Re: CISCO 0-day exploits

[Ahmed Borno <amaged () gmail com>]

Being realistic, as you mentioned, these vendors do not have the right
incentive.

Thats one thing that operators can do and maybe it should be a recurring
theme at NANOG, calling out vendors to put some sanity and logic into how
iACLs and CoPP are handled. They can do a lot if they cared to spend some $
on being creative, maybe a BoF for this specific topic.

Creativity in the form of ways to avoid the fragile stacks and L3 packet of
death, They can even separate the Mgmt plane from the Control plane if they
are serious about it, they can enforce iACL on Mgmt interfaces, they can
have logic to validate packets before they are processed, and to be fair,
this needs to happen in the existing install base too, not only the new
ones. I am trying to say that if they cant hire skilled programmers then
they should show innovation around the most vulnerable part of their
code...the trusting nature of protocols.

P.S: How many junior network engineers care to turn on authentication on L2
segments.

~A

On Tue, Feb 11, 2020 at 6:24 AM Saku Ytti <saku () ytti fi> wrote:

> On Tue, 11 Feb 2020 at 16:09, Ahmed Borno <amaged () gmail com> wrote:
>
> > Sorry for the sad tone, i just wish network operators would find a way
> to challenge these vendors and call their less than optimal quality.
>
> It's hard, TINA. We can talk about white label, but in the end of the
> day, that box is just as proprietary as rest of them, because you
> can't buy BRCM and make it open. It's like 90s of Linux, GPUs and NICs
> were not supported, because vendors thought the specs were their
> secret sauce.
> When some vendor finally releases full specs on github including P4
> compiler target for their chip and will sell chip on their web for 1
> unit at x USD, we may start to see some real progress, we can start
> building open source NOS with data-planes.
>
> Maybe INTC could start the revolution with Tofino. Ship PCI cards with
> Tofino and few 100GE ports (local switching support) and open it up
> entirely. Maybe JNPR could ship Trio PCI cards, why not, it's not like
> they have lot to lose, considering terrible market performance.
>
>
> --
>   ++ytti