Re: [ippm] Secdir early review of draft-ietf-ippm-ioam-direct-export-07

Haoyu Song <haoyu.song@futurewei.com> Thu, 19 May 2022 16:45 UTC

Return-Path: <haoyu.song@futurewei.com>
X-Original-To: ippm@ietfa.amsl.com
Delivered-To: ippm@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 476F7C1D350B; Thu, 19 May 2022 09:45:33 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.1
X-Spam-Level:
X-Spam-Status: No, score=-7.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=futurewei.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w5uoTbWwK-FP; Thu, 19 May 2022 09:45:29 -0700 (PDT)
Received: from NAM10-BN7-obe.outbound.protection.outlook.com (mail-bn7nam10on2071b.outbound.protection.outlook.com [IPv6:2a01:111:f400:7e8a::71b]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9458FC1D3507; Thu, 19 May 2022 09:45:25 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=IPsG8fJ+PRqk/ZvM/2c8mN0au5XRACldVp9WOaB3E4D49dCuTR8u0HpCQr9NXeE6AEv9BVVQHiAhUPAoM02jpP6frIpHa5Pkw7d2vib5Am5PPaf1Q0k/v0uyGfynkha66nQsqZZJzoHxPfwMXIPVygwCdfCXjyasTX371uISif4rhqct4u4X8OnSJ3l3EQLnk4JhtVweL0KMjhVX55X5nqNZdMBgz8x8qBM2jFbsTMKog78hrFs+HKSdbzwyg4UPfYy8YwtUb5bAtF3xI1Edj5Bb14O7xm05P4mWBsJRgZMGRC/uXHAovDohmvznY64PbGrLm5paZUEJ0N2wjtI8VA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=cV/4slKNFUR/PNpuYIJvZUnh9NdBMucGFSeYwBCSoDM=; b=A/O5ZqoQIA1mP2XbI+6cD4EkmSjQp35GTz295kqTuZUNeORU4xk8yqsdqcl2BrtDYLEFWfBtp4zjNk3pcDDOXBVX3tJet8CWvq/DVa8R+5Dgd32LD8R9Mdk8lbmT82TugDVyqIylAMHiy14Sr6Oq9uRKgvIcSD19Ew6WAv8YC6s7u00Nt7B4h7uhyzfwxQdL4x6sr9zWQuE4/r6VsrAGDGDSlm2WxNS6ZKTBqtVzK3nUMvGQfCfbflALu4/rLZplKKkvrlWmkQLtsoPynRajYZffxWIyEvFsZpxYcxMfMVxADbhvz6at1xarVRNlSw7JHB/nrDCgQD6XlgwL5qsagg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=futurewei.com; dmarc=pass action=none header.from=futurewei.com; dkim=pass header.d=futurewei.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Futurewei.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=cV/4slKNFUR/PNpuYIJvZUnh9NdBMucGFSeYwBCSoDM=; b=KLkQxqymAibhgJjCXofxJfUsoUCo2jr/oDV49tuJMP5y1wfDEz5wC3pNREh4TQupItnU/W6pd5UsVAlt7oNOqC+MpsnykswWJToo5FBEKrNhATlZnITJY66of7Ek0NcGMF2vLSNtJnYNBBrGSzpV5YFRUrZ7+K0p7ZunFkLC744=
Received: from BY3PR13MB4787.namprd13.prod.outlook.com (2603:10b6:a03:357::13) by CO1PR13MB4773.namprd13.prod.outlook.com (2603:10b6:303:fb::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5273.5; Thu, 19 May 2022 16:45:21 +0000
Received: from BY3PR13MB4787.namprd13.prod.outlook.com ([fe80::68af:7a2e:a1b:aa7d]) by BY3PR13MB4787.namprd13.prod.outlook.com ([fe80::68af:7a2e:a1b:aa7d%7]) with mapi id 15.20.5293.007; Thu, 19 May 2022 16:45:20 +0000
From: Haoyu Song <haoyu.song@futurewei.com>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>, "secdir@ietf.org" <secdir@ietf.org>
CC: "draft-ietf-ippm-ioam-direct-export.all@ietf.org" <draft-ietf-ippm-ioam-direct-export.all@ietf.org>, "ippm@ietf.org" <ippm@ietf.org>
Thread-Topic: Secdir early review of draft-ietf-ippm-ioam-direct-export-07
