Re: Segment Routing Drafts

[Fred Baker <[e-mail]>]

Having it generally useful is a plus. What would help me is a vision, probably a few paragraphs, about how it is expected to be used. For example, I would presume that the target system is expected to maintain some counters and dump them on command. Thinking through the security implications, so now I have a flood dumping those counters, and I can determine which systems seem to be seeing a lot of traffic. They might be interesting targets...

> On Mar 7, 2019, at 5:23 AM, Ron Bonica <[e-mail]> wrote:
> 
> Brian, Fred,
> 
> Thanks for these comments. The Security Considerations Section has been rewritten as follows:
> 
> " The OAM option can also be used in denial of service attacks. Network devices SHOULD protect themselves against such attacks by limiting the number of OAM options that they process per unit time. If the rate limit is exceeded, the network device MAY either discard the packet or continue to process the packet, ignoring the OAM option."
> 
> While the OAM option offers an alternative to the SRv6 OAM bit, its applicability is not restricted to SRv6. It is applicable in any IPv6 packet.
> 
>                                                                                                   Ron
> 
> 
>> -----Original Message-----
>> From: Brian E Carpenter <[e-mail]>
>> Sent: Friday, March 1, 2019 7:23 PM
>> To: Fred Baker <[e-mail]>; Ron Bonica
>> <[e-mail]>
>> Cc: IPv6 List <[e-mail]>
>> Subject: Re: Segment Routing Drafts
>> 
>> On 02-Mar-19 11:25, Fred Baker wrote:
>>> 
>>> 
>>>> On Feb 27, 2019, at 8:22 PM, Ron Bonica
>> <rbonica=[e-mail]> wrote:
>>>> -
>>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf
>>>> .org_doc_draft-2Dbonica-2D6man-
>> 2Doam_&d=DwICaQ&c=HAkYuh63rsuhr6Scbfh0
>>>> UjBXeMK-ndb3voDTXcWzoCI&r=Fch9FQ82sir-BoLx84hKuKwl-
>> AWF2EfpHcAwrDThKP8
>>>> &m=fA-
>> M3FuAMPPT1Vz39C2CSoahbM305dnBjaZxsUnSkw8&s=UrTODtxAc6CDYfNq
>> asws
>>>> GetVveWmZuh3Iy5UCVRnOxc&e=
>>> 
>>> I read this draft, and was immediately puzzled. The OAM option is useful if
>> and only if it is implemented and configured, and (per the security
>> considerations) is a reason the packet should not be permitted to enter aa
>> subsequent network.
>> 
>> The text is confusing. It says:
>> 
>>   Network operators should block packets containing these extension
>>   headers at their boundary.
>> 
>> I hope that that is meant to say:
>> 
>>   Network operators should block packets containing the OAM option
>>   at their boundary.
>> 
>> Because clearly it is way out of scope for this draft to address firewall
>> recommendations in general (which anyway are covered by draft-ietf-opsec-
>> ipv6-eh-filtering, currently "Waiting_for_AD_Go-Ahead").
>> 
>>> As such, it is only useful on a small subset of the systems it encounters, and
>> only in the originating network.
>>> 
>>> Am I reading this correctly?
>> 
>> Well, if it is intended as part of the segment routing specs, that needs to be
>> stated in the draft. If so, it presumably inherits the property of segment
>> routing that it only works within a Segment Routing Domain
>> (https://urldefense.proofpoint.com/v2/url?u=https-
>> 3A__tools.ietf.org_html_rfc8402-23page-
>> 2D6&d=DwICaQ&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-
>> ndb3voDTXcWzoCI&r=Fch9FQ82sir-BoLx84hKuKwl-
>> AWF2EfpHcAwrDThKP8&m=fA-
>> M3FuAMPPT1Vz39C2CSoahbM305dnBjaZxsUnSkw8&s=Bg0e57opW73bkN5
>> KGBqF0IB31ou5hvoNF9hvaf6HKSM&e=)
>> and the OAM option would be blocked at the domain boundary.
>> 
>> Which is one of the motivations for draft-carpenter-limited-domains, of
>> course.
>> 
>>    Brian

--------------------------------------------------------------------------------
The fact that there is a highway to hell and a stairway to heaven is an interesting comment on projected traffic volume...