Re: [bess] Secdir telechat review of draft-ietf-bess-bgp-sdwan-usage-20

[Linda Dunbar <[e-mail]>]

Stephen,

BGP/TLS has been deployed  (see the attached email from Robert Razuk on using BGP over TLS in  Sproute's SDWAN solution for years) even though there is only a 00 draft for BGP over TLS in IETF.
The document states that analysis of BGP over TLS is beyond the scope.
Is the following sentence better?
      While beyond the scope of this document, conducting a comprehensive analysis might be needed to ensure the security of BGP over TLS [BGP-OVER-TLS]


Thank you,
Linda
-----Original Message-----
From: Stephen Farrell via Datatracker <[e-mail]>
Sent: Thursday, February 15, 2024 10:30 AM
To: [e-mail]
Cc: [e-mail]; [e-mail]; [e-mail]
Subject: Secdir telechat review of draft-ietf-bess-bgp-sdwan-usage-20

Reviewer: Stephen Farrell
Review result: Has Issues

Draft-20 seems to dial-back the call for BGP/TLS, but OTOH adds text in the security considerations saying that BGP/TLS "is imperative." I'm not sure of the security pitfalls that might arise if one followed the guidance here whilst BGP/TLS is still just a non-wg -00 draft (and hence aspirational), but it seems to me like a possibly dangerous implement.

--- Begin Message ---

Hi John,

Trimming a bit the list of to/cc

I noticed you stated this:

".. as far as I’m aware, there is no IETF specification for BGP over TLS, and I don’t expect that there will ever be a specification for BGP over DTLS, given that BGP assumes a stream transport..."

So that got me a bit curious as I have been using BGP over TCP over TLS and BGP over TCP over DTLS for years testing Sproute's SDWAN solution. Works perfectly fine. In fact it performs much better then BGP over TCP over IPSec.

And now you said something even more interesting:

".. It’s possible to layer lots of things over lots of other things..."

That sounds like using TCP over TLS or DTLS is a bad thing ... which clearly is not.

Cheers,
Robert

PS. In the subject spec I found many references to running TLS or DTLS to RRs or PEs and having BGP established there. I would rather not delete DTLS from it.







On Tue, Feb 6, 2024 at 8:39 PM John Scudder <[e-mail]<mailto:[e-mail]>> wrote:
Hi Robert,

> On Feb 6, 2024, at 1:49 PM, Robert Raszuk <[e-mail]<mailto:[e-mail]>> wrote:
>
> Hi John,
>
> https://datatracker.ietf.org/doc/draft-wirtgen-bgp-tls/<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-wirtgen-bgp-tls%2F&data=05%7C02%7Clinda.dunbar%40futurewei.com%7Ca97fde0f1f4746e688ac08dc274ca7c4%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C0%7C638428457433215814%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=X0Pq0imVajEuS%2FyUyFCmb2et9H0RCWnF9bgfLG8Yor0%3D&reserved=0>

See my earlier reply to Linda.

> And for DTLS ... isn't this simply TCP over DTLS which works just fine ?

I’m not sure what you’re getting at here. It’s possible to layer lots of things over lots of other things. That doesn’t mean that it makes sense to do so, or that it’s something you can just mention in (literally) a single word in a spec and imagine you’ve provided enough detail. In this case, Linda said she planned to remove the mention of DTLS, which makes more sense to me, so I guess we don’t need to keep discussing it.

