Re: [nvo3] Working Group Last Call and IPR Poll for draft-ietf-nvo3-geneve-08.txt
Daniel Migault <daniel.migault@ericsson.com> Fri, 01 March 2019 03:07 UTC
Return-Path: <mglt.ietf@gmail.com>
X-Original-To: nvo3@ietfa.amsl.com
Delivered-To: nvo3@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 21F7D130EEE; Thu, 28 Feb 2019 19:07:00 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.879
X-Spam-Level:
X-Spam-Status: No, score=-1.879 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.018, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GFRUQDe6m941; Thu, 28 Feb 2019 19:06:57 -0800 (PST)
Received: from mail-lf1-f65.google.com (mail-lf1-f65.google.com [209.85.167.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ECFA912867A; Thu, 28 Feb 2019 19:06:56 -0800 (PST)
Received: by mail-lf1-f65.google.com with SMTP id d26so226630lfa.1; Thu, 28 Feb 2019 19:06:56 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=JqUPNH0wKt+HlwF+mowwVyarPkuSQU1qPHgJcg/xbZI=; b=KgB9Puiqp3KXRQwM6u8wFbyWVjrweCvmsDtn9ailI1zSR4Yb5ppQiNfo0VbVK48uSo cQ4hENFmWSyF8UIlcWR4Gtu/yFAQ8WxuKZJU6oLOrDvpirLM3Vy/s6gE2ZJ+dVgsk5en 3hfRvnyrm83my5mjFImXRE9dCl3Tv+TfCuDZcAJbPjKyawjcKgqzctjVdj3nMsa5jinp nxzT3hDwyJ1zJPVzaP8dR2r0M2K/Vf6UAnSxY0olHIXN3MNdRonsAVWZSEpcXPAUc+jD sdHk0u+D7SC59YRALzH3+Tn+3sYMjWsOa9+ZT1M2G1yE/acRBGEHiwDyXw/cryAPQv4Q XewQ==
X-Gm-Message-State: APjAAAVnJEsSU+fRCcVxL//rM5wdEhVMER8X2XFJkSH+ZkfxI5YVCCj8 kcpKXJTf9m+gztGdvv8/IGLej8HXk5fJzYMn4gM=
X-Google-Smtp-Source: APXvYqydfOUL3tTSKm6Vf7XKS66rZZNzhgE2RU4jx5gs5MwgnWrdE/TORRK/tgoPAIGY4cyGjXovv2qKljcwwsh2jD8=
X-Received: by 2002:ac2:5387:: with SMTP id g7mr1589354lfh.158.1551409615130; Thu, 28 Feb 2019 19:06:55 -0800 (PST)
MIME-Version: 1.0
References: <C35AB375-99DA-4629-8D67-D8991FF69434@nokia.com> <MWHPR21MB01917E5CF224896CE3B49552B9750@MWHPR21MB0191.namprd21.prod.outlook.com>
In-Reply-To: <MWHPR21MB01917E5CF224896CE3B49552B9750@MWHPR21MB0191.namprd21.prod.outlook.com>
From: Daniel Migault <daniel.migault@ericsson.com>
Date: Thu, 28 Feb 2019 22:06:43 -0500
Message-ID: <CADZyTkmTZkkCQ-r4PcwuzYnevAQkq=iXPatG7LgMFKZ8Z59zdA@mail.gmail.com>
To: Pankaj Garg <pankajg=40microsoft.com@dmarc.ietf.org>
Cc: "Bocci, Matthew (Nokia - GB)" <matthew.bocci@nokia.com>, NVO3 <nvo3@ietf.org>, "draft-ietf-nvo3-geneve@ietf.org" <draft-ietf-nvo3-geneve@ietf.org>
Content-Type: multipart/alternative; boundary="00000000000002d5730582ffb343"
Archived-At: <https://mailarchive.ietf.org/arch/msg/nvo3/5X1ETIpm-RAktn_CkmyiP0t8Fmo>
Subject: Re: [nvo3] Working Group Last Call and IPR Poll for draft-ietf-nvo3-geneve-08.txt
X-BeenThere: nvo3@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Network Virtualization Overlays \(NVO3\) Working Group" <nvo3.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/nvo3>, <mailto:nvo3-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/nvo3/>
List-Post: <mailto:nvo3@ietf.org>
List-Help: <mailto:nvo3-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/nvo3>, <mailto:nvo3-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 01 Mar 2019 03:07:00 -0000
Hi, I just briefly went through the document quickly and in my opinion, the document still faces some security issues. The current text (in my opinion) prevents any geneve security related options. Currently Geneve cannot be secured and this prevents future work to eventually secure Geneve. In my opinion the current text mandates Geneve to remain unsecure. Geneve security option that are willing to authenticate/encrypt a part of the Geneve Header will affect the parsing of the protected option and will affect the order in which option needs to be process. Typically a protected option (authenticated, encrypted) cannot or should not be processed before authenticated or decrypted. This has already been mentioned in [1], and the text needs in my opinion further clarifications. """ o An option SHOULD NOT be dependent upon any other option in the packet, i.e., options can be processed independent of one another. An option MUST NOT affect the parsing or interpretation of any other option. """ As stated in [2] it remains unclear to me why this section is not referencing and leveraging on the security analysis [3-4] performed by two different independent teams. My reading of the security consideration