[Sidrops] Fw: New Version Notification for draft-li-sidrops-bicone-sav-01.txt

[Lancheng Qin <[e-mail]>]

Forwarding discussion of this draft on another mailing list to this mailing list. Thank you.

Best Regards,
Lancheng



> -----原始邮件-----
> 发件人: "Lancheng Qin" <[e-mail]>
> 发送时间:2024-06-21 17:04:30 (星期五)
> 收件人: "Siyuan Teng" <[e-mail]>
> 抄送: [e-mail]
> 主题: [savnet] Re: 答复: Fw: New Version Notification for draft-li-sidrops-bicone-sav-01.txt
> 
> Yes. The router can generate both allowlist and blocklist in control plane, and use only one (according to the recommendations in Section 7) in data plane to save storage overhead.
> 
> Best,
> Lancheng
> 
> 
> > -----原始邮件-----
> > 发件人: "Siyuan Teng" <[e-mail]>
> > 发送时间:2024-06-21 16:24:05 (星期五)
> > 收件人: "Lancheng Qin" <[e-mail]>
> > 抄送: "Aijun Wang" <[e-mail]>, [e-mail]
> > 主题: [savnet] Re: 答复: Fw: New Version Notification for draft-li-sidrops-bicone-sav-01.txt
> > 
> > Hi Lancheng,
> > 
> > In Section 6.3, Bicone SAV uses the allowlist to remove some prefixes from the blocklist. In Section 7, it suggests that an AS can choose to use the allowlist filter or the blocklist filter.
> > 
> > Does it mean that Bicone SAV would generate both allowlist and blocklist but adopt only one?
> > 
> > Siyuan
> > 
> > 
> > > -----原始邮件-----
> > > 发件人: "Lancheng Qin" <[e-mail]>
> > > 发送时间:2024-06-20 21:17:26 (星期四)
> > > 收件人: "Aijun Wang" <[e-mail]>
> > > 抄送: [e-mail]
> > > 主题: [savnet] Re: 答复: Fw: New Version Notification for draft-li-sidrops-bicone-sav-01.txt
> > > 
> > > Hi Aijun,
> > > 
> > > > This draft aims to solve the inter-domain SAVNET problem. Inclusion of "inter-domain" and "SAVNET" would assist the reader to get the key aim of your proposal and also can put it into the SAVNET repository automatically.
> > > 
> > > [Lancheng]: For the same reason (i.e., SAVNET solution documents are not included in the Charter or Milestones for SAVNET WG), we submit this document to SIDROPS WG.
> > > 
> > > > The key idea of your proposal is how to generate and apply the blocklist. Will the allowlist and blocklist existing on one router simultaneously? In section 7 of your document "summary of recommendations", the operator should make some judgement for the accuracy of the allowlist/blocklist, which will be challenged to the operator and can't be updated automatically, it seems the safest way is to use always the allowlist and blocklist at the same time?
> > > 
> > > [Lancheng]: In the previous version, this draft proposed to use both allowlist and blocklist on one interface. However, in IETF 119, we received comments that this would greatly increase storage overhead and computational complexity. Therefore, this new version proposes to use only one in data plane. As mentioned in Section 7, blocklist can be used by default if the network operator is unsure whether using allowlist will lead to improper block. Even though, network operators can also flexibly choose whether to use an allowlist or a blocklist according to their needs. For example, if the network is more concerned about avoiding improper block, it can use a blocklist. If the network is more concerned about blocking as much spoofing traffic as possible, it can use an allowlist.
> > > 
> > > Thank you.
> > > 
> > > Best,
> > > Lancheng
> > > 
> > > 
> > > > -----原始邮件-----
> > > > 发件人: "Aijun Wang" <[e-mail]>
> > > > 发送时间:2024-06-20 12:06:51 (星期四)
> > > > 收件人: "'Lancheng Qin'" <[e-mail]>, [e-mail]
> > > > 主题: [savnet] 答复: Fw: New Version Notification for draft-li-sidrops-bicone-sav-01.txt
> > > > 
> > > > Hi, Lancheng:
> > > > 
> > > > Similar comments for this draft:
> > > >  1) This draft aims to solve the inter-domain SAVNET problem. Inclusion of "inter-domain" and "SAVNET" would assist the reader to get the key aim of your proposal and also can put it into the SAVNET repository automatically.
