RE: HIT and ACLs (was Re: [Int-area] Progress on draft-laganier-ipv6-khi-01.txt

> -----Original Message-----
> From: marcelo bagnulo braun [mailto:marcelo@it.uc3m.es] 
> Sent: Monday, June 05, 2006 9:21 AM
> To: Henderson, Thomas R
> Cc: Internet Area; Tim Shepard
> Subject: HIT and ACLs (was Re: [Int-area] Progress on 
> draft-laganier-ipv6-khi-01.txt 
> 
> Hi Tom,
> 
> a question about this point...
> 
> El 05/06/2006, a las 7:35, Henderson, Thomas R escribió:
> >
> > It is not only local handles where this matters; in fact, 
> as you point
> > out, it may not matter much there at all.  However, think 
> about using
> > HITs instead of IPv6 addresses in ACLs;
> 
> I am not sure if i understand in which situations this can be 
> practical...
> 
> there are at least two things that i am not sure how to deal with in 
> this case:
> - First, HITs are not carried in every packet (as opposed to IP 
> addresses) so you could only have ACLs based on HITs on the endsystem 
> (meaning that you cannot have e.g. an ACL on a firewall that is 
> inspecting traffic to verify what is filtered, right?) or are you 
> considering the case where the firewall keeps track of the hip 
> exchange?

I am considering the case where the firewall/end system keeps track of the HIP exchange.  See, for example, the following draft:
http://www.ietf.org/internet-drafts/draft-tschofenig-hiprg-hip-natfw-traversal-04.txt

> - Second, i guess that in order to be usefull it should be 
> possible to 
> aggregate the HITs so that you could define blocks in the 
> ACL. I mean a 
> plain namespace like HITs seem kind of unpractical since you 
> would need 
> to detail each and every host in the ACL. I guess that for this, the 
> type 2 HITs would be really needed...
> 

There is a section in the IRTF NSRG report that describes this issue:

   "Additionally, HIP raises an issue regarding other uses for
   aggregation of IP addresses.  Today, they are not only aggregated for
   purposes of reduced routing, but also for reduced administration.  A
   typical access list used on the Internet will have some sort of a
   mask, indicating that a group of hosts from the same subnet may
   access some resource.  Because the value of a HIT is a hash in part,
   only the administratively assigned value can be aggregated,
   introducing an allocation limitation and authorization concerns."

But in practice today, there is a similar lack of aggregation in ssh key-based access controls.  I think it depends on what you are trying to accomplish with the ACL.  If you really want to write ACL policies based on address prefixes, then continue to do so, but if you want to do it based on host identifiers, then I agree that either they would need to be enumerated or there would need to be some structure added for aggregation (as well as some means to authenticate that the host is authorized to use those structured id bits).  

If a distinct prefix is allocated for ORCHIDs, then it makes it straightforward for a system to determine by inspection whether the entry is an address or a HIT, and finer granularity controls are then possible at the network layer.

Tom

_______________________________________________
Int-area mailing list
Int-area@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/int-area