Network Working Group A. Lindem
Internet-Draft Redback Networks
Expires: April 1, 2005 A. Oswal
Cisco Systems
October 2004
OSPFv3 Destination Address Filter
draft-lindem-ospfv3-dest-filter-03.txt
Status of this Memo
This document is an Internet-Draft and is subject to all provisions
of section 3 of RFC 3667. By submitting this Internet-Draft, each
author represents that any applicable patent or other IPR claims of
which he or she is aware have been or will be disclosed, and any of
which he or she become aware will be disclosed, in accordance with
RFC 3668.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as
Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
This Internet-Draft will expire on April 1, 2005.
Copyright Notice
Copyright (C) The Internet Society (2004).
Abstract
OSPFv2 has been criticized for it vulnerability to Denial of Service
(DOS) attacks. With OSPFv3, it is a simple matter to filter on the
destination address at an implementation dependent level in order to
limit the scope of DOS attacks to directly attached routers. Unlike
hop limit checking mechanisms, it is compatible with the existing
OSPFv3 behavior. However, this level of protection will preclude the
Lindem & Oswal Expires April 1, 2005 [Page 1]
Internet-Draft OSPFv3 Destination Address Filter October 2004
deployment of virtual links in topologies where the filtering is
applied.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Proposed Solution . . . . . . . . . . . . . . . . . . . . . . 4
2.1 Virtual Links . . . . . . . . . . . . . . . . . . . . . . 4
2.2 Tunnels . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. Implementation Placement and Granularity of Filter . . . . . . 6
4. RIPng Applicability . . . . . . . . . . . . . . . . . . . . . 7
5. Compatibility . . . . . . . . . . . . . . . . . . . . . . . . 8
6. Security Considerations . . . . . . . . . . . . . . . . . . . 9
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 10
8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 11
8.1 Normative References . . . . . . . . . . . . . . . . . . . . 11
8.2 Informative References . . . . . . . . . . . . . . . . . . . 11
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 12
A. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 13
Intellectual Property and Copyright Statements . . . . . . . . 14
Lindem & Oswal Expires April 1, 2005 [Page 2]
Internet-Draft OSPFv3 Destination Address Filter October 2004
1. Introduction
OSPFv2 [OSPFv2] and OSPFv3 [OSPFv3] both have been criticised for
their vulnerability to Denial of Service attacks [VULNER]. Both
support cryptographic authentication to prevent an attacker from
being able to spoof an OSPFv2 or OSPFv3 packet ([OSPFv2] and
[AUTHv3]). However, in many cases the MD5 or IPSEC protection
actually exacerbates the attack due to the computational overhead
involved. For OSPFv3, this document proposes limiting accepted
OSPFv3 packets to those that are not routable. Doing so allows these
packets to be filtered at a low level for a relatively small
computational cost.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119].
Lindem & Oswal Expires April 1, 2005 [Page 3]
Internet-Draft OSPFv3 Destination Address Filter October 2004
2. Proposed Solution
In order to limit the vulnerability to DOS attacks to directly
attached routers, OSPFv3 packets are only accepted if the destination
address in the packet header is a link-local unicast address or
link-local scoped multicast address. Both these address types are
never forwarded more than one hop. Unlike hop limit checking
mechanisms [GTSM], this technique is fully backward compatible with
the OSPFv3 which doesn't specify that OSPFv3 packets be sent with a
hop limit of 255. The only hop limit specification is that the
link-scoped multicast packets are sent with a hop limit of 1. Hence,
this mechanism can be deployed on one OSPFv3 router at a time.
In order to make the checking simple and low cost, this document
suggests checking the first two octets of the IPv6 destination
address for a valid link local unicast or link-local scoped multicast
address. Based on the IPv6 Address Architecture [IP6ADDR], this
would equate to:
if (((first-two-octets & 0xffc0) != 0xfe80) &&
((first-two-octets & 0xff0f) != 0xff02)) {
drop the packet;
}
Alternately, an implementation may also check the multicast address
flags to assure they are 0x0 since the OSPFv3 specification
explicitly uses multicast addresses ff02::5 (AllSPFRouters) and
ff02::6 (AllDRrouters) [OSPFv3].
if (((first-two-octets & 0xffc0) != 0xfe80) &&
((first-two-octets & 0xffff) != 0xff02)) {
drop the packet;
}
2.1 Virtual Links
Virtual links make use of a global IPv6 unicast destination address.
Hence, the proposed destination address filter and virtual links are
incompatible. Depending on the granularity of the filtering, virtual
links may still be used (See Section 3.0).
2.2 Tunnels
In order to support OSPF over tunnels, e.g. GRE [GRE], it is
necessary for the destination filter to be applied after OSPF packets
are delivered to the tunnel endpoint and decapsulated. Furthermore,
the encapsulated OSPFv3 packet's destination address should be
Lindem & Oswal Expires April 1, 2005 [Page 4]
Internet-Draft OSPFv3 Destination Address Filter October 2004
AlllSPFRouters (FF02::5).
Lindem & Oswal Expires April 1, 2005 [Page 5]
Internet-Draft OSPFv3 Destination Address Filter October 2004
3. Implementation Placement and Granularity of Filter
The placement and granularity of the destination address filter is an
engineering decision that must be made for each implementation.
