RFC 5294

Host Threats to Protocol Independent Multicast (PIM) ✨

Okay, so the header on this one is giving 💖. It's RFC 5294, filed under the Network Working Group, and it's Informational, which means it's sharing info with the Internet community and isn't setting a standard 🎀. It's dated August 2008. The authors are P. Savola (CSC/FUNET) and J. Lingard (Arastra). The header doesn't list anything it obsoletes or updates 🌸.

Status of This Memo

This memo is informational, bestie. It's for the Internet community, and it does not specify an Internet standard of any kind 🧚. Distribution is unlimited, so share it with everyone 🌈.

Abstract

This memo adds to the list of multicast infrastructure security threat analysis documents. It goes through Protocol Independent Multicast (PIM) threats that are specific to router interfaces connecting hosts 🦋.

Table of Contents 📑

1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  2
2.  Host-Interface PIM Vulnerabilities . . . . . . . . . . . . . .  2
  2.1.  Nodes May Send Illegitimate PIM Register Messages  . . . .  3
  2.2.  Nodes May Become Illegitimate PIM Neighbors  . . . . . . .  3
  2.3.  Routers May Accept PIM Messages from Non-Neighbors . . . .  3
  2.4.  An Illegitimate Node May Be Elected as the PIM DR or DF  .  3
    2.4.1.  PIM-SM Designated Router Election  . . . . . . . . . .  3
    2.4.2.  BIDIR-PIM Designated Forwarder Election  . . . . . . .  4
  2.5.  A Node May Become an Illegitimate PIM Asserted
        Forwarder  . . . . . . . . . . . . . . . . . . . . . . . .  4
  2.6.  BIDIR-PIM Does Not Use RPF Check . . . . . . . . . . . . .  4
3.  On-Link Threats  . . . . . . . . . . . . . . . . . . . . . . .  5
  3.1.  Denial-of-Service Attack on the Link . . . . . . . . . . .  5
  3.2.  Denial-of-Service Attack on the Outside  . . . . . . . . .  6
  3.3.  Confidentiality, Integrity, or Authorization Violations  .  6
4.  Mitigation Methods . . . . . . . . . . . . . . . . . . . . . .  7
  4.1.  Passive Mode for PIM . . . . . . . . . . . . . . . . . . .  7
  4.2.  Use of IPsec among PIM Routers . . . . . . . . . . . . . .  7
  4.3.  IP Filtering PIM Messages  . . . . . . . . . . . . . . . .  8
  4.4.  Summary of Vulnerabilities and Mitigation Methods  . . . .  8
5.  Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 10
6.  Security Considerations  . . . . . . . . . . . . . . . . . . . 10
7.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 10
  7.1.  Normative References . . . . . . . . . . . . . . . . . . . 10
  7.2.  Informative References . . . . . . . . . . . . . . . . . . 10

1. Introduction 🌸

Okay so there's been some analysis of security threats to multicast routing infrastructures [RFC4609]. There's also been work on putting confidentiality, integrity, and authorization into the multicast payload [RFC3740], and some analysis of security threats in Internet Group Management Protocol/Multicast Listener Discovery (IGMP/MLD) [DALEY-MAGMA]. But nobody has done a comprehensive analysis of security threats to PIM on host-connecting (typically "Local Area Network") links 👀.

So we define these PIM host threats to include:

• Nodes using PIM to attack or deny service to hosts on the same link,
• Nodes using PIM to attack or deny service to valid multicast routers on the link, or
• Nodes using PIM (Register messages) to bypass the controls of multicast routers on the link.

The attacking node is typically a host or a host acting as an illegitimate router 😈.

A node that originates multicast data can disturb existing receivers of the group on the same link. But this issue isn't PIM-specific, so it's out of scope 🙅‍♀️. Subverting legitimate routers is also out of scope. The security implications for multicast routing infrastructure are described in [RFC4609] 💅.

This document analyzes the PIM host-interface vulnerabilities, comes up with a few specific threats, proposes some potential ways to mitigate these problems, and checks how well those methods actually fix the issues 🔥.

It's assumed you already know the basic concepts of PIM 🧠.

Analysis of PIM-DM [RFC3973] is out of scope for this document 🙃.