> > > >  2) The key idea of your proposal is how to generate and apply the blocklist. Will the allowlist and blocklist existing on one router simultaneously? In section 7 of your document "summary of recommendations", the operator should make some judgement for the accuracy of the allowlist/blocklist, which will be challenged to the operator and can't be updated automatically, it seems the safest way is to use always the allowlist and blocklist at the same time?
> > > > 
> > > > 
> > > > Best Regards.
> > > > 
> > > > Aijun Wang
> > > > 
> > > > 
> > > > -----邮件原件-----
> > > > 发件人: [e-mail] [mailto:[e-mail]] 代表 Lancheng Qin
> > > > 发送时间: 2024年6月14日 8:51
> > > > 收件人: [e-mail]
> > > > 主题: [savnet] Fw: New Version Notification for draft-li-sidrops-bicone-sav-01.txt
> > > > 
> > > > Hi all,
> > > > 
> > > > We have revised draft-li-sidrops-bicone-sav according to comments received in IETF 119. 
> > > > 
> > > > Here is a summary of main updates:
> > > > 
> > > > (1)    We add a new Section 4 to introduce two goals of Bicone SAV.
> > > > 
> > > > (2)    We add a new Section 5 to introduce some existing methods that can generate allowlist SAV filters.
> > > > 
> > > > (3)    In Section 6.3, we describe how to deal with the overlap between provider cone and customer cone.
> > > > 
> > > > (4)    We add a new Section 7 to provide a summary of recommendations.
> > > > 
> > > > 
> > > > Your comments and suggestions are welcome. Thank you!
> > > > 
> > > > Best Regards,
> > > > Lancheng
> > > > 
> > > > 
> > > > > -----原始邮件-----
> > > > > 发件人: [e-mail]
> > > > > 发送时间:2024-06-14 08:46:13 (星期五)
> > > > > 收件人: "Dan Li" <[e-mail]>, "Lancheng Qin" 
> > > > > <[e-mail]>, "Li Chen" <[e-mail]>, 
> > > > > "Libin Liu" <[e-mail]>
> > > > > 主题: New Version Notification for draft-li-sidrops-bicone-sav-01.txt
> > > > > 
> > > > > A new version of Internet-Draft draft-li-sidrops-bicone-sav-01.txt has 
> > > > > been successfully submitted by Lancheng Qin and posted to the IETF 
> > > > > repository.
> > > > > 
> > > > > Name:     draft-li-sidrops-bicone-sav
> > > > > Revision: 01
> > > > > Title:    Bicone Source Address Validation
> > > > > Date:     2024-06-14
> > > > > Group:    Individual Submission
> > > > > Pages:    10
> > > > > URL:      https://www.ietf.org/archive/id/draft-li-sidrops-bicone-sav-01.txt
> > > > > Status:   https://datatracker.ietf.org/doc/draft-li-sidrops-bicone-sav/
> > > > > HTML:     https://www.ietf.org/archive/id/draft-li-sidrops-bicone-sav-01.html
> > > > > HTMLized: https://datatracker.ietf.org/doc/html/draft-li-sidrops-bicone-sav
> > > > > Diff:     https://author-tools.ietf.org/iddiff?url2=draft-li-sidrops-bicone-sav-01
> > > > > 
> > > > > Abstract:
> > > > > 
> > > > >    The primary design goal of source address validation (SAV) is
> > > > >    avoiding improper block (i.e., blocking legitimate traffic) while
> > > > >    maintaining directionality, especially in partial deployment
> > > > >    scenarios (see [I-D.ietf-savnet-inter-domain-problem-statement] and
> > > > >    [RFC8704]).  Existing advanced SAV solutions typically generate
> > > > >    ingress SAV allowlist filters by using information related to
> > > > >    customer cone.  This document analyzes potential improper block
> > > > >    problems of solely using allowlist filters.  To minimize improper
> > > > >    block, this document proposes Bicone SAV, which enhances the SAV
> > > > >    technology by additionally using blocklist filters generated based on
> > > > >    information related to provider cone.
> > > > > 
> > > > > 
> > > > > 
> > > > > The IETF Secretariat
> > > > > 
> > > > --
> > > > savnet mailing list -- [e-mail]
> > > > To unsubscribe send an email to [e-mail]
> > > > 
> > > > -- 
> > > > savnet mailing list -- [e-mail]
> > > > To unsubscribe send an email to [e-mail]
> > > -- 
> > > savnet mailing list -- [e-mail]
> > > To unsubscribe send an email to [e-mail]
> > -- 
> > savnet mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> -- 
> savnet mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]