Re: [bess] Eric Rescorla's Discuss on draft-ietf-bess-evpn-etree-13: (with DISCUSS)
Eric Rescorla <ekr@rtfm.com> Thu, 30 November 2017 19:10 UTC
Return-Path: <ekr@rtfm.com>
X-Original-To: bess@ietfa.amsl.com
Delivered-To: bess@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B4B9D129496 for <bess@ietfa.amsl.com>; Thu, 30 Nov 2017 11:10:07 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.898
X-Spam-Level:
X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3viWryJyNfNF for <bess@ietfa.amsl.com>; Thu, 30 Nov 2017 11:10:05 -0800 (PST)
Received: from mail-yb0-x233.google.com (mail-yb0-x233.google.com [IPv6:2607:f8b0:4002:c09::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E9E27128E19 for <bess@ietf.org>; Thu, 30 Nov 2017 11:10:02 -0800 (PST)
Received: by mail-yb0-x233.google.com with SMTP id i15so3123860ybk.0 for <bess@ietf.org>; Thu, 30 Nov 2017 11:10:02 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=vQQQ2W3IOQDKgvHv9oDEb1Az1HFp8xqWyC0sjq6htFM=; b=ZUeCGIhiLxvX28sGzYY5nmGP79U5jLHiyajTK32ZwyM/3Kg6DoSyaqPoceZWcFSUEd sdFWUqoX5DH1LzRmQ00JXoJk15rV0+GheXyOJ/5FvL+qr3wXo84gcBsm60gEdwQusmdM hvZTrmIN4xg+iqjsVgEodzGhcCel+Mgp9g878HAULVuOFnZPWeJ5Ntiypl7xUOyHbuZU GMA7p1ccNjbtK538euwRWeOmp6KtdLDRr0zQ6Nzdi9a0FvVzkUKjmhXAOx6Tnck/SB9k vuAI59Wf7sabd0aQXeQed75V3fMP/E7+JfhS1uRyRFWXYT7LC2Q78tcpRXHO30WdYYCJ k3XQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=vQQQ2W3IOQDKgvHv9oDEb1Az1HFp8xqWyC0sjq6htFM=; b=MCXPsI60qWJriC7uILS79TROBIk/YEkIMS84W4JXUb3HfnXSKeLSeTbReoZBb9lWwC /PKa+RHXm2IykQQM8EohJzdsnXkH+5f/dmKUNcKHc0Xhm0UgoUFNptZQy1raOwz+10oO jzu0ridh1GtoauUzeSiCxYE93ikGHc1+4BvYkFGgs/JpWGleuD5+dXkkQmelgV+/pK6e gxYonqs6bJkaLSyB30jLiDcKVycTyNsm9L2z+xuygk2rcQHJLoA2TVft3PSuSvRWvidd 7y8PQIrFVfG1xEKz59JZqypqSwxU1ygUoGgDLwRI74tajrx6a0HLLsh18nr/5IYY7Tzf xT9w==
X-Gm-Message-State: AJaThX5haVB4Rgkie5bFliY2rGaDeMMG6qLeLe4iGOBPoctW50GpLqS8 0u/hnObHiNURLPY98G2u9nRGisPpBG5Uk99IK1bttg==
X-Google-Smtp-Source: AGs4zMZuyeC7l2ViOvcZcVPc1XrAlRPfYFwIJAx54ugfxMfSXqspV5ZToEEi3CJwXOwy06K6X1L9ay7FkY9lhGCQ6aQ=
X-Received: by 10.37.16.134 with SMTP id 128mr2251880ybq.474.1512069002074; Thu, 30 Nov 2017 11:10:02 -0800 (PST)
MIME-Version: 1.0
Received: by 10.129.123.132 with HTTP; Thu, 30 Nov 2017 11:09:21 -0800 (PST)
In-Reply-To: <D6458F0D.22DF89%sajassi@cisco.com>
References: <150498212906.8167.3812629658977416528.idtracker@ietfa.amsl.com> <CABcZeBP=vnWupC2FAw51M1MYPyc0kPt+xx5d3T1Q8soPC6rHkQ@mail.gmail.com> <BA928107-421C-4A37-8ADC-3041E8DDF054@cisco.com> <D618BF3A.227070%sajassi@cisco.com> <D62A0B38.22AF50%sajassi@cisco.com> <D6458F0D.22DF89%sajassi@cisco.com>
From: Eric Rescorla <ekr@rtfm.com>
Date: Thu, 30 Nov 2017 11:09:21 -0800
Message-ID: <CABcZeBN4Bw9zB_F66-3shWzLTLyksCDJZbZvbJfeR=_df8Fmyg@mail.gmail.com>
To: "Ali Sajassi (sajassi)" <sajassi@cisco.com>
Cc: The IESG <iesg@ietf.org>, Alvaro Retana <aretana.ietf@gmail.com>, "thomas.morin@orange.com" <thomas.morin@orange.com>, "bess-chairs@ietf.org" <bess-chairs@ietf.org>, "draft-ietf-bess-evpn-etree@ietf.org" <draft-ietf-bess-evpn-etree@ietf.org>, "bess@ietf.org" <bess@ietf.org>
Content-Type: multipart/alternative; boundary="001a11c0125abeb5f7055f37ff40"
Archived-At: <https://mailarchive.ietf.org/arch/msg/bess/pn1zfvoXkJlGiRssAIdPrnWwyrc>
