Re: [secdir] secdir review of draft-ietf-trill-directory-framework-05

Charlie Kaufman <charliek@microsoft.com> Sat, 13 July 2013 03:46 UTC

Return-Path: <charliek@microsoft.com>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3A0CC11E817F; Fri, 12 Jul 2013 20:46:48 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 1.533
X-Spam-Level: *
X-Spam-Status: No, score=1.533 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, SARE_RAND_6=2, UNRESOLVED_TEMPLATE=3.132]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UZnl9++GxYSR; Fri, 12 Jul 2013 20:46:41 -0700 (PDT)
Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2lp0239.outbound.protection.outlook.com [207.46.163.239]) by ietfa.amsl.com (Postfix) with ESMTP id 2E2C611E80E4; Fri, 12 Jul 2013 20:46:40 -0700 (PDT)
Received: from BN1BFFO11FD016.protection.gbl (10.58.52.202) by BN1BFFO11HUB027.protection.gbl (10.58.53.137) with Microsoft SMTP Server (TLS) id 15.0.717.3; Sat, 13 Jul 2013 03:46:39 +0000
Received: from TK5EX14MLTC104.redmond.corp.microsoft.com (131.107.125.37) by BN1BFFO11FD016.mail.protection.outlook.com (10.58.53.76) with Microsoft SMTP Server (TLS) id 15.0.717.3 via Frontend Transport; Sat, 13 Jul 2013 03:46:39 +0000
Received: from ch1outboundpool.messaging.microsoft.com (157.54.51.114) by mail.microsoft.com (157.54.79.159) with Microsoft SMTP Server (TLS) id 14.3.136.1; Sat, 13 Jul 2013 03:46:38 +0000
Received: from mail114-ch1-R.bigfish.com (10.43.68.251) by CH1EHSOBE001.bigfish.com (10.43.70.51) with Microsoft SMTP Server id 14.1.225.22; Sat, 13 Jul 2013 03:46:37 +0000
Received: from mail114-ch1 (localhost [127.0.0.1]) by mail114-ch1-R.bigfish.com (Postfix) with ESMTP id 190691C0472; Sat, 13 Jul 2013 03:46:37 +0000 (UTC)
X-Forefront-Antispam-Report-Untrusted: CIP:157.56.240.21; KIP:(null); UIP:(null); (null); H:BL2PRD0310HT005.namprd03.prod.outlook.com; R:internal; EFV:INT
X-SpamScore: -39
X-BigFish: PS-39(zz98dI9371I542I1432Ibf3W4015I1447Izz1f42h1ee6h1de0h1fdah2073h1202h1e76h1d1ah1d2ah1fc6hz8dhz1033IL8275bh8275dhz31h2a8h668h839h944hd24hf0ah1220h1288h12a5h12a9h12bdh137ah13b6h1441h1504h1537h153bh162dh1631h1758h18e1h1946h19b5h19ceh1ad9h1b0ah1d07h1d0ch1d2eh1d3fh1de9h1dfeh1dffh1e1dh9a9j1155h)
Received-SPF: softfail (mail114-ch1: transitioning domain of microsoft.com does not designate 157.56.240.21 as permitted sender) client-ip=157.56.240.21; envelope-from=charliek@microsoft.com; helo=BL2PRD0310HT005.namprd03.prod.outlook.com ; .outlook.com ;
X-Forefront-Antispam-Report-Untrusted: SFV:NSPM; SFS:(199002)(189002)(24454002)(51704005)(164054003)(30594002)(377454003)(13464003)(51914003)(51856001)(77096001)(56776001)(59766001)(46102001)(56816003)(80022001)(76576001)(76796001)(76482001)(53806001)(74366001)(49866001)(74502001)(69226001)(76786001)(83072001)(74316001)(54356001)(4396001)(54316002)(65816001)(66066001)(16406001)(63696002)(33646001)(47736001)(74662001)(74876001)(31966008)(50986001)(47976001)(47446002)(79102001)(74706001)(77982001)(81342001)(81542001)(1411001)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:BL2PR03MB592; H:BL2PR03MB592.namprd03.prod.outlook.com; CLIP:50.46.151.49; RD:InfoNoRecords; A:1; MX:1; LANG:en;
Received: from mail114-ch1 (localhost.localdomain [127.0.0.1]) by mail114-ch1 (MessageSwitch) id 137368719562702_25594; Sat, 13 Jul 2013 03:46:35 +0000 (UTC)
Received: from CH1EHSMHS015.bigfish.com (snatpool1.int.messaging.microsoft.com [10.43.68.241]) by mail114-ch1.bigfish.com (Postfix) with ESMTP id F417D20047; Sat, 13 Jul 2013 03:46:34 +0000 (UTC)
