Hi roman! Can you please take.a look at -13? Does it address your concerns?
As Luigi mentioned, we were discussing some of the same text with Donald in the SECDIR review thread [1]. You might also want to follow up there. Thanks! Alvaro. [1] https://mailarchive.ietf.org/arch/msg/last-call/GHK4uqFcppRSSdbzvzQxQJj0p0A/ On June 2, 2022 at 7:40:50 AM, Luigi Iannone ([email protected]) wrote: Hi Roman, Thank you very much for your review. Please see my comments inline. On 1 Jun 2022, at 20:54, Roman Danyliw via Datatracker <[email protected]> wrote: Roman Danyliw has entered the following ballot position for draft-ietf-lisp-6834bis-12: Discuss When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ for more information about how to handle DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-lisp-6834bis/ ---------------------------------------------------------------------- DISCUSS: ---------------------------------------------------------------------- On the -11 document, I initial wrote the following: The SECDIR review by Donald Eastlake asked about handling roll-over/wrap-around of the Map Version Number. Specifically, can a “Map Version Number advance[e] … so quickly that an old version number is encountered that appears to be newer than or equal to the current version number. Why can't this happen? Or if it can, why doesn't that hurt?” It would appear that a number of the conclusions of the ITR or ETR on arriving packets in Section 7.1 and 7.2 wouldn’t be correct. I then saw the -12 document published on June 1 which added the following text to Section 7: Map Version Number incrementing and mappings' TTL MUST be managed so that an old version number will not be confused as a new version number. Thank you for adding this text. Practically, this identifies the desired intent, but doesn’t seem describe the mechanics. Yes, you are right. We were discussing this with Donald and Alvaro as well. Can more be said about how this confusion will be mitigated at the ITR/ETRs? I also don't follow how to use the TTLs here. In revision -13 the previous text has been changed in: Mapping updates, and their corresponding Map Version Number must be managed so that a very old version number will not be confused as a new version number (because of the circular numbering space). To this end simple measures can be taken, like updating a mapping only when all active traffic is using the latest version, or waiting sufficient time to be sure that mapping in LISP caches expire, which means waiting at least as much as the mapping Time-To-Live (as defined in <xref target="I-D.ietf-lisp-rfc6833bis"/>). Do you consider this text enough? Consider the situation that Donald noted where the Map Version advanced so quickly that it wraps around so that: (a) the new Map Version Number value equals the old Map Version Number. If one followed the guidance in Section 7.1 of: 1. The packet arrives with the same Dest Map-Version number stored in the EID-to-RLOC Database. This is the regular case. The ITR sending the packet has in its EID-to-RLOC Map-Cache an up-to-date mapping. No further actions are needed. It would seem that the ITR wouldn’t do a Map-Request and would misroute the packet based on the old mapping. That is correct. But if you operate as suggested in the new text this situation will not happen. (b) the new Map Version Number is now smaller (but in fact fresher/newer) If one followed the guidance of Section 7.1. of: 3. The packets arrive with a Dest Map-Version number smaller (i.e., older) than the one stored in the EID-to-RLOC Database. This means that the ITR sending the packet has an old mapping in its EID-to-RLOC Map-Cache containing stale information. Per bullet #3, if there was wrap-around would the ITR in fact be sending stale mapping information? This is just me overlooking previous comments. The text should be in the same form as the second bullet. In revision -13 it is now: The packet arrives with a Dest Map-Version number older (as defined in Section 6) than the one stored in the EID-to-RLOC Database. ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Thank you to Donald Eastlake for the SECDIR review. I support Paul Wouter’s DISCUSS position. IMO that DISCUSS was fixed in revision -12 already. I copy at the end of this mail my answer to Paul (I did not receive anything back from him yet). Thanks again. Please let me know if revision -13 addresses your concerns. Ciao Luigi ----------------- Hi Paul, I understand the concerns, but I think you did not read revision -12 of the document. Please see inline. On 1 Jun 2022, at 17:43, Paul Wouters via Datatracker <[email protected]> wrote: Paul Wouters has entered the following ballot position for draft-ietf-lisp-6834bis-12: Discuss When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ for more information about how to handle DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-lisp-6834bis/ ---------------------------------------------------------------------- DISCUSS: ---------------------------------------------------------------------- Changed my comments to a DISCUSS, as Donald Eastlake also pointed these out in his secdir review, and I am now convinced we need better text to address this. #1 map-version rollover is defined (to skip the 0 version) but I also see: The packet arrives with a Dest Map-Version number greater (i.e., newer) than the one stored in the EID-to-RLOC Database. Since the ETR is authoritative on the mapping, meaning that the Map- Version number of its mapping is the correct one This would imply rollover to a smaller number is not expected to occur ? The text is now: The packet arrives with a Dest Map-Version number newer (as defined in Section 6 <https://datatracker.ietf.org/doc/html/draft-ietf-lisp-6834bis-12#section-6>) than the one stored in the EID-to-RLOC Database. Since the ETR is authoritative on the mapping, meaning that the Map-Version number of its mapping is the correct one, this implies that someone is not behaving correctly with respect to the specifications. In this case, the packet carries a version number that is not valid and packet MUST be silently dropped. #2 MUST NOT or SHOULD ? Map-Versioning MUST NOT be used over the public Internet and SHOULD only be used in trusted and closed deployments. This sentence seems to contradict itself. I would turn the SHOULD into a MUST The first paragraph of Section 8 “Security Considerations” is now: This document builds on the specification and operation of the LISP control and data planes. The Security Considerations of [I-D.ietf-lisp-rfc6830bis <https://datatracker.ietf.org/doc/html/draft-ietf-lisp-6834bis-12#ref-I-D.ietf-lisp-rfc6830bis>] and [I-D.ietf-lisp-rfc6833bis <https://datatracker.ietf.org/doc/html/draft-ietf-lisp-6834bis-12#ref-I-D.ietf-lisp-rfc6833bis>] apply and, as such, Map-Versioning MUST NOT be used over the public Internet and MUST only be used in trusted and closed deployments. A thorough security analysis of LISP is documented in [RFC7835 <https://datatracker.ietf.org/doc/html/rfc7835>]. As you can see the SHOULD is already changed in a MUST. Do you consider that the above address your concerns? Ciao L.
_______________________________________________ lisp mailing list [email protected] https://www.ietf.org/mailman/listinfo/lisp