Subject: Re: [bess] Eric Rescorla's Discuss on draft-ietf-bess-evpn-etree-13: (with DISCUSS)
X-BeenThere: bess@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: BGP-Enabled ServiceS working group discussion list <bess.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/bess>, <mailto:bess-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/bess/>
List-Post: <mailto:bess@ietf.org>
List-Help: <mailto:bess-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/bess>, <mailto:bess-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 30 Nov 2017 19:10:08 -0000
I will try to give this a read this week On Thu, Nov 30, 2017 at 10:46 AM, Ali Sajassi (sajassi) <sajassi@cisco.com> wrote: > > Hi Alvaro, > > I have addressed all the comments from IESG (including Eric Rescorla’s > comments) but the status of this draft still shows "AD Followup". Can you > please progress this draft and let me know if there is anything else you > need from me. > > Regards, > Ali > > From: Cisco Employee <sajassi@cisco.com> > Date: Thursday, November 9, 2017 at 1:42 PM > To: Cisco Employee <sajassi@cisco.com>, Eric Rescorla <ekr@rtfm.com>, The > IESG <iesg@ietf.org>, Alvaro Retana <aretana.ietf@gmail.com> > > Cc: "thomas.morin@orange.com" <thomas.morin@orange.com>, " > bess-chairs@ietf.org" <bess-chairs@ietf.org>, "draft-ietf-bess-evpn-etree@ > ietf.org" <draft-ietf-bess-evpn-etree@ietf.org>, "bess@ietf.org" < > bess@ietf.org> > Subject: Re: Eric Rescorla's Discuss on draft-ietf-bess-evpn-etree-13: > (with DISCUSS) > > Hi Eric, > > Let me know if you have any further questions/comments. > > Cheers, > Ali > > From: Cisco Employee <sajassi@cisco.com> > Date: Friday, October 27, 2017 at 10:06 AM > To: "Alvaro Retana (aretana)" <aretana@cisco.com>, Eric Rescorla < > ekr@rtfm.com>, The IESG <iesg@ietf.org> > Cc: "thomas.morin@orange.com" <thomas.morin@orange.com>, " > bess-chairs@ietf.org" <bess-chairs@ietf.org>, "draft-ietf-bess-evpn-etree@ > ietf.org" <draft-ietf-bess-evpn-etree@ietf.org>, "bess@ietf.org" < > bess@ietf.org> > Subject: Re: Eric Rescorla's Discuss on draft-ietf-bess-evpn-etree-13: > (with DISCUSS) > Resent-From: <alias-bounces@ietf.org> > Resent-To: Cisco Employee <sajassi@cisco.com>, <ssalam@cisco.com>, < > jdrake@juniper.net>, <ju1738@att.com>, <sboutros@vmware.com>, < > jorge.rabadan@nokia.com> > Resent-Date: Friday, October 27, 2017 at 10:06 AM > > Hi Eric, > > The “leaf” or “root” designation of an Attachment Circuit (AC) is done by > the operator / service provider on the PE device (and not on a CE). So, CE > device has no control in changing a “leaf” designation to a “root”. I added > “the network operator / service provider” to the text. Furthermore, I added > additional text to address your second concern (e.g., regarding how to > avoid any exchange among leaf ACs): > > "Furthermore, this document provides additional security check by allowing > sites (or ACs) of an EVPN instance to be designated as "Root" or "Leaf" by > the network operator/ service provider and thus preventing any traffic > exchange among "Leaf" sites of that VPN through ingress filtering for known > unicast traffic and