Received: from BL2PRD0310HT005.namprd03.prod.outlook.com (157.56.240.21) by CH1EHSMHS015.bigfish.com (10.43.70.15) with Microsoft SMTP Server (TLS) id 14.16.227.3; Sat, 13 Jul 2013 03:46:34 +0000
Received: from BL2PR03MB592.namprd03.prod.outlook.com (10.255.109.35) by BL2PRD0310HT005.namprd03.prod.outlook.com (10.255.97.40) with Microsoft SMTP Server (TLS) id 14.16.329.3; Sat, 13 Jul 2013 03:46:33 +0000
Received: from BL2PR03MB592.namprd03.prod.outlook.com (10.255.109.35) by BL2PR03MB592.namprd03.prod.outlook.com (10.255.109.35) with Microsoft SMTP Server (TLS) id 15.0.731.11; Sat, 13 Jul 2013 03:46:32 +0000
Received: from BL2PR03MB592.namprd03.prod.outlook.com ([169.254.11.121]) by BL2PR03MB592.namprd03.prod.outlook.com ([169.254.11.121]) with mapi id 15.00.0731.000; Sat, 13 Jul 2013 03:46:31 +0000
From: Charlie Kaufman <charliek@microsoft.com>
To: Donald Eastlake <d3e3e3@gmail.com>
Thread-Topic: [secdir] secdir review of draft-ietf-trill-directory-framework-05
Thread-Index: Ac598XBBv+Y+ucf3RaayD+kk4dv1wQBcszoAAAXSzzA=
Date: Sat, 13 Jul 2013 03:46:31 +0000
Message-ID: <d020d053284a4d5b8ad2f35a431ed284@BL2PR03MB592.namprd03.prod.outlook.com>
References: <6d411f21bfcb4636a4d9d234cec91bd0@BL2PR03MB592.namprd03.prod.outlook.com> <CAF4+nEEiWEez1mS+_YsoCsA8zePhK16hohUhA+qHGrRLu9rwZQ@mail.gmail.com>
In-Reply-To: <CAF4+nEEiWEez1mS+_YsoCsA8zePhK16hohUhA+qHGrRLu9rwZQ@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [50.46.151.49]
x-forefront-prvs: 0906E83A25
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OrganizationHeadersPreserved: BL2PR03MB592.namprd03.prod.outlook.com
X-FOPE-CONNECTOR: Id%0$Dn%*$RO%0$TLS%0$FQDN%$TlsDn%
X-FOPE-CONNECTOR: Id%59$Dn%IETF.ORG$RO%2$TLS%6$FQDN%corpf5vips-237160.customer.frontbridge.com$TlsDn%
X-FOPE-CONNECTOR: Id%59$Dn%TOOLS.IETF.ORG$RO%2$TLS%6$FQDN%corpf5vips-237160.customer.frontbridge.com$TlsDn%
X-FOPE-CONNECTOR: Id%59$Dn%GMAIL.COM$RO%2$TLS%6$FQDN%corpf5vips-237160.customer.frontbridge.com$TlsDn%
X-CrossPremisesHeadersPromoted: TK5EX14MLTC104.redmond.corp.microsoft.com
X-CrossPremisesHeadersFiltered: TK5EX14MLTC104.redmond.corp.microsoft.com
X-Forefront-Antispam-Report: CIP:131.107.125.37; CTRY:US; IPV:CAL; IPV:NLI; EFV:NLI; SFV:NSPM; SFS:(51914003)(189002)(24454002)(30594002)(377454003)(164054003)(51704005)(13464003)(199002)(76786001)(46406003)(46102001)(76482001)(33646001)(1411001)(79102001)(74502001)(56776001)(23726002)(80022001)(76796001)(74316001)(4396001)(74876001)(69226001)(50986001)(16676001)(20776003)(81542001)(47776003)(76576001)(74662001)(50466002)(74706001)(31966008)(66066001)(77096001)(83072001)(47976001)(81342001)(54316002)(6806004)(47736001)(59766001)(74366001)(65816001)(47446002)(54356001)(77982001)(49866001)(44976005)(51856001)(56816003)(63696002)(53806001)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:BN1BFFO11HUB027; H:TK5EX14MLTC104.redmond.corp.microsoft.com; CLIP:131.107.125.37; RD:InfoDomainNonexistent; MX:1; A:1; LANG:en;
X-OriginatorOrg: microsoft.onmicrosoft.com
X-O365ENT-EOP-Header: Message processed by - O365_ENT: Allow from ranges (Engineering ONLY)
X-Forefront-PRVS: 0906E83A25
Cc: "draft-ietf-trill-directory-framework.all@tools.ietf.org" <draft-ietf-trill-directory-framework.all@tools.ietf.org>, "iesg@ietf.org" <iesg@ietf.org>, "secdir@ietf.org" <secdir@ietf.org>
Subject: Re: [secdir] secdir review of draft-ietf-trill-directory-framework-05
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 13 Jul 2013 03:46:48 -0000

Sounds great!