2. Host-Interface PIM Vulnerabilities 🎀

This section quickly covers the main attacks against host-interface PIM signaling. The actual threats and mitigation methods come in the next sections ✨.

The attacking node may be either a malicious host or an illegitimate router 🦹‍♀️.

2.1. Nodes May Send Illegitimate PIM Register Messages 💌

PIM Register messages are sent unicast, and they contain encapsulated multicast data packets. Malicious hosts or routers could also send Register messages themselves, for example to get around rate-limits or to interfere with foreign Rendezvous Points (RPs), as described in [RFC4609] 😤.

The Register message can be targeted at any IP address, whether it's in or out of the local PIM domain. The source address may be spoofed, unless spoofing has been prevented [RFC3704], so the attacker can create arbitrary state at the RPs 🫣.

2.2. Nodes May Become Illegitimate PIM Neighbors 🚪

When PIM has been enabled on a router's host interface, any node can become a PIM neighbor by using PIM Hello messages. Once it's a PIM neighbor this way, the node can send other PIM messages to the router and may use those messages to attack the router 💀.

2.3. Routers May Accept PIM Messages from Non-Neighbors 🙈

The PIM-SM (Sparse Mode) specification recommends that PIM messages other than Hellos should not be accepted, except from valid PIM neighbors. The Bidirectional-PIM (BIDIR-PIM) specification says that packets from non-neighbors "SHOULD NOT" be accepted; see Section 5.2 of [RFC5015]. However, the specification doesn't mandate this, so some implementations may be susceptible to attack from PIM messages sent by non-neighbors 🥺.

2.4. An Illegitimate Node May Be Elected as the PIM DR or DF 👑

2.4.1. PIM-SM Designated Router Election 🗳️

In PIM-SM, the Designated Router (DR) on a Local Area Network (LAN) is responsible for Register-encapsulating data from new sources on the LAN. It also generates PIM Join/Prune messages on behalf of group members on the LAN 📦.

A node that can become a PIM neighbor can also make itself elected DR, whether or not the DR Priority option is being used in PIM Hello messages on the LAN 😭.

2.4.2. BIDIR-PIM Designated Forwarder Election 🦋

In BIDIR-PIM [RFC5015], a Designated Forwarder (DF) is elected per link. The DF is responsible for forwarding data downstream onto the link, and also for forwarding data from its link upstream 🍓.

A node that can become a BIDIR-PIM neighbor can make itself elected DF by sending DF Offer messages with a better metric than its neighbors. This is just like becoming a PIM neighbor, except that the PIM Hello messages must include the Bidirectional Capable PIM-Hello option 🫠.

There are also some other BIDIR-PIM attacks related to DF election. These include spoofing DF Offer and DF Winner messages (for example, using a legitimate router's IP address), which makes everyone except the impersonated router believe that router is the DF. An attacker might also stop the DF election from converging by sending an infinite sequence of DF Offer messages 🌀.

For further discussion of BIDIR-PIM threats, check out the Security Considerations section in [RFC5015] 📚.

2.5. A Node May Become an Illegitimate PIM Asserted Forwarder 🎭

With a PIM Assert message, a router can be elected to be in charge of forwarding all traffic for a particular (S,G) or (*,G) onto the LAN. This overrides DR behavior 🙀.

The specification says Assert messages should only be accepted from known PIM neighbors, and "SHOULD" be discarded otherwise. So the node either has to be able to spoof the IP address of a current neighbor, form a PIM adjacency first, or count on these checks being disabled 🕵️‍♀️.

The Assert Timer is 3 minutes by default. The state must be refreshed, or it'll be removed automatically ⏳.

As noted before, it's also possible to spoof an Assert (for example, using a legitimate router's IP address) to cause a temporary disruption on the LAN 🌪️.

