Re: [Int-area] Eric Rescorla's No Objection on draft-ietf-intarea-probe-09: (with COMMENT)

Ron Bonica <rbonica@juniper.net> Wed, 13 December 2017 21:43 UTC

From: Ron Bonica <rbonica@juniper.net>
To: Eric Rescorla <ekr@rtfm.com>, The IESG <iesg@ietf.org>
CC: "draft-ietf-intarea-probe@ietf.org" <draft-ietf-intarea-probe@ietf.org>, Luigi Iannone <ggx@gigix.net>, "intarea-chairs@ietf.org" <intarea-chairs@ietf.org>, "ggx@gigix.net" <ggx@gigix.net>, "int-area@ietf.org" <int-area@ietf.org>
Thread-Topic: Eric Rescorla's No Objection on draft-ietf-intarea-probe-09: (with COMMENT)
Thread-Index: AQHTc6g+tW20fOciNUynHVaa5fIyuaNBygAQ
Date: Wed, 13 Dec 2017 21:43:20 +0000
Message-ID: <BLUPR0501MB2051F3ACC596CA21B7AE537DAE350@BLUPR0501MB2051.namprd05.prod.outlook.com>
References: <151312445212.30031.10241103164330453479.idtracker@ietfa.amsl.com>
In-Reply-To: <151312445212.30031.10241103164330453479.idtracker@ietfa.amsl.com>
Accept-Language: en-US
Content-Language: en-US
received-spf: None (protection.outlook.com: juniper.net does not designate permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 7e2597b5-2e8e-41bc-8bcd-08d542728756
X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Dec 2017 21:43:20.6625 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLUPR0501MB2050
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-12-13_12:, , signatures=0
X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1712130298
Archived-At: <https://mailarchive.ietf.org/arch/msg/int-area/pBkduai-bpy44NlafI77_4sbfCU>
Subject: Re: [Int-area] Eric Rescorla's No Objection on draft-ietf-intarea-probe-09: (with COMMENT)
X-BeenThere: int-area@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: IETF Internet Area Mailing List <int-area.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/int-area>, <mailto:int-area-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/int-area/>
List-Post: <mailto:int-area@ietf.org>
List-Help: <mailto:int-area-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/int-area>, <mailto:int-area-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 13 Dec 2017 21:43:38 -0000

Hi Eric,

Thanks for the review. Responses inline......

                        Ron


> -----Original Message-----
> From: Eric Rescorla [mailto:ekr@rtfm.com]
> Sent: Tuesday, December 12, 2017 7:21 PM
> To: The IESG <iesg@ietf.org>
> Cc: draft-ietf-intarea-probe@ietf.org; Luigi Iannone <ggx@gigix.net>;
> intarea-chairs@ietf.org; ggx@gigix.net; int-area@ietf.org
> Subject: Eric Rescorla's No Objection on draft-ietf-intarea-probe-09: (with
> COMMENT)
> 
> Eric Rescorla has entered the following ballot position for
> draft-ietf-intarea-probe-09: No Objection
[RB ] 
[snip]
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> I share Yaron Sheffer's concern about the incoming ACL. Do you really mean
> to list all the probe-capable nodes?
[RB ] 
The ACL doesn't list all probe-capable nodes. It is configure on a probe-capable node and it enumerates the prefixes from which it will accept an ICMP Extended Echo Request.

For example, assume that an ISP deploys PROBE capable software on its routers. By default, these routers won't accept an ICMP Extended Echo Request from anybody. The ISP will probably want to enable PROBE, but only if the ICMP Extended Echo Request comes from the NOC or from a few other trusted prefixes. So, the ISP will put those prefixes into the ACL.

I am thinking that the number of prefixes will typically be very small (e.g., the NOC).

> 
>    or IPv6 Neighbor Cache [RFC4861].  Otherwise, it reports that the
>    interface does not exist.
> Hmm... So you don't try to ping it yourself? That's interesting.
[RB ] 
The proxy node could ping the probed interface, but that would require the router to main state. We don't want to go there for scaling and security reasons.

Rather than doing that, PROBE looks for an entry in the ARP Table and Neighbor Cache. Prior version 08 of this draft, the proxy node assumed that the probed interface does not exist if it is not in the ARP Table and Neighbor Cache. IETF LC reviewers pointed out that this assumption is not safe. So now, the proxy node reports that the table entry does not exist. In no longer reports that the interface does not exist.

> 
>       the probed node.  The L-bit is clear if the probed interface is
>       directly connected to the probed node.
> Maybe I'm missing something here, but how does the probing node know?
> I.e., can it address by IP address and set L=0?
[RB ] 
This is a parameter to the Probe application. See the appendix.
> 
> View Inlinedraft-ietf-intarea-probe.txt:365
>       Ethernet is running on the probed interface.  Otherwise, the E-bit
>       is clear.
> This seems pretty limited. Does "WiFi" count for instance?
> 
[RB ] 
The E-bit was removed in response to last call comments

[Int-area] Eric Rescorla's No Objection on draft-… Eric Rescorla
Re: [Int-area] Eric Rescorla's No Objection on dr… Ron Bonica
Re: [Int-area] Eric Rescorla's No Objection on dr… Eric Rescorla