Thread-Index: AQHYa5ZSECw3eYBdlUCMv5PBUiom6a0mZgOw
Date: Thu, 19 May 2022 16:45:20 +0000
Message-ID: <BY3PR13MB4787765F9D1BDE157268DE109AD09@BY3PR13MB4787.namprd13.prod.outlook.com>
References: <165297463378.5296.5590170778832486427@ietfa.amsl.com>
In-Reply-To: <165297463378.5296.5590170778832486427@ietfa.amsl.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=futurewei.com;
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: f7a59db2-191c-4d40-ad6b-08da39b6f664
x-ms-traffictypediagnostic: CO1PR13MB4773:EE_
x-microsoft-antispam-prvs: <CO1PR13MB47731F5CCD1BD1A692F1E86F9AD09@CO1PR13MB4773.namprd13.prod.outlook.com>
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: C5coIhlCiY0emj/G9R75o6RNJjTdDPy0ZN2uatrBxepdCCspcyPHV6TvlHR0Qx8Ile9HtIIqGoOJc+Y+r+B6ugTvtwS0ylArfPd2sKrOdOVxK2VLJsV4YXfEBz6jgFGv5sQAuEpU+yVmd3uVpkgiJyNwigEhvWwT0lKm9aFS14rAOQCs7aNA9reh7UDrkUBnyf1HpHW3/rYwAFPXxk8IQegg4LhsVEDPTueuGVC8oIn/92hgqPp1PwoEmr9LA4i3uLVmYR3PyhQ8dJanb1fRwIFLpUyW4BL9M+/0wnTEujyo2XRLqAVp0NAl2i//1iXPbxGUx/Uj/O9D0BHW50krwo3Ljj2ljK29sx7IOalgN7JY8WZMo+TfXOPOZcNqotRHRu6EFTFhZDOSGr44tuzQJ+5fvZ904ho9fi9xvG2p5rIcek+49OTrkpvNXOuD1EkhSUFtpgbh8UrqiSeonxlG0opEHoYcv+gvMXiCVshi9QfxaAQrsnly2K7VwWd2F/SnCksRrVAjZGK9hqNKK5xMupOL2MvJY1F886VzxytrcXC2jozVgvzmKFQ9HOdFCEwuY90hQy+0eXgauknGLFdhBEKll9K054QrKdIim7e0ssRnAq3YFMLyXziB4T2G4v4h60oDaWbTXWMuyYrbsmllJUJdQ5Nu/NIqZgmYn7jC33wxIyGRli8Q/dmxGsT7DDTGgLaPQPuzM0gQYg0300tUqw==
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BY3PR13MB4787.namprd13.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(8676002)(66476007)(66556008)(66946007)(66446008)(71200400001)(53546011)(4326008)(44832011)(86362001)(26005)(76116006)(6506007)(64756008)(110136005)(7696005)(8936002)(52536014)(508600001)(122000001)(38100700002)(33656002)(5660300002)(83380400001)(2906002)(55016003)(296002)(54906003)(9686003)(316002)(186003)(38070700005); DIR:OUT; SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?utf-8?B?TFZqR0lLUVFCUVF4Kyt0L0JmUHhqTmUzSnhlTWUyZWc3c2xkbXhROE9HSmdp?= =?utf-8?B?aWJobFhmVzBocmR5b2lyNXpPbFpPUXhJZDVjMDJOTWdkaW12NTZXM2F5dUQ5?= =?utf-8?B?UHRQcmEvaHFrUlNSaWorUkxhOHdkNXdqUTRhNmE5RWl6RGFOdWRNRmphZWVN?= =?utf-8?B?TmMya3FXUG9LQ01mM0p4Mmx4NWtoc0tCMUdyV3F3YktOa1BQUDdFYlFoM0xx?= =?utf-8?B?Y20xcDVxTXVzT0hnZU5wamZHbStZTkxlcjdMVmF1bzZXMWhGYkF0WGIveTQx?= =?utf-8?B?dVBNZGx6UmtRZ0pydmJvN2dnZVNLTHV4RW1HdzA1QU41cS9raldrNVd2aWdQ?= =?utf-8?B?WnUxeEFJcGNuUlQ0UzhCTlJ4dzdoK3cvSWNKUGIxcnlrWWt2MDRsNGRhMGJ0?= =?utf-8?B?THhycnlQK3dDNVY1M0E4djd2SUlGVi9MekY5U0g1aEtMTnFZVXc2bzhUdzVE?= =?utf-8?B?UTIveGJpWTRRamdlclB5UW1xelJrRmkvczFrWGgrV3paK001NmdyOFI4MHJr?= =?utf-8?B?UnVneWZadStyTmw5ZUZHZmFGcGRUVWRCbFBTNkJxS1BObGowYzF2ZUR2N29w?= =?utf-8?B?TWN4alovMGdiT2g3Q2x4OStGTUtXWlVHMXdvSFFBZ2svNlVCSWN4UHNUZzZX?= =?utf-8?B?cEd1NUlZRGF4Y2tHMVM0UUxGVG5QMzJMMlJKSFNGZTdzUlpCWVVFeGQrK2d5?= =?utf-8?B?Yy9pQTR5NzNTOFgrQ0RPMkNqcGNndDFKR3R1SjU2SnlPbXdvY2VNVEJNMnZG?= =?utf-8?B?elV6NlFhRDNnVG5zYm9mLytqKzF0a09QVExqRHRKVmgvMGp5NTFqYTBSV0F2?= =?utf-8?B?S3RiMUZBb05UOEN3SjJ0dTIvcUtkZGhENFpWWWhqdW1qOWhJVXMyYUw5Y3ov?