IETF Logo Mail Archive

Re: [Anima-signaling] GRASP issue 52: Insecure instance text

Toerless Eckert <eckert@cisco.com> Mon, 01 August 2016 09:29 UTC

Return-Path: <eckert@cisco.com>
X-Original-To: anima-signaling@ietfa.amsl.com
Delivered-To: anima-signaling@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D5BF12D5BF for <anima-signaling@ietfa.amsl.com>; Mon, 1 Aug 2016 02:29:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -15.808
X-Spam-Level:
X-Spam-Status: No, score=-15.808 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.287, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8KJsxX4f_d44 for <anima-signaling@ietfa.amsl.com>; Mon, 1 Aug 2016 02:29:10 -0700 (PDT)
Received: from alln-iport-6.cisco.com (alln-iport-6.cisco.com [173.37.142.93]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E32C112B049 for <anima-signaling@ietf.org>; Mon, 1 Aug 2016 02:29:09 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1704; q=dns/txt; s=iport; t=1470043749; x=1471253349; h=date:from:to:cc:subject:message-id:references: mime-version:in-reply-to; bh=BDpauNAhUFP1Awg/O/y0wmiFYMy/sdZ9bpuwNpD/tf0=; b=WO1gnM+TwMDXfp9AawHDUnhny41ffUa9esvIuupVV3HBnWZrbaLNr236 4qotrLtfW1fXmFRneiESCivD0lMzt+TS/NW0b6TmD8KflI1J4cJ9Pk78D wz5EyMBy683NUKcN95nKxfVYPsEEgpGJpZTLLypQpSdvieamJkEHYIKgW E=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0D7AgDuFZ9X/5tdJa1dg0VWfLkRgX0kh?= =?us-ascii?q?XkCgSo4FAEBAQEBAQFdJ4RfAQUBATg0CxALGAklDwUTNhOIMQ7AZwEBAQEBAQE?= =?us-ascii?q?BAQEBAQEBAQEBAQEBARcFineKGwWPC4oojnUKjz+MMIN3HjaCEhyBbBwyiFEBA?= =?us-ascii?q?QE?=
X-IronPort-AV: E=Sophos;i="5.28,454,1464652800"; d="scan'208";a="305194695"
Received: from rcdn-core-4.cisco.com ([173.37.93.155]) by alln-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 01 Aug 2016 09:29:09 +0000
Received: from mcast-linux1.cisco.com (mcast-linux1.cisco.com [172.27.244.121]) by rcdn-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id u719T83f010326 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 1 Aug 2016 09:29:09 GMT
Received: from mcast-linux1.cisco.com (localhost.cisco.com [127.0.0.1]) by mcast-linux1.cisco.com (8.13.8/8.13.8) with ESMTP id u719T7Fh001110; Mon, 1 Aug 2016 02:29:08 -0700
Received: (from eckert@localhost) by mcast-linux1.cisco.com (8.13.8/8.13.8/Submit) id u719T71Q001105; Mon, 1 Aug 2016 02:29:07 -0700
Date: Mon, 1 Aug 2016 02:29:07 -0700
From: Toerless Eckert <eckert@cisco.com>
To: Brian E Carpenter <brian.e.carpenter@gmail.com>
Message-ID: <20160801092907.GV21039@cisco.com>
References: <fbc9727c-c4c0-1cd1-b015-382c33a5a90a@gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <fbc9727c-c4c0-1cd1-b015-382c33a5a90a@gmail.com>
User-Agent: Mutt/1.4.2.2i
Archived-At: <https://mailarchive.ietf.org/arch/msg/anima-signaling/g14dZ8JyX6EByP2ykyYHyOeHd3M>
Cc: Anima signaling DT <anima-signaling@ietf.org>
Subject: Re: [Anima-signaling] GRASP issue 52: Insecure instance text
X-BeenThere: anima-signaling@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Mailing list for the signaling design team of the ANIMA WG <anima-signaling.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/anima-signaling>, <mailto:anima-signaling-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/anima-signaling/>
List-Post: <mailto:anima-signaling@ietf.org>
List-Help: <mailto:anima-signaling-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/anima-signaling>, <mailto:anima-signaling-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 01 Aug 2016 09:29:11 -0000

Maybe Max has more details, he did take some notes.

>From my side:

- Define different "Modes" of GRASP, where each Mode has
  specific limitation (or none). Every Instance of GRASP has a particular Mode:

   DULL - Discovery Unsolicited Link Local

     This is the "insecure" mode, aka: Only Unsolicited Link Local Discovery Response
     Messages are permitted. Loop Count = 1. No redirects are permitted.

     (i don't think we need to constrain the announcements further to only bootstrap
      proxy etc. This should be nicely reuseable for any similar announcements, not
      only bootstrap proxy).
  
   FULL - Instance inside ACP. No restrictions.

   SONN - Secure Only Neighbor Negotiation 
      For use when negotiating (securely) an ACP channgel:
      loopcount=1 only. All messages permitted. 

Cheers
    Toerless

On Mon, Aug 01, 2016 at 09:01:56AM +1200, Brian E Carpenter wrote:
> Hi,
> 
> Here's another issue for design team comments.
> 
> I have a specific request from the bootstrap team to described in detail
> what is allowed and disallowed in an insecure instance of GRASP. The idea is
> that during bootstrap a separate instance of GRASP will run in its own memory
> space, such that it cannot contaminate the normal secure instance. For example
> it will have its own discovery cache. I will work on the text as soon as
> possible, based on some input from Max Pritikin. Any input welcome.
> 
> Regards
>    Brian
> 
> _______________________________________________
> Anima-signaling mailing list
> Anima-signaling@ietf.org
> https://www.ietf.org/mailman/listinfo/anima-signaling

-- 
---
Toerless Eckert, eckert@cisco.com

v2.8.7 | Report a Bug | By Email