[Anima-signaling] 2 day last call on SONN constrained instance

[Brian E Carpenter <[e-mail]>]

Hi,

We need to move ahead with the GRASP draft. Therefore, I have reworked the
text in a way that doesn't remove the SONN description but does not make
it a requirement either. Please comment on the new version of the whole
section that follows. I'm going to take silence as consent 48 hours from now.

Regards
   Brian

3.5.2.  Constrained Instances

   This section describes some examples of cases where additional
   instances of GRASP subject to certain constraints are appropriate.

3.5.2.1.  No ACP

   As mentioned in Section 3.3, some GRASP operations might be performed
   across an administrative domain boundary by mutual agreement, without
   the benefit of an ACP.  Such operations MUST be confined to a
   separate instance of GRASP with its own copy of all GRASP data
   structures.  Messages MUST be authenticated and SHOULD be encrypted.
   TLS [RFC5246] and DTLS [RFC6347] based on a Public Key Infrastructure
   (PKI) [RFC5280] are RECOMMENDED for this purpose.  Further details
   are out of scope for this document.

3.5.2.2.  Discovery Unsolicited Link-Local

   Some services may need to use insecure GRASP discovery, response and
   flood messages without being able to use pre-existing security
   associations.  Such operations being intrinsically insecure, they
   need to be confined to link-local use to minimise the risk of
   malicious actions.  Possible examples include discovery of candidate
   ACP neighbors [I-D.ietf-anima-autonomic-control-plane], discovery of
   bootstrap proxies [I-D.ietf-anima-bootstrapping-keyinfra] or perhaps
   initialisation services in networks using GRASP without being fully
   autonomic (e.g., no ACP).  Such usage MUST be limited to link-local
   operations and MUST be confined to a separate insecure instance of
   GRASP with its own copy of all GRASP data structures.  This instance
   is nicknamed DULL - Discovery Unsolicited Link-Local.

   The detailed rules for the DULL instance of GRASP are as follows:

   o  An initiator MUST only send Discovery or Flood Synchronization
      link-local multicast messages with a loop count of 1.  A responder
      SHOULD NOT send a Discovery Response message unless it cannot be
      avoided.  Other GRASP message types MUST NOT be sent.

   o  A responder MUST silently discard any message whose loop count is
      not 1.

   o  A responder MUST silently discard any message referring to a GRASP
      Objective that is not directly part of a service that requires
      this insecure mode.

   o  A responder MUST NOT relay any multicast messages.

   o  A Discovery Response MUST indicate a link-local address.

   o  A Discovery Response MUST NOT include a Divert option.

   o  A node MUST silently discard any message whose source address is
      not link-local.

   GRASP traffic SHOULD be minimized by using only Flood Synchronization
   to announce objectives and their associated locators, rather than by
   using Discovery and Response.  Further details are out of scope for
   this document

3.5.2.3.  Secure Only Neighbor Negotiation

   Some services might use insecure on-link operations as in DULL, but
   also use unicast synchronization or negotiation operations protected
   by TLS.  A separate instance of GRASP is used, with its own copy of
   all GRASP data structures.  This instance is nicknamed SONN - Secure
   Only Neighbor Negotiation.

   The detailed rules for the SONN instance of GRASP are as follows:

   o  Any type of GRASP message MAY be sent.

   o  An initiator MUST send any Discovery or Flood Synchronization
      link-local multicast messages with a loop count of 1.

   o  A responder MUST silently discard any Discovery or Flood
      Synchronization message whose loop count is not 1.

   o  A responder MUST silently discard any message referring to a GRASP
      Objective that is not directly part of the service concerned.

   o  A responder MUST NOT relay any multicast messages.

   o  A Discovery Response MUST indicate a link-local address.

   o  A Discovery Response MUST NOT include a Divert option.

   o  A node MUST silently discard any message whose source address is
      not link-local.

   Further details, including TLS and PKI usage, are out of scope for
   this document.

--