= =?utf-8?B?Y3FTeW4vZkk5NUMyYWJsQVJVNDNOZXljUDBDUzRraTFOV05CdjloZEVzcXNk?= =?utf-8?B?VTVaMkJFb3QwRmVGTzBxc3g2SzRlTjJ4RG9nSi8vYWpvQWtDcktXazBPaHBI?= =?utf-8?B?Vm4yMURCaUNHRWVNQ2g3SnNYUlIwMkUzL2gzeENVTUVCNDk4dVIzRUhocUJm?= =?utf-8?B?STEycU0ySjZldFZuOGE4VFozd2pYdFZSTlFpdURaMTZPd25RUHhMWkxQdFFS?= =?utf-8?B?UjBLWnBPWWxVeDFLNjNMUGloYU5lS2tMc2t2ZFh6bzVDaWtVV3Y5UG9iYTZm?= =?utf-8?B?QnBLWWRnUjA4MWVWdG84VDNLVGRyT0FWMEN2SXJBUzdmV1NWcUh5R1EwdHZy?= =?utf-8?B?clVOaTNRMFhMa0owNU0wQzYwaS9RWTUzK1AyUDdvVXVONUJnbytGZ3pQdFJo?= =?utf-8?B?cElQL0lieWZmWmlFc0NQZDdLT3FPeHVnZUlBL2swN3c5VFdQRlJqSENFRUZ0?= =?utf-8?B?UHc0a1U2MGZZR04xRWFPS2JYMk00RjJleEkwVWZmOStjZUZBa3J1ZHA0SVlI?= =?utf-8?B?dUJkNjRsS0ZlRHFtUEFPdW04c0lZWGpvYUN4a1VOOXp6MklQR2ttOWhmdmxL?= =?utf-8?B?blhUOVVqN0Z2cWczMis5eVpxUVJWeFpvNTBucElveGZWbThUM2JjMzR0d0pp?= =?utf-8?B?dGlwMUdRaENxSnpUaDV1aitacFFDWDNFb3RGQ2I5NzIyazhqSXZGQW5IQkhI?= =?utf-8?B?Zi8yZjUyMVB1M2tNYnRrMTFpaktrMng3M2hzYmNnRktpcDJBb2JrMFVCc1RE?= =?utf-8?B?Y3YzdWZKYnRHZzlERVkrbDJrRnBUZ0RjVTZ0d2NHc2FhaU5pVEYwOUVrMy9y?= =?utf-8?B?c2d1ZFFMZElrU043R3k4T0hkQ29vYmg2SVRWOUN3a3VYZ3IrWlZ1dVZHSnY1?= =?utf-8?B?WE5RZ3k2SU1vQWRVMjA2ZzNuZlR4M21uODNMeFUvUWh3Z2k2UlR3VitQN3VP?= =?utf-8?B?TnhBaVVCNTBiVlkvNk1BSFVzWlU5bjBYZE42SkZIVCtEQXJqODg5Mkk1K1M4?= =?utf-8?B?UlBsTG4wMW1kWFV4c0o5QVo4STI1QWk4WXFRZ1RwZVY1WVpicGtCN1kzc2Y4?= =?utf-8?B?TW1va1JYTzN1TzZBZmNkTDVhRndYVXNuNGFIcCsvTm1od05Ud2puc2F4UTFJ?= =?utf-8?B?bEk3OFVaMHE2dnRxK2FpT0kxNUNNQzFFS2JoYWZ4MVBUbXh3RVVKamFFZ09T?= =?utf-8?B?WFFLNGpxQnZ0ZDJXaXg5VmtnWXA3ckxSNG5XeXBndzh4cU5ieGVDL1R1NnF4?= =?utf-8?B?UEJadm1KSVBXTmpPK3Jsa1JSWmFUaURyZ2RKeHA5cXJtU0lHNStuQkxvQVVX?= =?utf-8?B?UWVSdzRvcGtabEFxYnhsUGVrUkZIaHlnUXpYNXQ2UWVtMlRqejhjNUhrZVNt?= =?utf-8?Q?n3WTUzILqG6g3zrAqX?=
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: Futurewei.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BY3PR13MB4787.namprd13.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: f7a59db2-191c-4d40-ad6b-08da39b6f664
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 May 2022 16:45:20.6658 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 0fee8ff2-a3b2-4018-9c75-3a1d5591fedc
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: seIZxcUQFBJmacFWA72OqDG6qwFDSJO5a7xH1PRtx91S1mLMFFdNSsCctE3gc/F6YOrnPC2sUQV8Gti8FbFQRw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1PR13MB4773
Archived-At: <https://mailarchive.ietf.org/arch/msg/ippm/n4AXUIgLa6cuB0Njt4eskPe69rw>
Subject: Re: [ippm] Secdir early review of draft-ietf-ippm-ioam-direct-export-07
X-BeenThere: ippm@ietf.org
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: IETF IP Performance Metrics Working Group <ippm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ippm>, <mailto:ippm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ippm/>
List-Post: <mailto:ippm@ietf.org>
List-Help: <mailto:ippm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ippm>, <mailto:ippm-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 19 May 2022 16:45:33 -0000

