Re: Éric Vyncke's Discuss on draft-ietf-bfd-vxlan-09: (with DISCUSS and COMMENT)

"Carlos Pignataro (cpignata)" <cpignata@cisco.com> Thu, 19 December 2019 03:22 UTC

Return-Path: <cpignata@cisco.com>
X-Original-To: rtg-bfd@ietfa.amsl.com
Delivered-To: rtg-bfd@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 071BA120018; Wed, 18 Dec 2019 19:22:36 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.498
X-Spam-Level:
X-Spam-Status: No, score=-14.498 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=Kv6nUXWr; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=H//8KHCn
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RtwDm8RPDPQP; Wed, 18 Dec 2019 19:22:33 -0800 (PST)
Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D28F12004F; Wed, 18 Dec 2019 19:22:33 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2718; q=dns/txt; s=iport; t=1576725753; x=1577935353; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=QxgXXmj97AkZkdaEdyrLr9dlUR5Ex8hQSIYzXLD93B4=; b=Kv6nUXWrUEbJxtQzlpZJka365gsax4JTJXNNiAZj0eLvY+JPYOGMcWWp IQ4izRKNp3fHIit1tgcKmAR1scphpOPL2OFi5waiR7WnGGEpBdfWJLNWm SB6fIqWMcKSrcvPzWmWmQkzqeJuN9IaQWVisnle++7d6T/njOMIuvpXJZ o=;
IronPort-PHdr: =?us-ascii?q?9a23=3AlbVWARHcmK8YQyr73TQCPZ1GYnJ96bzpIg4Y7I?= =?us-ascii?q?YmgLtSc6Oluo7vJ1Hb+e4z1Q3SRYuO7fVChqKWqK3mVWEaqbe5+HEZON0pNV?= =?us-ascii?q?cejNkO2QkpAcqLE0r+efXybiM8FdhLfFRk5Hq8d0NSHZW2ag=3D=3D?=
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DgAQBr7Ppd/5FdJa1lGwEBAQEBAQE?= =?us-ascii?q?FAQEBEQEBAwMBAQGBfIFNUAWBRCAECyqEBoNGA4pzgl+BAZcFglIDVAkBAQE?= =?us-ascii?q?MAQEtAgEBhEACF4ICJDgTAgMNAQEEAQEBAgEFBG2FNwyFXgEBAQECARIREQw?= =?us-ascii?q?BATcBBAsCAQYCDgoCAhkNAgICMBUFCwIEDgUigwCCRwMOIAGRV5BkAoE4iGF?= =?us-ascii?q?1gTKCfgEBBYUnGIIQCYEOKIlPgkkagUE/gREnIIIXNT6ESAGDEDKCLI9+OY8?= =?us-ascii?q?2jyAKgjWWFBuaUYNHojGDJwIEAgQFAg4BAQWBaSKBWHAVZQGCQT4SGA2NEgw?= =?us-ascii?q?XFYM7ilN0gSiPQwEB?=
X-IronPort-AV: E=Sophos;i="5.69,330,1571702400"; d="scan'208";a="687662633"
Received: from rcdn-core-9.cisco.com ([173.37.93.145]) by rcdn-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 19 Dec 2019 03:22:32 +0000
Received: from XCH-RCD-008.cisco.com (xch-rcd-008.cisco.com [173.37.102.18]) by rcdn-core-9.cisco.com (8.15.2/8.15.2) with ESMTPS id xBJ3MVw2017519 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 19 Dec 2019 03:22:32 GMT
Received: from xhs-rcd-002.cisco.com (173.37.227.247) by XCH-RCD-008.cisco.com (173.37.102.18) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 18 Dec 2019 21:22:31 -0600
Received: from xhs-aln-001.cisco.com (173.37.135.118) by xhs-rcd-002.cisco.com (173.37.227.247) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 18 Dec 2019 21:22:31 -0600
Received: from NAM04-CO1-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-001.cisco.com (173.37.135.118) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Wed, 18 Dec 2019 21:22:30 -0600
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ACmyKkIWiW9bYr102U0hrUsFgARe6NnUhPNYty1Zn2dPiiWopBOzsRH1uOf4k5H1wTaT5+xiPLkSm8wu+p2+XxeDUQK1YDy+5u3HyBAPP2oXFqUlFEjdn5Dpste+uBdX9yrGsEXc7FeKvVCbCHMjeKfLsYW62Z5gS69dqngv1CaPQIFhVhno4ULnzvl7Nc9f4WkJtrUENab1rxnY7zcoC0l973tw1IkTaPhOjuNHK5fbf07CFJD1nWaeXHnz+HTiOS38zk5Ay9euGHWtv9cTspoBSoCgOaJ8HMbA3iBuGvqRc8LAB4vjIjD8KhVFLmm4EZ5/oj5eMeSNzI7VVedDzw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=QxgXXmj97AkZkdaEdyrLr9dlUR5Ex8hQSIYzXLD93B4=; b=nZzsyJUNa0mQC/W10CNjkSH6/gRh08CAOi30oES2vSHal/z4pw5WlDl0TQmVAk/RBeZSA8YtdsWI2+uvGiUoW6WR8NHuZcxCzUX0ewPnmknExKGzhBr8YwZn0sEqWxRHP/cVjsSmxi/g1e298tof2THoLhKpDhfbZ8oQRwYWl4QU8WBLlqZzflDkISn+B34c2wp9u+sXQbQ4OjqvlY1xOaVsyw4/OCo/34bnAg4bhgVn9W+cpgFMZFuCtgHjes2i532Z0VH/nYKmyJHlZ+Zi5FrxI0A5bYfc446XlqZ6/X8EeYG6+2hofJAJOFOTNLuzNET+EVl4CEws43VzFMnmgQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=QxgXXmj97AkZkdaEdyrLr9dlUR5Ex8hQSIYzXLD93B4=; b=H//8KHCnzJ+0hMbi9yy4kHazR0cbmDYpu08CpFkIcX7XjcDEs0hVX/101yQtKKtBj87aOAj8Oh8ahPpK5Xp0nhLHhx9cpM3r4T8PQTK9F+G/a9+WGOITJmZuYaH7Do4l6cH28wmcncTucaNMJqt/fXMyEfRZSSTuC9u6J06p5uQ=
Received: from BN6PR11MB0034.namprd11.prod.outlook.com (10.161.156.160) by BN6PR11MB1459.namprd11.prod.outlook.com (10.172.21.22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2559.14; Thu, 19 Dec 2019 03:22:29 +0000
