Re: [lisp] Roman Danyliw's Discuss on draft-ietf-lisp-6834bis-12: (with DISCUSS and COMMENT)

[Alvaro Retana <[e-mail]>]

Hi roman!

Can you please take.a look at -13?  Does it address your concerns?

As Luigi mentioned, we were discussing some of the same text with Donald in
the SECDIR review thread [1].  You might also want to follow up there.

Thanks!

Alvaro.


[1]
https://mailarchive.ietf.org/arch/msg/last-call/GHK4uqFcppRSSdbzvzQxQJj0p0A/


On June 2, 2022 at 7:40:50 AM, Luigi Iannone ([e-mail]) wrote:

Hi Roman,

Thank you very much for your review.

Please see my comments inline.

On 1 Jun 2022, at 20:54, Roman Danyliw via Datatracker <[e-mail]>
wrote:

Roman Danyliw has entered the following ballot position for
draft-ietf-lisp-6834bis-12: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to
https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-lisp-6834bis/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

On the -11 document, I initial wrote the following: The SECDIR review by
Donald
Eastlake asked about handling roll-over/wrap-around of the Map Version
Number.
Specifically, can a “Map Version Number advance[e] … so quickly that an old
version number is encountered that appears to be newer than or equal to the
current version number. Why can't this happen? Or if it can, why doesn't
that
hurt?”  It would appear that a number of the conclusions of the ITR or ETR
on
arriving packets in Section 7.1 and 7.2 wouldn’t be correct.

I then saw the -12 document published on June 1 which added the following
text
to Section 7:
  Map Version Number incrementing
  and mappings' TTL MUST be managed so that an old version number will
  not be confused as a new version number.

Thank you for adding this text.  Practically, this identifies the desired
intent, but doesn’t seem describe the mechanics.


Yes, you are right. We were discussing this with Donald and Alvaro as well.


 Can more be said about how
this confusion will be mitigated at the ITR/ETRs?  I also don't follow how
to
use the TTLs here.


In revision -13 the previous text has been changed in:

Mapping updates, and their corresponding Map Version Number must be managed
so that a very old version number will not be confused as a new version
number (because of the circular numbering space). To this end simple
measures can be taken, like updating a mapping only when all active traffic
is using the latest version, or waiting sufficient time to be sure that
mapping in LISP caches expire, which means waiting at least as much as the
mapping Time-To-Live (as defined in <xref
target="I-D.ietf-lisp-rfc6833bis"/>).

Do you consider this text enough?


Consider the situation that Donald noted where the Map Version advanced so
quickly that it wraps around so that:

(a) the new Map Version Number value equals the old Map Version Number.  If
one
followed the guidance in Section 7.1 of:
  1.  The packet arrives with the same Dest Map-Version number stored
      in the EID-to-RLOC Database.  This is the regular case.  The ITR
      sending the packet has in its EID-to-RLOC Map-Cache an up-to-date
      mapping.  No further actions are needed.

It would seem that the ITR wouldn’t do a Map-Request and would misroute the
packet based on the old mapping.


That is correct.
But if you operate as suggested in the new text this situation will not
happen.



(b) the new Map Version Number is now smaller (but in fact fresher/newer)
 If
one followed the guidance of Section 7.1. of:

3.  The packets arrive with a Dest Map-Version number smaller (i.e.,
      older) than the one stored in the EID-to-RLOC Database.  This
      means that the ITR sending the packet has an old mapping in its
      EID-to-RLOC Map-Cache containing stale information.

Per bullet #3, if there was wrap-around would the ITR in fact be sending
stale
mapping information?


This is just me overlooking previous comments.
The text should be in the same form as the second bullet.
In revision -13 it is now:

The packet arrives with a Dest Map-Version number older (as
       defined in Section 6) than the one stored in the EID-to-RLOC
       Database.





----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you to Donald Eastlake for the SECDIR review.

I support Paul Wouter’s DISCUSS position.


IMO that DISCUSS was fixed in revision -12 already.
I copy at the end of this mail my answer to Paul (I did not receive
anything back from him yet).

Thanks again.

Please let me know if revision -13 addresses your concerns.

Ciao

Luigi

-----------------
Hi Paul,

I understand the concerns, but I think you did not read revision -12 of the
document.
Please see inline.

On 1 Jun 2022, at 17:43, Paul Wouters via Datatracker <[e-mail]>
wrote:

Paul Wouters has entered the following ballot position for
draft-ietf-lisp-6834bis-12: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to
https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/

for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-lisp-6834bis/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Changed my comments to a DISCUSS, as Donald Eastlake also pointed these out
in
his secdir review, and I am now convinced we need better text to address
this.

#1  map-version rollover is defined (to skip the 0 version) but I also see:

The packet arrives with a Dest Map-Version number greater (i.e.,
      newer) than the one stored in the EID-to-RLOC Database.  Since
      the ETR is authoritative on the mapping, meaning that the Map-
      Version number of its mapping is the correct one

This would imply rollover to a smaller number is not expected to occur ?


The text is now:

The packet arrives with a Dest Map-Version number newer (as
       defined in Section 6
<https://datatracker.ietf.org/doc/html/draft-ietf-lisp-6834bis-12#section-6>)
than the one stored in the EID-to-RLOC
       Database.  Since the ETR is authoritative on the mapping, meaning
       that the Map-Version number of its mapping is the correct one,
       this implies that someone is not behaving correctly with respect
       to the specifications.  In this case, the packet carries a
       version number that is not valid and packet MUST be silently
       dropped.





#2 MUST NOT or SHOULD ?

Map-Versioning MUST NOT be used over the public Internet and SHOULD only be
used in trusted and closed deployments.

This sentence seems to contradict itself. I would turn the SHOULD into a
MUST


The first paragraph of Section 8 “Security Considerations” is now:

 This document builds on the specification and operation of the LISP
   control and data planes.  The Security Considerations of
   [I-D.ietf-lisp-rfc6830bis
<https://datatracker.ietf.org/doc/html/draft-ietf-lisp-6834bis-12#ref-I-D.ietf-lisp-rfc6830bis>]
and [I-D.ietf-lisp-rfc6833bis
<https://datatracker.ietf.org/doc/html/draft-ietf-lisp-6834bis-12#ref-I-D.ietf-lisp-rfc6833bis>]
apply and,
   as such, Map-Versioning MUST NOT be used over the public Internet and
   MUST only be used in trusted and closed deployments.  A thorough
   security analysis of LISP is documented in [RFC7835
<https://datatracker.ietf.org/doc/html/rfc7835>].



As you can see the SHOULD is already changed in a MUST.


Do you consider that the above address your concerns?

Ciao

L.