is that the message is that IPsec or TLS could be used to protect a geneve overlay network. This is - in my opinion- not correct as this does not consider the transit device. In addition, the security consideration only considers the case where the cloud provider and the overlay network provider are a single entity, which I believe oversimplifies the problem. The threat model seems to me very vague, so the current security consideration is limited to solving a problem that is not stated. My reading of the text indicates the tenant can handle by itself the confidentiality of its information without necessarily relying on the overlay service provider. This is not correct. Even when the tenant uses IPsec/TLS, it still leaks some information. The current text contradicts [3] section 6.2 and [4] section 5.1. My reading is that the text indicates that IPsec/DTLS could be used to protect the overlay service for both confidentiality and integrity. While this could be used in some deployment this is not compatible with transit devices. As such the generic statement is not correct. Section 6.4 indicates that transit device must be trusted which is incorrect. Instead the transit device with all nodes between the transit device and the NVE needs to be trusted. Overall the impression provided is that IPsec (or TLS) can be used by the service overlay provider, which is (in my opinion) not true. It is unclear to me how authentication of NVE peers differs from the authentication communication as the latest usually rely on the first. Maybe the section should insist on mutual authentication. Yours, Daniel [1] https://mailarchive.ietf.org/arch/msg/nvo3/RFFjYHAUUlMvOsYwRNtdOJOIk9o [2] https://mailarchive.ietf.org/arch/msg/nvo3/e7YHFlqIuOwIJoL2ep7jyHIrSGw [3] https://tools.ietf.org/html/draft-ietf-nvo3-security-requirements-07 [4] https://tools.ietf.org/html/draft-mglt-nvo3-geneve-security-requirements-05 On Wed, Feb 27, 2019 at 7:30 PM Pankaj Garg <pankajg= 40microsoft.com@dmarc.ietf.org> wrote: > I am not aware of any IP related to draft-ietf-nvo3-geneve which has not > already been disclosed. > > > > Thanks > > Pankaj > > > > *From:* Bocci, Matthew (Nokia - GB) <matthew.bocci@nokia.com> > *Sent:* Tuesday, October 9, 2018 2:08 AM > *To:* NVO3 <nvo3@ietf.org> > *Cc:* draft-ietf-nvo3-geneve@ietf.org > *Subject:* Working Group Last Call and IPR Poll for > draft-ietf-nvo3-geneve-08.txt > > > > This email begins a two-week working group last call for > draft-ietf-nvo3-geneve-08.txt. > > > > Please review the draft and post any comments to the NVO3 working group > list. If you have read the latest version of the draft but have no comments > and believe it is ready for publication as a standards track RFC, please > also indicate so to the WG email list. > > > > We are also polling for knowledge of any undisclosed IPR that applies to > this document, to ensure that IPR has been disclosed in compliance with > IETF IPR rules (see RFCs 3979, 4879, 3669 and 5378 for more details). > > If you are listed as an Author or a Contributor of this document, please > respond to this email and indicate whether or not you are aware of any > relevant undisclosed IPR. The Document won't progress without answers from > all the Authors and Contributors. > > > > Currently there are two IPR disclosures against this document. > > > > If you are not listed as an Author or a Contributor, then please > explicitly respond only if you are aware of any IPR that has not yet been > disclosed in conformance with IETF rules. > > > > This poll will run until Friday 26th October. > > > > Regards > > > > Matthew and Sam > _______________________________________________ > nvo3 mailing list > nvo3@ietf.org > https://www.ietf.org/mailman/listinfo/nvo3 >
- [nvo3] Working Group Last Call and IPR Poll for d… Bocci, Matthew (Nokia - GB)
- Re: [nvo3] Working Group Last Call and IPR Poll f… T. Sridhar
- Re: [nvo3] Working Group Last Call and IPR Poll f… Jesse Gross
- Re: [nvo3] Working Group Last Call and IPR Poll f… Ganga, Ilango S
- Re: [nvo3] Working Group Last Call and IPR Poll f… Ganga, Ilango S
- Re: [nvo3] Working Group Last Call and IPR Poll f… Daniel Migault
- Re: [nvo3] Working Group Last Call and IPR Poll f… T. Sridhar