2.6. BIDIR-PIM Does Not Use RPF Check 🙅‍♀️

PIM protocols don't perform a Reverse Path Forwarding (RPF) check on the shared tree (for example, in PIM-SM, from the RP to local receivers). On the other hand, an RPF check is performed on stub host interfaces, for example. Because all forwarding in BIDIR-PIM is based on the shared tree principle, it doesn't use an RPF check to verify that forwarded packets are arriving from a "topologically correct" direction. This has two immediately obvious implications 🤯:

1. A node may maintain a forwarding loop until the Time to Live (TTL) runs out by passing packets from interface A to B. This isn't believed to cause significant new risk, because with a similar ease, such a node could generate original packets that would loop back to its other interface 🔁.
2. A node may spoof source IP addresses in multicast packets it sends. Other PIM protocols drop such packets when performing the RPF check, but BIDIR-PIM accepts them. That allows easier Denial-of-Service (DoS) attacks on the multicast delivery tree and makes the attacker less traceable 🕶️.

3.2. Denial-of-Service Attack on the Outside 💥

okay so DoS attacks can also hit nodes beyond the link, especially in setups where a multicast router and/or a DR is treated as a trusted node 🫶 that's a whole vibe, and not the good kind 😭

In particular, if DRs do some form of rate-limiting (for example, on new Join/Prune messages), then becoming a DR and sending those messages yourself lets you subvert those restrictions 🙈 so rate-limiting functions need to be deployed at multiple layers, as described in [RFC4609]. 🔒

In addition, any host can send PIM Register messages on their own, to whichever RP it wants 💅 and if unicast RPF (Reverse Path Forwarding) mechanisms [RFC3704] haven't been applied, the packet may be spoofed 👀 this can be done to get around rate-limits, and/or to attack remote RPs, and/or to interfere with the integrity of an ASM group. this attack is also described in [RFC4609] 🦋

also, BIDIR-PIM doesn't stop nodes from using topologically incorrect addresses (source address spoofing), which makes this kind of attack way harder to trace 🕵️‍♀️

3.3. Confidentiality, Integrity, or Authorization Violations 🎀

ok this is the part where things get spicy 🌶️ contrary to unicast, any node can legitimately receive all multicast transmissions on the link by just adjusting the appropriate link-layer multicast filters. so if you need confidentiality, it has to come from cryptography 🔐

if a node can become a DR, it can violate the integrity of any data streams sent by sources on the LAN, by modifying (possibly in subtle, unnoticeable ways) the packets before they get Register-encapsulated 😱

if a node can form a PIM neighbor adjacency or spoof the IP address of a current neighbor, and it has external connectivity some other way (other than the LAN), then it can violate the integrity of any data streams sent by external sources onto the LAN 🫠 it would do this by sending an appropriate Assert message onto the LAN, to stop the genuine PIM routers from forwarding the valid data. then it grabs the multicast traffic through its other connection, modifies those data packets, and forwards them onto the LAN 💀

in either of the two cases above, the node could act totally normal for some traffic while violating integrity for other traffic 🥸 very sneaky, very not it.

a more elaborate attack targets authorization ✨ there are some very questionable models [HAYASHI] where the current multicast architecture is used to provide paid multicast service, and where authorization/authentication gets added to group management protocols like IGMP. needless to say, if a host could act as a router, all kinds of attacks become possible: subscribing to multicast service without using IGMP (so you don't have to pay for it), denying the service to everyone else on the same link, and more 😤 in short, if you want to really ensure authorization, a better architecture should be used instead (e.g., [RFC3740]). 🔑

4. Mitigation Methods 🛡️

this section lists some ways to mitigate the vulnerabilities and threats from the previous sections 💖

4.1. Passive Mode for PIM 🌙

the current PIM specification seems to mandate running the PIM Hello protocol on all PIM-enabled interfaces 🙄 and most implementations require PIM to be enabled on an interface before they'll send PIM Register messages for data from sources on that interface, or do any other PIM processing at all.

as described in [RFC4609], running full PIM (Hello messages and all) is unnecessary for stub networks where only one router is providing multicast service 🧚 so implementations should provide an option to mark the interface as "passive" with regard to PIM. in passive mode, no PIM packets get sent or processed (if received), but hosts can still send and receive multicast on that interface 🍓

4.2. Use of IPsec among PIM Routers 🔐

instead of passive mode, or when multiple PIM routers exist on a single link, you could also use IPsec to secure the PIM messaging, so nobody can subvert it 💜 the actual procedures are described in [RFC4601] and [LINKLOCAL].