—John

>
> Many thx,
> R.
>
>
>
> On Tue, Feb 6, 2024 at 4:38 PM John Scudder <jgs=[e-mail]<mailto:[e-mail]>> wrote:
> I haven’t done a full review of this document, but I did notice that Roman Danyliw balloted DISCUSS on version 15 [1], asking, among other things, "Are there pointers for BGP over DTLS? Over TLS?”. This doesn’t appear to have been addressed, either in Linda’s reply to Roman [2], or in the text of the document. It seems ill-advised to be last calling a document with an unaddressed DISCUSS. For what it’s worth, Roman’s point seems to me to be on target — as far as I’m aware, there is no IETF specification for BGP over TLS, and I don’t expect that there will ever be a specification for BGP over DTLS, given that BGP assumes a stream transport.
>
> $0.02,
>
> —John
>
> [1] https://datatracker.ietf.org/doc/draft-ietf-bess-bgp-sdwan-usage/ballot/#draft-ietf-bess-bgp-sdwan-usage_roman-danyliw<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-bess-bgp-sdwan-usage%2Fballot%2F%23draft-ietf-bess-bgp-sdwan-usage_roman-danyliw&data=05%7C02%7Clinda.dunbar%40futurewei.com%7Ca97fde0f1f4746e688ac08dc274ca7c4%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C0%7C638428457433230841%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=OzYS1Rkp6NscaNNe3MBIM1Ts3%2BAvuk53ZZMRYtdlDjA%3D&reserved=0>
> [2] https://mailarchive.ietf.org/arch/msg/bess/-AT3GpMR6rr6-ywB5vWD7EbGk0w/<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmailarchive.ietf.org%2Farch%2Fmsg%2Fbess%2F-AT3GpMR6rr6-ywB5vWD7EbGk0w%2F&data=05%7C02%7Clinda.dunbar%40futurewei.com%7Ca97fde0f1f4746e688ac08dc274ca7c4%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C0%7C638428457433243398%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=5nrpTUrKjmShGnBpKiGrfRowShwqpmH2lZUbhYo1%2Bwk%3D&reserved=0>
>
> > On Feb 1, 2024, at 11:58 AM, The IESG <[e-mail]<mailto:[e-mail]>> wrote:
> >
> >
> > The IESG has received a request from the BGP Enabled ServiceS WG (bess) to
> > consider the following document: - 'BGP Usage for SD-WAN Overlay Networks'
> >  <draft-ietf-bess-bgp-sdwan-usage-19.txt> as Informational RFC
> >
> > The IESG plans to make a decision in the next few weeks, and solicits final
> > comments on this action. Please send substantive comments to the
> > [e-mail]<mailto:[e-mail]> mailing lists by 2024-02-15. Exceptionally, comments may
> > be sent to [e-mail]<mailto:[e-mail]> instead. In either case, please retain the beginning
> > of the Subject line to allow automated sorting.
> >
> > Abstract
> >
> >
> >   The document discusses the usage and applicability of BGP as the
> >   control plane for multiple SD-WAN scenarios. The document aims to
> >   demonstrate how the BGP-based control plane is used for large-
> >   scale SD-WAN overlay networks with little manual intervention.
> >
> >   SD-WAN edge nodes are commonly interconnected by multiple types of
> >   underlay networks owned and managed by different network
> >   providers.
> >
> >
> >
> >
> > The file can be obtained via
> > https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-ietf-bess-bgp-sdwan-usage/__;!!NEt6yMaO-gk!E4My2sQFYwfDPTtjIaFd1jpCRXVBB-u6OkgI3yHHnKfSsS4Kc80iA-x0qPn_krxB9c0LBSQsXvI1RN7dGgEtnA$<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-bess-bgp-sdwan-usage%2F__%3B!!NEt6yMaO-gk!E4My2sQFYwfDPTtjIaFd1jpCRXVBB-u6OkgI3yHHnKfSsS4Kc80iA-x0qPn_krxB9c0LBSQsXvI1RN7dGgEtnA%24&data=05%7C02%7Clinda.dunbar%40futurewei.com%7Ca97fde0f1f4746e688ac08dc274ca7c4%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C0%7C638428457433254868%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=YoU1ajQlLOcjggkHV2e7Yyb%2FnmBcWTQl4%2F%2FrzTNiIto%3D&reserved=0>
> >
> >
> >
> > No IPR declarations have been submitted directly on this I-D.
> >
> >
> >
> >
> >
> > _______________________________________________
> > IETF-Announce mailing list
> > [e-mail]<mailto:[e-mail]>
> > https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/ietf-announce__;!!NEt6yMaO-gk!E4My2sQFYwfDPTtjIaFd1jpCRXVBB-u6OkgI3yHHnKfSsS4Kc80iA-x0qPn_krxB9c0LBSQsXvI1RN5i_8mwVg$<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fietf-announce__%3B!!NEt6yMaO-gk!E4My2sQFYwfDPTtjIaFd1jpCRXVBB-u6OkgI3yHHnKfSsS4Kc80iA-x0qPn_krxB9c0LBSQsXvI1RN5i_8mwVg%24&data=05%7C02%7Clinda.dunbar%40futurewei.com%7Ca97fde0f1f4746e688ac08dc274ca7c4%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C0%7C638428457433266923%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=m27w3FcYAaT7XrV9BNDDabBBTFlG91qfaD18iBPGaFI%3D&reserved=0>
>
> --
> last-call mailing list
> [e-mail]<mailto:[e-mail]>
> https://www.ietf.org/mailman/listinfo/last-call<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Flast-call&data=05%7C02%7Clinda.dunbar%40futurewei.com%7Ca97fde0f1f4746e688ac08dc274ca7c4%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C0%7C638428457433277573%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=3EC09O7zrEzKbN%2B3OPGDr%2B6PV2Xw5T1ILxfS%2BSDx0HA%3D&reserved=0>

--- End Message ---