- Re: [nvo3] Working Group Last Call and IPR Poll f… Jon Hudson
- Re: [nvo3] Working Group Last Call and IPR Poll f… Anoop Ghanwani
- Re: [nvo3] Working Group Last Call and IPR Poll f… Greg Mirsky
- Re: [nvo3] Working Group Last Call and IPR Poll f… Ganga, Ilango S
- Re: [nvo3] Working Group Last Call and IPR Poll f… Daniel Migault
- Re: [nvo3] Working Group Last Call and IPR Poll f… Jesse Gross
- Re: [nvo3] Working Group Last Call and IPR Poll f… Jesse Gross
- Re: [nvo3] Working Group Last Call and IPR Poll f… Greg Mirsky
- Re: [nvo3] Working Group Last Call and IPR Poll f… Jesse Gross
- Re: [nvo3] Working Group Last Call and IPR Poll f… Greg Mirsky
- Re: [nvo3] Working Group Last Call and IPR Poll f… Bocci, Matthew (Nokia - GB)
- Re: [nvo3] Working Group Last Call and IPR Poll f… Greg Mirsky
- Re: [nvo3] Working Group Last Call and IPR Poll f… Ganga, Ilango S
- Re: [nvo3] Working Group Last Call and IPR Poll f… Anoop Ghanwani
- Re: [nvo3] Working Group Last Call and IPR Poll f… Ganga, Ilango S
- Re: [nvo3] Working Group Last Call and IPR Poll f… Daniel Migault
- Re: [nvo3] Working Group Last Call and IPR Poll f… Greg Mirsky
- Re: [nvo3] Working Group Last Call and IPR Poll f… Tal Mizrahi
- Re: [nvo3] Working Group Last Call and IPR Poll f… Chris Wright
- Re: [nvo3] Working Group Last Call and IPR Poll f… Dinesh Dutt
- Re: [nvo3] Working Group Last Call and IPR Poll f… Ganga, Ilango S
- Re: [nvo3] Working Group Last Call and IPR Poll f… Ganga, Ilango S
- Re: [nvo3] Working Group Last Call and IPR Poll f… Jesse Gross
- Re: [nvo3] Working Group Last Call and IPR Poll f… Jesse Gross
- Re: [nvo3] Working Group Last Call and IPR Poll f… Greg Mirsky
- Re: [nvo3] Working Group Last Call and IPR Poll f… Greg Mirsky
- Re: [nvo3] Working Group Last Call and IPR Poll f… Jesse Gross
- Re: [nvo3] Working Group Last Call and IPR Poll f… Jesse Gross
- Re: [nvo3] Working Group Last Call and IPR Poll f… Greg Mirsky
- Re: [nvo3] Working Group Last Call and IPR Poll f… Pankaj Garg
- Re: [nvo3] Working Group Last Call and IPR Poll f… Daniel Migault
- Re: [nvo3] Working Group Last Call and IPR Poll f… Bocci, Matthew (Nokia - GB)
- Re: [nvo3] Working Group Last Call and IPR Poll f… Daniel Migault
- Re: [nvo3] Working Group Last Call and IPR Poll f… Bocci, Matthew (Nokia - GB)
- Re: [nvo3] Working Group Last Call and IPR Poll f… Bocci, Matthew (Nokia - GB)
- Re: [nvo3] Working Group Last Call and IPR Poll f… Daniel Migault
- Re: [nvo3] Working Group Last Call and IPR Poll f… Daniel Migault
- Re: [nvo3] Working Group Last Call and IPR Poll f… Ganga, Ilango S
- Re: [nvo3] Working Group Last Call and IPR Poll f… Daniel Migault
- Re: [nvo3] Working Group Last Call and IPR Poll f… Ganga, Ilango S
- Re: [nvo3] Working Group Last Call and IPR Poll f… Joel M. Halpern
- Re: [nvo3] Working Group Last Call and IPR Poll f… Ganga, Ilango S
- Re: [nvo3] Working Group Last Call and IPR Poll f… Joel Halpern Direct
- Re: [nvo3] Working Group Last Call and IPR Poll f… Daniel Migault
- Re: [nvo3] Working Group Last Call and IPR Poll f… Daniel Migault
- Re: [nvo3] Working Group Last Call and IPR Poll f… Ganga, Ilango S
- Re: [nvo3] Working Group Last Call and IPR Poll f… Ganga, Ilango S
- Re: [nvo3] Working Group Last Call and IPR Poll f… Daniel Migault
- Re: [nvo3] Working Group Last Call and IPR Poll f… Daniel Migault
- Re: [nvo3] Working Group Last Call and IPR Poll f… Ganga, Ilango S
- Re: [nvo3] Working Group Last Call and IPR Poll f… Ganga, Ilango S
- Re: [nvo3] Working Group Last Call and IPR Poll f… Daniel Migault
- Re: [nvo3] Working Group Last Call and IPR Poll f… Daniel Migault
- Re: [nvo3] Working Group Last Call and IPR Poll f… Daniel Migault
- Re: [nvo3] Working Group Last Call and IPR Poll f… Jesse Gross
- Re: [nvo3] Working Group Last Call and IPR Poll f… Joe Touch
- Re: [nvo3] Working Group Last Call and IPR Poll f… Daniel Migault
- Re: [nvo3] Working Group Last Call and IPR Poll f… Daniel Migault
- Re: [nvo3] Working Group Last Call and IPR Poll f… Joe Touch
- Re: [nvo3] Working Group Last Call and IPR Poll f… Daniel Migault
- Re: [nvo3] Working Group Last Call and IPR Poll f… Joe Touch
- Re: [nvo3] Working Group Last Call and IPR Poll f… Daniel Migault
- Re: [nvo3] Working Group Last Call and IPR Poll f… Jesse Gross