Obviously, the sooner it is done after packet reception the less
resource that is consumed processing packets that will be dropped.
However, since the checking has to be confined to OSPFv3 packets that
are delivered locally it may be easier to delay the checking until
the packets have been identified as such. A conveinent place in an
implementation using the BSD socket model [SOCKET] is the point at
which an inbound packet is added to the OSPFv3 socket.
The granularity of the check will limit the usage of virtual links at
the granularity which it is applied. For example, if it is applied
at the BSD socket level, virtual links may not be used by any OSPF
instance utilizing that socket. Alternately, additional
configuration and checking could be added at the socket level so that
the destination filter is only applied to certain instances, areas,
or interfaces. Implementations will need to balance their market
requirements for virtual link deployment. In any case, the use of
virtual link SHOULD be allowed either by configuration or the filter
should be automatically disabled when a virtual link is configured.
Lindem & Oswal Expires April 1, 2005 [Page 6]
Internet-Draft OSPFv3 Destination Address Filter October 2004
4. RIPng Applicability
The destination filter described herein is also applicable to RIPng
[RIPNG]. The filter simply needs to be applied to UDP port 521. In
RIPng there is no concept of a virtual link and no requirement to
send to IPv6 global addresses.
Lindem & Oswal Expires April 1, 2005 [Page 7]
Internet-Draft OSPFv3 Destination Address Filter October 2004
5. Compatibility
All mechanisms described in this document are backward-compatible
with standard OSPFv3 implementations [OSPFv3].
Lindem & Oswal Expires April 1, 2005 [Page 8]
Internet-Draft OSPFv3 Destination Address Filter October 2004
6. Security Considerations
This document recommends a mechanism that can be used to limit OSPFv3
Denial of Service (DOS) attacks to directly attached networks.
Hence, the entire document deals with security.
Lindem & Oswal Expires April 1, 2005 [Page 9]
Internet-Draft OSPFv3 Destination Address Filter October 2004
7. IANA Considerations
This document does not require any IANA assignments or action.
Lindem & Oswal Expires April 1, 2005 [Page 10]
Internet-Draft OSPFv3 Destination Address Filter October 2004
8. References
8.1 Normative References
[IP6ADDR] Hinden, R. and S. Deering, "IP Version 6 Addressing
Architecture", RFC 3513, April 2003.
[OSPFv2] Moy, J., "OSPF Version 2", RFC 2328, April 1998.
[OSPFv3] Moy, J., Ferguson, D. and R. Colton, "OSPF for IPv6", RFC
2740, December 1999.
[RFC2119] Bradner, S., "Key words for use in RFC's to Indicate
Requirement Levels", RFC 2328, March 1977.
[RIPng] Malkin, G. and R. Minnear, "RIPng for IPv6", RFC 2080,
January 1997.
[SOCKET] Gilligan, B., Thomson, S., Bound, J. and J. McCann, "Basic
Socket Interface Extensions for IPv6", RFC 3493, February
2003.
8.2 Informative References
[AUTHv3] Gupta, M. and N. Melam, "Authentication/Confidentiality for
OSPFv3", draft-ietf-ospf-ospfv3-auth-04.txt (work in
progress).
[GRE] Farinacci, D., Li, T., Hanks, S., Meyer, D. and P. Traina,
"Generic Routing Encapsulation (GRE)", RFC 2784, March
2000.
[GTSM] Gill, V., Heasley, J. and D. Meyer, "The Generalized TTL
Security Mechanism (GTSM)",
draft-ietf-rtgwg-rfc3682bis-02.txt (work in progress).
[VULNER] Jones, E. and O. Le Moigne, "OSPF Security Vulnerabilities
Analysis", draft-ietf-rpsec-ospf-vuln-00.txt (work in
progress).
Lindem & Oswal Expires April 1, 2005 [Page 11]
Internet-Draft OSPFv3 Destination Address Filter October 2004
Authors' Addresses
Acee Lindem
Redback Networks
102 Carric Bend Court
Cary, NC 27519
USA
EMail: acee@redback.com
Anand Oswal
Cisco Systems
225 West Tasman Drive
San Jose, CA 95134
USA
EMail: sina@cisco.com
Lindem & Oswal Expires April 1, 2005 [Page 12]
Internet-Draft OSPFv3 Destination Address Filter October 2004
Appendix A. Acknowledgments
The authors wish to acknowledge Mukesh Gupta, Venkata Naidu, Enke
Chen, and George Apostolopoulos for their review and comments.
The RFC text was produced using Marshall Rose's xml2rfc tool.
Lindem & Oswal Expires April 1, 2005 [Page 13]
Internet-Draft OSPFv3 Destination Address Filter October 2004
Intellectual Property Statement
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Disclaimer of Validity
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Copyright Statement
Copyright (C) The Internet Society (2004). This document is subject
to the rights, licenses and restrictions contained in BCP 78, and
except as set forth therein, the authors retain all their rights.
Acknowledgment
Funding for the RFC Editor function is currently provided by the
Internet Society.
Lindem & Oswal Expires April 1, 2005 [Page 14]