Subject: [secdir] Issue with PCEP

From: Julien Meuric <[email-masked]>
Date: Wed, 13 Jul 2011 17:04:19 +0200

Dear Security Directorate,

In the PCE WG, an issue had been reported by several implementers of 
PCEP, the "Path Computation Element communication Protocol" specified in 
RFC 5440 (cf. the thread on 
http://www.ietf.org/mail-archive/web/pce/current/msg02426.html or 
http://tools.ietf.org/agenda/80/slides/pce-0.pdf).

This issue is related to the fact that the TCP source port of a PCEP 
session is fixed. To summarize, some operating systems (including Linux) 
are not that flexible when it comes to assigning a fixed source port.

A reasonable solution to this issue is to remove that restriction on the 
source port of a PCEP session. It is backward compatible with current 
RFC 5440 and has been agreed with the Tranport Area ADs.

 From a security perspective, do you issue any blocking issue in moving 
forward with this solution?

Thank you,

Julien, PCE co-chair

---

From: Brian Weis <[email-masked]>
Date: Mon, 18 Jul 2011 14:10:56 -0700

Hi Julien,

It's not clear to me that there would be any security issue with relaxing this restriction. A PCE application should be concerned with accepting only PCE sessions from authorized peers, and should apply integrity protection to the segments to ensure that only segments from those peers are accepted, but restricting the source port number for the TCP segments received from authorized peers doesn't seem particularly valuable to me.

Hope that helps,
Brian

On Jul 13, 2011, at 8:04 AM, Julien Meuric wrote:

> In the PCE WG, an issue had been reported by several implementers of PCEP, the "Path Computation Element communication Protocol" specified in RFC 5440 (cf. the thread on http://www.ietf.org/mail-archive/web/pce/current/msg02426.html or http://tools.ietf.org/agenda/80/slides/pce-0.pdf).
> 
> This issue is related to the fact that the TCP source port of a PCEP session is fixed. To summarize, some operating systems (including Linux) are not that flexible when it comes to assigning a fixed source port.
> 
> A reasonable solution to this issue is to remove that restriction on the source port of a PCEP session. It is backward compatible with current RFC 5440 and has been agreed with the Tranport Area ADs.
> 
> From a security perspective, do you issue any blocking issue in moving forward with this solution?
> 
> Thank you,
> 
> Julien, PCE co-chair
> 
> _______________________________________________
> secdir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/secdir

-- 
Brian Weis
Security Standards and Technology, SRTG, Cisco Systems
Telephone: +1 408 526 4796
Email: [email-masked]

---

From: Julien Meuric <[email-masked]>
Date: Tue, 19 Jul 2011 10:43:17 +0200

Hi Brian.

At this stage, we do not look for a deeper security analysis. Your 
answer is actually helpful, so thank you for your valuable feedback.

Cheers,

Julien