egress filtering for BUM traffic. Since by default and > for the purpose of backward compatibility, an AC that doesn't have a leaf > designation is considered as a root AC, in order to avoid any traffic > exchange among leaf ACs, the operator SHOULD configure the AC with a proper > role (leaf or root) before activating the AC." > > Cheers, > Ali > > From: "Alvaro Retana (aretana)" <aretana@cisco.com> > Date: Tuesday, September 26, 2017 at 6:03 AM > To: Eric Rescorla <ekr@rtfm.com>, The IESG <iesg@ietf.org> > Cc: "thomas.morin@orange.com" <thomas.morin@orange.com>, " > bess-chairs@ietf.org" <bess-chairs@ietf.org>, "draft-ietf-bess-evpn-etree@ > ietf.org" <draft-ietf-bess-evpn-etree@ietf.org>, "bess@ietf.org" < > bess@ietf.org> > Subject: Re: Eric Rescorla's Discuss on draft-ietf-bess-evpn-etree-13: > (with DISCUSS) > Resent-From: <alias-bounces@ietf.org> > Resent-To: Cisco Employee <sajassi@cisco.com>, <ssalam@cisco.com>, < > jdrake@juniper.net>, <ju1738@att.com>, <sboutros@vmware.com>, < > jorge.rabadan@nokia.com> > Resent-Date: Tuesday, September 26, 2017 at 6:03 AM > > Hi! > > > > I don’t have anything in my archive either. :-( > > > > I just poked the authors… > > > > Alvaro. > > > > On 9/26/17, 5:59 AM, "Eric Rescorla" <ekr@rtfm.com> wrote: > > > > I have some memory that someone responded that this wasn't a security > requirement, but I can't find that now. > > > > -Ekr > > > > > > On Sat, Sep 9, 2017 at 11:35 AM, Eric Rescorla <ekr@rtfm.com> wrote: > > Eric Rescorla has entered the following ballot position for > draft-ietf-bess-evpn-etree-13: Discuss > > When responding, please keep the subject line intact and reply to all > email addresses included in the To and CC lines. (Feel free to cut this > introductory paragraph, however.) > > > Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html > for more information about IESG DISCUSS and COMMENT positions. > > > The document, along with other ballot positions, can be found here: > https://datatracker.ietf.org/doc/draft-ietf-bess-evpn-etree/ > > > > ---------------------------------------------------------------------- > DISCUSS: > ---------------------------------------------------------------------- > > It's not clear to me if the prohibition on leaf-to-leaf communications is > intended to be a security requirement. If so, it seems like it needs to > explicitly state why it is not possible for ACs which are leaf to pretend > to be > root. If not, then it should say so. Additionally, this solution appears to > rely very heavily on filtering, so I believe some text about what happens > during periods of filtering inconsistency (and what the impact on the > security > is). > > > > >
- Re: [bess] Eric Rescorla's Discuss on draft-ietf-… Eric Rescorla
- Re: [bess] Eric Rescorla's Discuss on draft-ietf-… Alvaro Retana (aretana)
- [bess] Eric Rescorla's Discuss on draft-ietf-bess… Eric Rescorla
- Re: [bess] Eric Rescorla's Discuss on draft-ietf-… Ali Sajassi (sajassi)
- Re: [bess] Eric Rescorla's Discuss on draft-ietf-… Ali Sajassi (sajassi)
- Re: [bess] Eric Rescorla's Discuss on draft-ietf-… Ali Sajassi (sajassi)
- Re: [bess] Eric Rescorla's Discuss on draft-ietf-… Eric Rescorla