however, setting up IPsec Security Associations (SAs) manually can be a seriously tedious process 😩 the routers might not even support IPsec, and automatic key negotiation may not be feasible in these scenarios either. a Group Domain of Interpretation (GDOI) [RFC3547] server might be able to help with this negotiation ✨

4.3. IP Filtering PIM Messages 🚧

to eliminate both unicast and multicast PIM messages, in similar scenarios to the ones where PIM passive mode applies, it might be possible to block IP protocol 103 (all PIM messages) in an input access list 🙌 this is more effective than PIM passive mode, because it also blocks Register messages.

this is also acceptable when there's more than one PIM router on the link, if IPsec is used (because the access-list processing sees the valid PIM messages as IPsec AH/ESP packets). in that case, unicast Register messages must also be protected with IPsec, or the routing topology must be such that the link is never used to originate or transit unicast Register messages 🫶

when multiple routers exist on a link, IPsec isn't required if you can stop hosts from sending PIM messages at the Ethernet switch (or equivalent) host ports 🌸 there are at least two ways to do this:

1. use IP access lists on the stub routers to allow PIM messages from the valid neighbor IP addresses only, and implement IP spoofing prevention at the Ethernet-switch-port level using proprietary mechanisms, or
2. filter out all PIM messages at configured host ports on Ethernet switches, instead of doing it on the routers.

the main benefit of this approach is that multiple stub routers can still talk through the LAN without IPsec, but hosts can't disturb the PIM protocol 🎉 the drawback is that Ethernet switches need to implement much finer-grained IP layer filtering, and carefully maintaining those filters could be a significant operational headache 😮‍💨

4.4. Summary of Vulnerabilities and Mitigation Methods 📋

this section sums up the vulnerabilities and how well the mitigation methods handle them 💅

Summary of vulnerabilities and mitigations:

  +-----+---------------------+-----------------+-----------------+
  | Sec | Vulnerability       | One stub router | >1 stub routers |
  |     |                     | PASV|IPsec|Filt | PASV|IPsec|Filt |
  +-----+---------------------+-----+-----+-----+-----+-----+-----+
  | 2.1 | Hosts Registering   |  N  | N+  |  Y  |  N  | N+  | Ysw |
  +-----+---------------------+-----+-----+-----+-----+-----+-----+
  | 2.2 | Invalid Neighbor    |  Y  |  Y  |  Y  |  *  |  Y  | Ysw |
  +-----+---------------------+-----+-----+-----+-----+-----+-----+
  | 2.3 | Adjacency Not Reqd  |  Y  |  Y  |  Y  |  *  |  Y  | Ysw |
  +-----+---------------------+-----+-----+-----+-----+-----+-----+
  | 2.4 | Invalid DR /DF      |  Y  |  Y  |  Y  |  *  |  Y  | Ysw |
  +-----+---------------------+-----+-----+-----+-----+-----+-----+
  | 2.5 | Invalid Forwarder   |  Y  |  Y  |  Y  |  *  |  Y  | Ysw |
  +-----+---------------------+-----+-----+-----+-----+-----+-----+
  | 2.6 | No RPF Check (BIDIR)|  x  |  x  |  x  |  x  |  x  |  x  |
  +-----+---------------------+-----+-----+-----+-----+-----+-----+

                               Figure 1

"*" means Yes if IPsec is used in addition; No otherwise.

"Ysw" means Yes if IPsec is used in addition or IP filtering is done on Ethernet switches on all host ports; No otherwise.

"N+" means that the use of IPsec between the on-link routers does not protect from this; IPsec would have to be used at RPs.

"x" means that, with BIDIR-PIM, IP access lists or RPF mechanisms need to be applied in stub interfaces to prevent originating packets with topologically incorrect source addresses. this needs to be done in addition to any other chosen approach.

to sum it all up 🎀 IP protocol filtering for all PIM messages looks like the most complete solution when paired with IPsec between the real stub routers (if there's more than one of them). however, IPsec isn't required if PIM message filtering or a certain kind of IP spoofing prevention is applied on all the host ports on Ethernet switches. if hosts performing registering isn't considered a serious problem, IP protocol filtering and passive-mode PIM seem to be equivalent approaches 🤷‍♀️ and if BIDIR-PIM is used, ingress filtering needs to be applied in stub interfaces to multicast packets as well as unicast, so hosts can't use wrong source addresses 🌈