Received: from BN6PR11MB0034.namprd11.prod.outlook.com ([fe80::d4cf:20e6:8706:d006]) by BN6PR11MB0034.namprd11.prod.outlook.com ([fe80::d4cf:20e6:8706:d006%5]) with mapi id 15.20.2538.019; Thu, 19 Dec 2019 03:22:29 +0000
From: "Carlos Pignataro (cpignata)" <cpignata@cisco.com>
To: Jeff Haas <jhaas@pfrc.org>
CC: "rtg-bfd@ietf.org" <rtg-bfd@ietf.org>, "Eric Vyncke (evyncke)" <evyncke@cisco.com>, "draft-ietf-bfd-vxlan@ietf.org" <draft-ietf-bfd-vxlan@ietf.org>, The IESG <iesg@ietf.org>, "bfd-chairs@ietf.org" <bfd-chairs@ietf.org>
Subject: =?utf-8?B?UmU6IMOJcmljIFZ5bmNrZSdzIERpc2N1c3Mgb24gZHJhZnQtaWV0Zi1iZmQt?= =?utf-8?Q?vxlan-09:_(with_DISCUSS_and_COMMENT)?=
Thread-Topic: =?utf-8?B?w4lyaWMgVnluY2tlJ3MgRGlzY3VzcyBvbiBkcmFmdC1pZXRmLWJmZC12eGxh?= =?utf-8?Q?n-09:_(with_DISCUSS_and_COMMENT)?=
Thread-Index: AQHVtLc75ryADAJO5Ui6+24NC5naA6e+kjMAgAHIsoD//7wKAIAAV1IAgABfYYA=
Date: Thu, 19 Dec 2019 03:22:28 +0000
Message-ID: <B88794A5-553E-453D-8CAF-1D05FCA56C1E@cisco.com>
References: <157657269782.26511.12421406428553874826.idtracker@ietfa.amsl.com> <CED2B858-AC55-4B0A-ADA2-AC46B628E6DA@cisco.com> <20191218203145.GD6488@pfrc.org> <FE5AEE55-9F03-49E9-89C3-6C9700C8683E@cisco.com> <20191218214102.GF6488@pfrc.org>
In-Reply-To: <20191218214102.GF6488@pfrc.org>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-mailer: Apple Mail (2.3608.40.2.2.4)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=cpignata@cisco.com;
x-originating-ip: [2600:1700:760:21aa:e09b:cbbd:7c40:1c9c]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 101eac64-af56-4c7b-64bb-08d78432ad91
x-ms-traffictypediagnostic: BN6PR11MB1459:
x-ms-exchange-transport-forked: True
x-microsoft-antispam-prvs: <BN6PR11MB14599B69BDA4CB45781F33E6C7520@BN6PR11MB1459.namprd11.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:10000;
x-forefront-prvs: 0256C18696
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(376002)(346002)(366004)(39860400002)(136003)(199004)(189003)(6486002)(186003)(478600001)(4326008)(36756003)(33656002)(86362001)(6512007)(2616005)(54906003)(316002)(66574012)(81156014)(76116006)(66446008)(66556008)(66946007)(64756008)(5660300002)(6916009)(71200400001)(8936002)(81166006)(6506007)(224303003)(66476007)(2906002); DIR:OUT; SFP:1101; SCL:1; SRVR:BN6PR11MB1459; H:BN6PR11MB0034.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1;
received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: tBqpqZPslnRUTCaGfDNietB4EmAZAu+0TYdiolJnrfRE/gZxpf9hKXb7FZ951zuyggUAk2nfA0NVT+MzqLzwAjPHOjncjEQVD3H3mzLvqiywzkePvaoeELj2b6vkkKb9c4VYxdAiy2HcQSSIv9jknbzPXIdE+8AevCxl29ciUxVQoIaEJ4v31jVV0kgv2H1e5J4Cz/AZ7k9IL40908QQcDt3joHsxwC1q7fCwkVSy03m/x9rzPRq9e5AI+A8LEHrpIuoh6ZA1zjcEy2XkxOMPKxuDssgMojKQrOq/GxJemE+rvR9L3Gn/r7zSFK1l2Qr57JDZstGvzweIEjpzP+zC1EK7VmQ4on0AT37LdFCmV7lRyWTDJhNCbb3Z9o/UZ5NrbayZIG7Fgnkmz6UzhxvSFQHk1D92CNgTq/9ift23uv4n0nVRaJlhJA5rTHQ529m
Content-Type: text/plain; charset="utf-8"
Content-ID: <93F47CF87E15B547AF7AC25476EBF783@namprd11.prod.outlook.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 101eac64-af56-4c7b-64bb-08d78432ad91
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Dec 2019 03:22:28.9153 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: DxJfpet7uNVULMVIWiETABV7NKSbBGsGKEmY93EjC5E/0bt7uwrpVBi8qOWheSiVgBZCpEOeoUgYoE3klLcj+g==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR11MB1459
X-OriginatorOrg: cisco.com
X-Outbound-SMTP-Client: 173.37.102.18, xch-rcd-008.cisco.com
X-Outbound-Node: rcdn-core-9.cisco.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/rtg-bfd/OhxxjJKbD6fpUdkynC-LpHehVss>
X-BeenThere: rtg-bfd@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "RTG Area: Bidirectional Forwarding Detection DT" <rtg-bfd.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rtg-bfd>, <mailto:rtg-bfd-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/rtg-bfd/>
List-Post: <mailto:rtg-bfd@ietf.org>
List-Help: <mailto:rtg-bfd-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rtg-bfd>, <mailto:rtg-bfd-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 19 Dec 2019 03:22:36 -0000

