from a security viewpoint and it is worth to notice that the specifications already offer authentication mechanism for Map-Register messages ([RFC6833]) and that [I-D.ietf-lisp-sec] and [I-D.ietf-lisp-ddt] are clearly going in the direction of a secure control-plane. -8. Acknowledgments +9. Acknowledgments This document builds upon the draft of Marcelo Bagnulo ([I-D.bagnulo-lisp-threat]), where the flooding attack and the reference environment were first described. The authors would like to thank Ronald Bonica, Albert Cabellos, Noel - Chiappa, Florin Coras, Vina Ermagan, Dino Farinacci, Joel Halpern, - Emily Hiltzik, Darrel Lewis, Edward Lopez, Fabio Maino, Terry - Manderson, and Jeff Wheeler for their comments. + Chiappa, Florin Coras, Vina Ermagan, Dino Farinacci, Stephen Farrell, + Joel Halpern, Emily Hiltzik, Darrel Lewis, Edward Lopez, Fabio Maino, + Terry Manderson, and Jeff Wheeler for their comments. This work has been partially supported by the INFSO-ICT-216372 TRILOGY Project (www.trilogy-project.org). -9. References +10. References -9.1. Normative References +10.1. Normative References [RFC6169] Krishnan, S., Thaler, D., and J. Hoagland, "Security Concerns with IP Tunneling", RFC 6169, April 2011. [RFC6830] Farinacci, D., Fuller, V., Meyer, D., and D. Lewis, "The Locator/ID Separation Protocol (LISP)", RFC 6830, January 2013. [RFC6832] Lewis, D., Meyer, D., Farinacci, D., and V. Fuller, "Interworking between Locator/ID Separation Protocol @@ -763,21 +776,26 @@ Separation Protocol (LISP) Map-Versioning", RFC 6834, January 2013. [RFC6836] Fuller, V., Farinacci, D., Meyer, D., and D. Lewis, "Locator/ID Separation Protocol Alternative Logical Topology (LISP+ALT)", RFC 6836, January 2013. [RFC6837] Lear, E., "NERD: A Not-so-novel Endpoint ID (EID) to Routing Locator (RLOC) Database", RFC 6837, January 2013. -9.2. Informative References + [RFC6973] Cooper, A., Tschofenig, H., Aboba, B., Peterson, J., + Morris, J., Hansen, M., and R. Smith, "Privacy + Considerations for Internet Protocols", RFC 6973, July + 2013. + +10.2. Informative References [Chu] Jerry Chu, H., "Tuning TCP Parameters for the 21st Century ", 75th IETF, Stockholm, July 2009, . [I-D.bagnulo-lisp-threat] Bagnulo, M., "Preliminary LISP Threat Analysis", draft- bagnulo-lisp-threat-01 (work in progress), July 2007. [I-D.ietf-lisp-ddt] @@ -828,20 +846,26 @@ Future Internet, 2009. [book_chapter] Saucez, D., Iannone, L., and O. Bonaventure, "The Map-and- Encap Locator/Identifier separation paradigm: a Security Analysis ", Solutions for Sustaining Scalability in Internet Growth, IGI Global, 2013. Appendix A. Document Change Log + o Version 08 Posted October 2013. + + * Addition of a privacy consideration note. + + * Editorial changes + o Version 07 Posted October 2013. * This version is updated according to the thorough review made during October 2013 LISP WG interim meeting. * Brief recommendations put in the security consideration section. * Editorial changes