Hi Kathleen, DISCUSS: > ---------------------------------------------------------------------- > > This should be pretty easy to address. In the security consideration > section, the following recommendation appears: > > o SBFDReflector MUST NOT look at the crypto sequence number before > accepting the packet. > > Could you please add text to say what happens (what attacks are possible) > if this is looked at? There is nothing to stop the crypt sequence number > from being looked at, right? Is there a way to actually prevent that? > > SBFD is state-less. The SBFDReflector is NOT maintaining any BFD peer state, and is thus incapable of doing the crypto-sequence checks. It has no idea of last sequence number that it had seen from a BFD peer, and hence CANNOT compare the new sequence number. Its for this reason that we mandate that the reflectors MUST NOT look at the sequence numbers.
We cant prevent a peer from looking at the sequence number -- thats an implementation specific issue. The implementation is violating the standard. Not sure what we can do to prevent that. Does this help? Cheers, Manav
