Re: [Bier] BIER v6 requirements draft comments: draft-ietf-bier-ipv6-requirements ...

["Xiejingrong (Jingrong)" <[e-mail]>]

Hi Tony, Greg, Hooman, and folks who concerned about BIER IPv6 security:

We have just posted the rev-04 of bier-ipv6-encapsulation, with the only updated section is chapter 5 “security considerations”, to focus on this single point.

Please read and see if your concern about security is addressed, or what’s the problem(s) still not addressed if any.


URL:            https://www.ietf.org/internet-drafts/draft-xie-bier-ipv6-encapsulation-04.txt

Status:         https://datatracker.ietf.org/doc/draft-xie-bier-ipv6-encapsulation/

Thanks
Jingrong


From: BIER [mailto:[e-mail]] On Behalf Of Antoni Przygienda
Sent: Tuesday, November 19, 2019 1:51 PM
To: [e-mail]
Subject: [Bier] BIER v6 requirements draft comments: draft-ietf-bier-ipv6-requirements ...


Finally getting to fire off some comments on draft-ietf-bier-ipv6-requirements draft



3.4: I see NO requirements to do anything with SR or SRv6 in BIER WG charter so I am not sure how it ended up so prominently in the draft. And BIER is a hop-by-hop technology, it already includes provisions to transition non-BIER nodes via correct algorithms so not sure how SRv6 is of any use or relevance here. Of course BIER could be tunneled with SRv6 but then a BIER frame should be carried natively inside a SRv6 frame.  Comingling two level layer 2.5 transport technologies into a single layer format as the draft seems to imply is unnecessary and a bad idea since there will be resulting cross-talk.

4.2: completely disagreed. BIER is a hop-by-hop layer 2.5 technology. Modifying IP options is arguably far more expensive than next-protocol frame.

4.3:

·         fragmentation will only play in IPv6 case if the frame is longer than IPv6 max frame size - BML roughly. No matter _where_ we stick the mask we face the same problem until we start to do BIER fragmentation and reassembly

·         Again, SRv6 is neither in the charter nor an issue since BIER is a L2.5 hop-by-hop technology and not, as the authors want it, all of a sudden an implicit tunneling or multi-hop technology

4.11: and again BIER is hop-by-hop and it will rely on higher layers to re-assemble just like MPLS does.

I-D.xie-bier-ipv6-encapsulatio: yes, IPv6 architecture has the loophole for in flight modification of hop-by-hop header options but it does not mean it’s a good idea



Last, major objection is that by opening any IPv6 destination address to receive BIER frames from multiple hops away we are opening a completely security nightmare and argumenting that whole BIER layer has to be IPSEC’ed to close that hole is simply going into a seriously wrong direction IMO.



--- tony