IETF Logo Mail Archive

Re: [bess] Eric Rescorla's Discuss on draft-ietf-bess-evpn-etree-13: (with DISCUSS)

"Alvaro Retana (aretana)" <aretana@cisco.com> Tue, 26 September 2017 13:03 UTC

Return-Path: <aretana@cisco.com>
X-Original-To: bess@ietfa.amsl.com
Delivered-To: bess@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23367133224; Tue, 26 Sep 2017 06:03:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.519
X-Spam-Level:
X-Spam-Status: No, score=-14.519 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Th1AF8zxcijp; Tue, 26 Sep 2017 06:03:32 -0700 (PDT)
Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 52EC213321F; Tue, 26 Sep 2017 06:03:32 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=8774; q=dns/txt; s=iport; t=1506431012; x=1507640612; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=aTg/Tf8yIJKULEhl3MsMYyRHIuyTdbRTqTCoUaVxFfE=; b=HXjW8wuJTTGQzAkICIILfEovqc/DfO4hL0MBBXj4zqbopQB08MT81gGm /vxW5a4lUPRcK9fkoYy2jL2ARc+4Ki5bgL6Qie9PitfmrF2Z56j3Ge4Mp r6wisA50wnzHC9s72LROr7Vy2vyNza3OEiCXXil5OrnjK0h5fdr58QKeL g=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0CdAACrT8pZ/5FdJa1bGQEBAQEBAQEBAQEBBwEBAQEBgm9rZG4nB4Nvih+iXoU+DoIECiOFGAIahDE/GAECAQEBAQEBAWsohRkGI1YQAgEIDjEDAgICMBQRAgQBDQUbiTRkEKdxgicnincBAQEBAQEBAQEBAQEBAQEBAQEBAQEYBYMrggKBUYIVgn2EUQESAYMyL4IxBYoSjjuIUwKHXIx/ghOFb4sElRoCERkBgTgBHziBAwt4FVsBhwp2AYY0gSOBEAEBAQ
X-IronPort-AV: E=Sophos;i="5.42,440,1500940800"; d="scan'208,217";a="298251415"
Received: from rcdn-core-9.cisco.com ([173.37.93.145]) by rcdn-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 26 Sep 2017 13:03:31 +0000
Received: from XCH-ALN-005.cisco.com (xch-aln-005.cisco.com [173.36.7.15]) by rcdn-core-9.cisco.com (8.14.5/8.14.5) with ESMTP id v8QD3VIR007906 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 26 Sep 2017 13:03:31 GMT
Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-ALN-005.cisco.com (173.36.7.15) with Microsoft SMTP Server (TLS) id 15.0.1320.4; Tue, 26 Sep 2017 08:03:30 -0500
Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1320.000; Tue, 26 Sep 2017 08:03:30 -0500
From: "Alvaro Retana (aretana)" <aretana@cisco.com>
To: Eric Rescorla <ekr@rtfm.com>, The IESG <iesg@ietf.org>
CC: "thomas.morin@orange.com" <thomas.morin@orange.com>, "bess-chairs@ietf.org" <bess-chairs@ietf.org>, "draft-ietf-bess-evpn-etree@ietf.org" <draft-ietf-bess-evpn-etree@ietf.org>, "bess@ietf.org" <bess@ietf.org>
Thread-Topic: Eric Rescorla's Discuss on draft-ietf-bess-evpn-etree-13: (with DISCUSS)
Thread-Index: AQHTNsfZFP7z9tWMvEmpy/rdNYoCFw==
Date: Tue, 26 Sep 2017 13:03:30 +0000
Message-ID: <BA928107-421C-4A37-8ADC-3041E8DDF054@cisco.com>
References: <150498212906.8167.3812629658977416528.idtracker@ietfa.amsl.com> <CABcZeBP=vnWupC2FAw51M1MYPyc0kPt+xx5d3T1Q8soPC6rHkQ@mail.gmail.com>
In-Reply-To: <CABcZeBP=vnWupC2FAw51M1MYPyc0kPt+xx5d3T1Q8soPC6rHkQ@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/f.25.0.170815
x-ms-exchange-messagesentrepresentingtype: 1
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [10.117.15.4]
Content-Type: multipart/alternative; boundary="_000_BA928107421C4A378ADC3041E8DDF054ciscocom_"
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/bess/QfRzZXEoZKAkHI79eDohib89hx8>
Subject: Re: [bess] Eric Rescorla's Discuss on draft-ietf-bess-evpn-etree-13: (with DISCUSS)
X-BeenThere: bess@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: BGP-Enabled ServiceS working group discussion list <bess.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/bess>, <mailto:bess-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/bess/>
List-Post: <mailto:bess@ietf.org>
List-Help: <mailto:bess-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/bess>, <mailto:bess-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 26 Sep 2017 13:03:39 -0000

Hi!

I don’t have anything in my archive either. :-(

I just poked the authors…

Alvaro.

On 9/26/17, 5:59 AM, "Eric Rescorla" <ekr@rtfm.com<mailto:ekr@rtfm.com>> wrote:

I have some memory that someone responded that this wasn't a security requirement, but I can't find that now.

-Ekr


On Sat, Sep 9, 2017 at 11:35 AM, Eric Rescorla <ekr@rtfm.com<mailto:ekr@rtfm.com>> wrote:
Eric Rescorla has entered the following ballot position for
draft-ietf-bess-evpn-etree-13: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-bess-evpn-etree/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

It's not clear to me if the prohibition on leaf-to-leaf communications is
intended to be a security requirement. If so, it seems like it needs to
explicitly state why it is not possible for ACs which are leaf to pretend to be
root. If not, then it should say so. Additionally, this solution appears to
rely very heavily on filtering, so I believe some text about what happens
during periods of filtering inconsistency (and what the impact on the security
is).

v2.27.6 | Report a Bug | By Email | System Status