1. Requirements for LER Forwarding of IPv4 Option Packets
(draft-dasmith-mpls-ip-options-00.txt)
IETF 72 MPLS WG – Dublin – July 28, 2008
David J. Smith
John Mullooly
Cisco Systems, Inc.
Bill Jaeger
AT&T
Tom Scholl
AT&T Labs

2. MPLS Architecture (RFC3031)
4. Edge LSR at Egress Removes Any Labels and Forwards Packet
1a. Existing Routing Protocols (e.g. OSPF, IS-IS) Establish Reachability to Destination Networks
1b. Label Distribution Protocols (e.g. LDP)
Establish Label to Destination Network (FEC) Mappings
LSR
LSR
LER
3. LSR Switches Packets Using Label Swapping
Source
LER
Destination
Prefix X
2. Ingress LER Receives IP Packet, Performs Layer 3 Value-Added Services, and “Labels” Packets

3. LER Forwarding of IPv4 Option Packets
1a. Existing Routing Protocols (e.g. OSPF, IS-IS) Establish Reachability to Destination Networks
1b. Label Distribution Protocols (e.g. LDP)
Establish Label to Destination Network (FEC) Mappings
LSR
LSR
LER
Source
LER
Destination
Prefix X
2. Ingress LER Receives IP Packet, Performs Layer 3 Value-Added Services, and “Routes” IPv4 Option Packets
3. LSR Routes IPv4 Option Packets

4. LER Forwarding of IPv4 Option Packets
Varies depending upon specific IPv4 option type
Varies amongst LER implementations*
* Not applicable to MPLS VPN LERs. IPv4 option packets within an MPLS VPN always MPLS encapsulated.

5. Security Considerations (1/2)
Crafted IP option packets that bypass MPLS encapsulation at a ingress LER may:
Allow an attacker to DoS downstream LSRs by saturating their software forwarding paths.
Exposes the MPLS network topology via traceroute.
Allow for IP TTL expiry-based DoS attacks against downstream LSRs.
Allow an attacker to bypass LSP Diff-Serv tunnels and any associated MPLS CoS field marking policies at ingress LERs and, thereby, DoS or steal high-priority traffic services within the MPLS core.
Allow an attacker to specify explicit IP forwarding path(s) across an MPLS network and, thereby, target specific LSRs with any of the DoS attacks outlined above.
Allow an attacker to build RSVP soft-states on downstream LSRs which could lead to theft of service by unauthorized parties or to a DoS condition caused by locking up LSR resources.

6. Security Considerations (2/2)
Crafted IP packets that:
Trigger imposition of Router Alert Label which could lead to a DoS condition on downstream LSRs.

7. Proposed LER Requirement (Ingress)
An ingress LER MUST implement the following policy, and the policy MUST be enabled by default:
When determining whether to push an MPLS label stack onto an IP packet, the determination is made without considering any IP options that may be carried in the IP packet header.
Further, the label values that appear in the label stack are determined without considering any such IP options.
How an ingress LER processes IP header options before MPLS encapsulation is out of scope as it is not relevant to MPLS.

8. Proposed LER Requirement (Egress)
An egress LER SHOULD only process IP options in those cases where the egress LER forwarding decision is based on the native IP packet.
When the egress LER forwarding decision is based on a popped label, the MPLS encapsulated IP header information including IP options should be ignored with the exception of the IP TTL per [RFC3443] and the Tunneled Diff-Serv information per [RFC3270].

9. Conclusion Comments are welcome
We would like this draft to be a WG draft