Hi Stephen,

Thanks for the review. Both concerns are valid and the potential DOS attack threat and mitigation are briefly discussed in the security considerations section. The privacy consideration is the same as in draft-ietf-ippm-ioam-data, also similar to that for IPFIX and Netflow. I think here we need to emphasize that all the data collected are network operation related without user private information. The technology is also supposed to be applied in a single managed domain. We can add some discussion on the privacy issue in the next revision.  

Best regards,
Haoyu

-----Original Message-----
From: Stephen Farrell via Datatracker <noreply@ietf.org> 
Sent: Thursday, May 19, 2022 8:37 AM
To: secdir@ietf.org
Cc: draft-ietf-ippm-ioam-direct-export.all@ietf.org; ippm@ietf.org
Subject: Secdir early review of draft-ietf-ippm-ioam-direct-export-07

Reviewer: Stephen Farrell
Review result: Has Issues

First, apologies for the dramatically late review. I hope this is still useful.

I think there are two issues worth considering:

1. The DEX scheme seems to create a potential for DoS based on storage whereas I think prevously only DoS vectors related to traffic were documented in the IAOM drafts. That's based on a quick scan though so I may have missed it being considered.

2. I see no mention at all of privacy in this draft nor in draft-ietf-ippm-ioam-data - I don't understand why that's ok given that privacy leaks from the kind of metadata collected here can be subtle? Or maybe that's in some other draft?