Hi, Jeff,

> 2019/12/18 午後4:41、Jeffrey Haas <jhaas@pfrc.org>のメールt;のメール:
> 
> Carlos,
> 
> On Wed, Dec 18, 2019 at 09:28:30PM +0000, Carlos Pignataro (cpignata) wrote:
>> The TTL of 1 recommended for RFC 4379 / RFC 8029 S4.3 is because if the MPLS packet is mis-routed, or there's a forwarding mis-programming, then an MPLS LSE pop would expose the BFD packet and so that the BFD is not further mis-forwarded.
>> 
>> In the VXLAN case an intermediate router would not remove the VXLAN encap because the outer encap is IP (with a destination address, not an MPLS Label that can be mis-interpreted in context) and a mid-point router would not understand VXLAN.
> 
> Explained, that now seems obvious.  Thanks. :-)
> 
> But given that point, what precisely is the objection to the inner IP header
> of the BFD for vxlan having a TTL of 1?

The intent would be to protect of potential attacks beyond the encapsulating endpoint (i.e., packet coming into the VTEP vs. sourced, off-link spoofing).

> 
> I think this is partially a matter of attack spaces varying depending on
> whether we're targeting the management VNI vs. a tenant.  In the case of the
> management VNI, we (should) have very strong control over what BFD traffic
> is getting encapsulated.  
> 
> However, for tenant VNI mode, is the argument that depending on what the
> other vxlan PDU parameters look like, tenant sourced BFD PDUs may be
> indistinguishable from ones sourced by the management infrastructure?  And
> if so, how would GTSM help us here?

Tenant sourced BFD PDUs would not use host loopback dest addresses. Scanning through S6 of draft-ietf-bfd-vxlan-09, "MAY support the use of the Management VNI”.

And if there are already protections for not over-forwarding the BFD pak, the flip-question is “what does TTL = 1 bug you?”

My assumption was that if the base BFD specs say “GSTM is useful”, why not here?

Thanks,

Carlos.

> 
> -- Jeff
>