Re: [lisp] Roman Danyliw's Discuss on draft-ietf-lisp-6834bis-12: (with DISCUSS and COMMENT)

[Roman Danyliw <[e-mail]>]

Hi Luigi!

Thanks for the updated text in -13/-14.  It addresses my DISCUSS feedback.  I’ve cleared m ballot.

Roman

From: Luigi Iannone <[e-mail]>
Sent: Thursday, June 2, 2022 7:41 AM
To: Roman Danyliw <[e-mail]>
Cc: The IESG <[e-mail]>; [e-mail]; [e-mail]; [e-mail] list <[e-mail]>; Padma Pillay-Esnault <[e-mail]>
Subject: Re: Roman Danyliw's Discuss on draft-ietf-lisp-6834bis-12: (with DISCUSS and COMMENT)

Hi Roman,

Thank you very much for your review.

Please see my comments inline.


On 1 Jun 2022, at 20:54, Roman Danyliw via Datatracker <[e-mail]<mailto:[e-mail]>> wrote:

Roman Danyliw has entered the following ballot position for
draft-ietf-lisp-6834bis-12: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-lisp-6834bis/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

On the -11 document, I initial wrote the following: The SECDIR review by Donald
Eastlake asked about handling roll-over/wrap-around of the Map Version Number.
Specifically, can a “Map Version Number advance[e] … so quickly that an old
version number is encountered that appears to be newer than or equal to the
current version number. Why can't this happen? Or if it can, why doesn't that
hurt?”  It would appear that a number of the conclusions of the ITR or ETR on
arriving packets in Section 7.1 and 7.2 wouldn’t be correct.

I then saw the -12 document published on June 1 which added the following text
to Section 7:
  Map Version Number incrementing
  and mappings' TTL MUST be managed so that an old version number will
  not be confused as a new version number.

Thank you for adding this text.  Practically, this identifies the desired
intent, but doesn’t seem describe the mechanics.

Yes, you are right. We were discussing this with Donald and Alvaro as well.



 Can more be said about how
this confusion will be mitigated at the ITR/ETRs?  I also don't follow how to
use the TTLs here.

In revision -13 the previous text has been changed in:

Mapping updates, and their corresponding Map Version Number must be managed so that a very old version number will not be confused as a new version number (because of the circular numbering space). To this end simple measures can be taken, like updating a mapping only when all active traffic is using the latest version, or waiting sufficient time to be sure that mapping in LISP caches expire, which means waiting at least as much as the mapping Time-To-Live (as defined in <xref target="I-D.ietf-lisp-rfc6833bis"/>).

Do you consider this text enough?



Consider the situation that Donald noted where the Map Version advanced so
quickly that it wraps around so that:

(a) the new Map Version Number value equals the old Map Version Number.  If one
followed the guidance in Section 7.1 of:
  1.  The packet arrives with the same Dest Map-Version number stored
      in the EID-to-RLOC Database.  This is the regular case.  The ITR
      sending the packet has in its EID-to-RLOC Map-Cache an up-to-date
      mapping.  No further actions are needed.

It would seem that the ITR wouldn’t do a Map-Request and would misroute the
packet based on the old mapping.

That is correct.
But if you operate as suggested in the new text this situation will not happen.




(b) the new Map Version Number is now smaller (but in fact fresher/newer)  If
one followed the guidance of Section 7.1. of:

3.  The packets arrive with a Dest Map-Version number smaller (i.e.,
      older) than the one stored in the EID-to-RLOC Database.  This
      means that the ITR sending the packet has an old mapping in its
      EID-to-RLOC Map-Cache containing stale information.

Per bullet #3, if there was wrap-around would the ITR in fact be sending stale
mapping information?

This is just me overlooking previous comments.
The text should be in the same form as the second bullet.
In revision -13 it is now:

The packet arrives with a Dest Map-Version number older (as
       defined in Section 6) than the one stored in the EID-to-RLOC
       Database.






----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you to Donald Eastlake for the SECDIR review.

I support Paul Wouter’s DISCUSS position.

IMO that DISCUSS was fixed in revision -12 already.
I copy at the end of this mail my answer to Paul (I did not receive anything back from him yet).

Thanks again.

Please let me know if revision -13 addresses your concerns.

Ciao

Luigi

-----------------
Hi Paul,

I understand the concerns, but I think you did not read revision -12 of the document.
Please see inline.


On 1 Jun 2022, at 17:43, Paul Wouters via Datatracker <[e-mail]<mailto:[e-mail]>> wrote:

Paul Wouters has entered the following ballot position for
draft-ietf-lisp-6834bis-12: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-lisp-6834bis/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Changed my comments to a DISCUSS, as Donald Eastlake also pointed these out in
his secdir review, and I am now convinced we need better text to address this.

#1  map-version rollover is defined (to skip the 0 version) but I also see:

The packet arrives with a Dest Map-Version number greater (i.e.,
      newer) than the one stored in the EID-to-RLOC Database.  Since
      the ETR is authoritative on the mapping, meaning that the Map-
      Version number of its mapping is the correct one

This would imply rollover to a smaller number is not expected to occur ?

The text is now:


The packet arrives with a Dest Map-Version number newer (as

       defined in Section 6<https://datatracker.ietf.org/doc/html/draft-ietf-lisp-6834bis-12#section-6>) than the one stored in the EID-to-RLOC

       Database.  Since the ETR is authoritative on the mapping, meaning

       that the Map-Version number of its mapping is the correct one,

       this implies that someone is not behaving correctly with respect

       to the specifications.  In this case, the packet carries a

       version number that is not valid and packet MUST be silently

       dropped.





#2 MUST NOT or SHOULD ?

Map-Versioning MUST NOT be used over the public Internet and SHOULD only be
used in trusted and closed deployments.

This sentence seems to contradict itself. I would turn the SHOULD into a MUST

The first paragraph of Section 8 “Security Considerations” is now:


 This document builds on the specification and operation of the LISP

   control and data planes.  The Security Considerations of

   [I-D.ietf-lisp-rfc6830bis<https://datatracker.ietf.org/doc/html/draft-ietf-lisp-6834bis-12#ref-I-D.ietf-lisp-rfc6830bis>] and [I-D.ietf-lisp-rfc6833bis<https://datatracker.ietf.org/doc/html/draft-ietf-lisp-6834bis-12#ref-I-D.ietf-lisp-rfc6833bis>] apply and,

   as such, Map-Versioning MUST NOT be used over the public Internet and

   MUST only be used in trusted and closed deployments.  A thorough

   security analysis of LISP is documented in [RFC7835<https://datatracker.ietf.org/doc/html/rfc7835>].


As you can see the SHOULD is already changed in a MUST.


Do you consider that the above address your concerns?

Ciao

L.