	--Charlie

-----Original Message-----
From: Donald Eastlake [mailto:d3e3e3@gmail.com] 
Sent: Friday, July 12, 2013 6:00 PM
To: Charlie Kaufman
Cc: secdir@ietf.org; iesg@ietf.org; draft-ietf-trill-directory-framework.all@tools.ietf.org
Subject: Re: [secdir] secdir review of draft-ietf-trill-directory-framework-05

Hi Charlie,

Thanks for the review, I believe I agree with all your points!

See below.

On Thu, Jul 11, 2013 at 1:20 AM, Charlie Kaufman <charliek@microsoft.com>; wrote:
> I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.
>
> This document describes a framework for adding a central control mechanism to trill to replace or supplement its autoconfiguring mechanism of dynamically learning the locations of all addresses on the LAN. The specific protocols for supplying and consuming this configuration information will presumably appear in future specs. This sort of configuration control is useful in a datacenter where all connections are carefully configured rather than being plug and play. It is particularly applicable in a "cloud" environment where virtual machines are moved between physical machines by some sort of Virtual Machine Management System that will also assign addresses and place them.
>
> The Security Considerations section of this document is very bland, noting that reachability depends on the correct delivery of information and stating that there may be security considerations specific to particular directory assistance mechanisms. The feature is designed to improve performance rather than security. I believe this seriously understates the security advantages that are possible if a central control mechanism replaces the autoconfiguration mechanism. In particular, the main protection/isolation mechanisms available today on a LAN concern partitioning by VLAN. Within a VLAN, any node can impersonate any other and can arrange to receive traffic addressed to another node. This can be prevented if the network learns the addresses belonging to each physical connection port not from looking at what the node transmits but rather from a central controller. A node cannot receive traffic addressed to someone else simply by sending a packet from that address or responding to an ARP searching for an IP address. In fact, such packets can be blocked by the ingress Rbridge. So control is much more fine-grained than with VLANs. The network guarantees the authenticity of the source address of each incoming packet.

Right.

> The directory framework could be made more useful in serving this security functionality if its configuration included in each entry not simply the IP address, MAC/VLAN, and list of attached Rbridges, but also a port identifier for each attached RBridge. Egress RBridges could use this information to impose more precise limits. If this information is not in the database, a central controlling mechanism would need a separate protocol and communications path to communicate this information to the Egress RBridges. The current spec allows such information to be included in the directory, but does not require it.

Another good point. How about if we replace the Security Considerations Section as follows:

OLD
   Accurate mapping of IP addresses into MAC addresses and of MAC
   addresses to the RBridge from which they are reachable is important
   to the correct delivery of information. The security of specific
   directory assisted mechanisms will be discussed in the document or
   documents specifying those mechanisms.

   For general TRILL security considerations, see [RFC6325].

NEW
   For general TRILL security considerations, see Section 6 of
   [RFC6325].

   Accurate mapping of IP addresses into MAC addresses and of MAC
   addresses to the RBridges from which they are reachable is important
   to the correct delivery of information. The security of specific
   directory assisted mechanisms for delivering such information will be
   discussed in the document or documents specifying those mechanisms.

   Directory assisted TRILL edge can substantially improve on the
   security of the default MAC address learning from the data plane used
   in a TRILL campus. With that data plane learning, any node can
   impersonate any other in the same data label (VLAN or FGL [FGL]) and
   can arrange to receive traffic addressed to another node.

   This can be prevented by disabling data plane MAC address learning
   and using trusted directory services, espeically if, when
   appropriate, ARP and ND messages are intercepted and responded too
   locally. Then end stations cannot receive traffic addressed to
   someone else simply by sending a packet from that MAC address or
   responding to an ARP or ND searching for an IP address. (Security ND
   or use of secure ESADI [ESADI] may also be helpful to security.) In
   fact, such possibly malicious packets can be blocked by the ingress
   RBridge. So control is much more fine-grained than the scope of a
   data labels, limiting spoofing to imposters directly connected to the
   same RBridge or, if RBrige port information is also provided by the
   directory, to on-link imposters.

and also add just a few words earlier on mentioning improved security with a reference to the Security Considerations Section?

> Nits:
>
> Page 4, bullet 4: "more common occurrence" -> "more frequent occurrence"

OK.

Thanks,
Donald
=============================
 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 155 Beaver Street, Milford, MA 01757 USA  d3e3e3@gmail.com