5. Acknowledgements 🫶

Greg Daley and Gopi Durup wrote an excellent analysis of MLD security issues [DALEY-MAGMA], which inspired the exploration of the on-link PIM threats problem space 👑

Ayan Roy-Chowdhury, Beau Williamson, Bharat Joshi, Dino Farinacci, John Zwiebel, Stig Venaas, Yiqun Cai, and Eric Gray gave good feedback on this memo 💖

6. Security Considerations 🚨

this memo analyzes the threats to the PIM multicast routing protocol on host interfaces, and proposes some possible mitigation techniques 😤 this is the stuff that keeps the Internet's multicast safe, so take it seriously, bestie 💀

7. References 📚

7.1. Normative References

• [RFC4601] Fenner, B., Handley, M., Holbrook, H., and I. Kouvelas, "Protocol Independent Multicast - Sparse Mode (PIM-SM): Protocol Specification (Revised)", RFC 4601, August 2006.
• [RFC4609] Savola, P., Lehtonen, R., and D. Meyer, "Protocol Independent Multicast - Sparse Mode (PIM-SM) Multicast Routing Security Issues and Enhancements", RFC 4609, October 2006.
• [RFC5015] Handley, M., Kouvelas, I., Speakman, T., and L. Vicisano, "Bidirectional Protocol Independent Multicast (BIDIR-PIM)", RFC 5015, October 2007.

7.2. Informative References

• [DALEY-MAGMA] Daley, G. and J. Combes, "Securing Neighbour Discovery Proxy Problem Statement", Work in Progress, February 2008.
• [HAYASHI] Hayashi, T., "Internet Group membership Authentication Protocol (IGAP)", Work in Progress, August 2003.
• [LINKLOCAL] Atwood, J., Islam, S., and M. Siami, "Authentication and Confidentiality in PIM-SM Link-local Messages", Work in Progress, February 2008.
• [RFC3547] Baugher, M., Weis, B., Hardjono, T., and H. Harney, "The Group Domain of Interpretation", RFC 3547, July 2003.
• [RFC3704] Baker, F. and P. Savola, "Ingress Filtering for Multihomed Networks", BCP 84, RFC 3704, March 2004.
• [RFC3740] Hardjono, T. and B. Weis, "The Multicast Group Security Architecture", RFC 3740, March 2004.
• [RFC3973] Adams, A., Nicholas, J., and W. Siadak, "Protocol Independent Multicast - Dense Mode (PIM-DM): Protocol Specification (Revised)", RFC 3973, January 2005.

Authors' Addresses 🦋

Pekka Savola
CSC - Scientific Computing Ltd.
Espoo
Finland

EMail: psavola@funet.fi


James Lingard
Arastra, Inc.
P.O. Box 10905
Palo Alto, CA  94303
USA

EMail: jchl@arastra.com

Full Copyright Statement ✨

okay so this part is the legal fine print at the bottom, but it still matters, bestie 💅 The IETF Trust owns the copyright (2008 💖), and this document is subject to the rights, licenses and restrictions in BCP 78. Except for what BCP 78 says, the authors keep all their rights 🎀

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

ngl that's a lot of caps energy 😭 but it basically means nobody is promising this doc is perfect or that using it won't step on anyone's rights or that it works for any specific purpose. Read it as a disclaimer, not a vibe check 🙈

---

Intellectual Property 💖

The IETF doesn't take a side on whether any Intellectual Property Rights (or other rights) might cover the tech described here, or whether you could get a license for it. It also hasn't done its own digging to find out. If you want the rules on RFC documents and rights, check out BCP 78 and BCP 79 🦋

Copies of IPR disclosures sent to the IETF Secretariat live in the IETF online IPR repository at http://www.ietf.org/ipr. That's also where you'd find any assurances of licenses, or the results of someone trying to get a general license or permission to use proprietary rights, for people implementing or using this spec ✨

And if you know about any copyrights, patents, patent applications or other proprietary rights that might cover tech needed to implement this standard, the IETF wants to hear about it! Send it to ietf-ipr@ietf.org 🫶

that's the whole doc, babe 🌈👑