From nobody Tue May 6 08:39:45 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C4FE1A038C for ; Tue, 6 May 2014 08:39:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.613 X-Spam-Level: **** X-Spam-Status: No, score=4.613 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, FILL_THIS_FORM=0.001, FREEMAIL_FROM=0.001, HTML_COMMENT_SAVED_URL=1.391, HTML_MESSAGE=0.001, MANGLED_LIPS=2.3, SPF_PASS=-0.001, T_DKIM_INVALID=0.01, T_HTML_ATTACH=0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T_VXEcycssYc for ; Tue, 6 May 2014 08:39:22 -0700 (PDT) Received: from mail-pa0-x236.google.com (mail-pa0-x236.google.com [IPv6:2607:f8b0:400e:c03::236]) by ietfa.amsl.com (Postfix) with ESMTP id 28BE01A0859 for ; Tue, 6 May 2014 08:39:22 -0700 (PDT) Received: by mail-pa0-f54.google.com with SMTP id lf10so11335787pab.41 for ; Tue, 06 May 2014 08:39:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:content-type:subject:date:message-id:cc:to:mime-version; bh=UsyPk9JYDBeeuhFVRXoKAbSDK3bvI2hyFnXzD1OZlmw=; b=oWtn2f1akRzOJh2qa0UOLmOEuR5ALsCkfxquC8yHJSsktKksYRLsGKW0CuUYD9Lkhc QXZzra//Qvmrwqxuo2LkVD2qdQ0FPDOu7dQOfrLObPuF9+b3/7r8PVEm5fCzC+i6sykW BpZ7OUXYyDdlpPhNvHBldCTLYUjyGWMCTJB8K7swOWhaFAhLopvtV8mWbD9IZbeScYHE HjsBRjuArss6bd8+GfPBGP8twTZ+1dHXD2R2gGdA2OWEGPUe7yDLNCMGUyp2wowYsfAj Gu5TUO7ZkKQXWnc+hPIF+CvheU52o+KPmInmd3K/Y7ptrMWwGMzNHiCz1ogr9EjbZLma jrEQ== X-Received: by 10.66.240.70 with SMTP id vy6mr7590229pac.80.1399390758035; Tue, 06 May 2014 08:39:18 -0700 (PDT) Received: from [192.168.5.249] (ip-64-134-235-33.public.wayport.net. [64.134.235.33]) by mx.google.com with ESMTPSA id ba5sm1065476pbc.61.2014.05.06.08.39.05 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 06 May 2014 08:39:13 -0700 (PDT) From: Dino Farinacci Content-Type: multipart/mixed; boundary="Apple-Mail=_3BC4A146-4E67-4245-89D0-CEAF46C4FA3F" Date: Tue, 6 May 2014 08:38:59 -0700 Message-Id: <19D545A3-99D4-4DA7-87DD-740A17E1BAA3@gmail.com> To: LISP mailing list list Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\)) X-Mailer: Apple Mail (2.1874) Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/Mkts7uyGdOHHeaqaXIBrlxNcx10 Cc: David Meyer Subject: [lisp] New update to draft-ietf-lisp-lcaf X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 May 2014 15:39:32 -0000 --Apple-Mail=_3BC4A146-4E67-4245-89D0-CEAF46C4FA3F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii The JSON advocates needed a length field to describe the JSON payload. = See diffs attached. Dino --Apple-Mail=_3BC4A146-4E67-4245-89D0-CEAF46C4FA3F Content-Disposition: attachment; filename=rfcdiff-lisp-lcaf-04-to-05.html Content-Type: text/html; x-unix-mode=0644; name="rfcdiff-lisp-lcaf-04-to-05.html" Content-Transfer-Encoding: quoted-printable wdiff draft-ietf-lisp-lcaf-04.txt = draft-ietf-lisp-lcaf-05.txt
Network Working Group                                       D. Farinacci
Internet-Draft                                               lispers.net
Intended status: Experimental                                   D. Meyer
Expires: July 31, =
November 7, 2014           =
                             Brocade
                                                             J. Snijders
                                                       Hibernia Networks
                                                        January 27,
                                                             =
May 6, 2014

                  LISP Canonical Address Format (LCAF)
                        draft-ietf-lisp-lcaf-04
                        draft-ietf-lisp-lcaf-05

Abstract

   This draft defines a canonical address format encoding used in LISP
   control messages and in the encoding of lookup keys for the LISP
   Mapping Database System.

Status of this Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on July =
31, November =
7, 2014.

Copyright Notice

   Copyright (c) 2014 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
   2.  Definition of Terms  . . . . . . . . . . . . . . . . . . . . .  4
   3.  LISP Canonical Address Format Encodings  . . . . . . . . . . .  5
   4.  LISP Canonical Address Applications  . . . . . . . . . . . . .  7
     4.1.  Segmentation using LISP  . . . . . . . . . . . . . . . . .  7
     4.2.  Carrying AS Numbers in the Mapping Database  . . . . . . .  8
     4.3.  Convey Application Specific Data . . . . . . . . . . . . .  9
     4.4.  Assigning Geo Coordinates to Locator Addresses . . . . . . 10
     4.5.  Generic Database Mapping Lookups . . . . . . . . . . . . . 12
     4.6.  NAT Traversal Scenarios  . . . . . . . . . . . . . . . . . 13
     4.7.  PETR Admission Control Functionality . . . . . . . . . . . 15
     4.8.  Multicast Group Membership Information . . . . . . . . . . 16
     4.9.  Traffic Engineering using Re-encapsulating Tunnels . . . . 18
     4.10. Storing Security Data in the Mapping Database  . . . . . . 19
     4.11. Source/Destination 2-Tuple Lookups . . . . . . . . . . . . 20
     4.12. Replication List Entries for Multicast Forwarding  . . . . 21
     4.13. Data Model Encoding  . . . . . . . . . . . . . . . . . . . 22
     4.14. Encoding Key/Value Address Pairs . . . . . . . . . . . . . 23
     4.15. Applications for AFI List Type . . . . . . . . . . . . . . 23
       4.15.1.  Binding IPv4 and IPv6 Addresses . . . . . . . . . . . 23
       4.15.2.  Layer-2 VPNs  . . . . . . . . . . . . . . . . . . . . 25
       4.15.3.  ASCII Names in the Mapping Database . . . . . . . . . 25
       4.15.4.  Using Recursive LISP Canonical Address Encodings  . . 26
       4.15.5.  Compatibility Mode Use Case . . . . . . . . . . . . . 27
   5.  Security Considerations  . . . . . . . . . . . . . . . . . . . 28
   6.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 29
   7.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 30
     7.1.  Normative References . . . . . . . . . . . . . . . . . . . 30
     7.2.  Informative References . . . . . . . . . . . . . . . . . . 30
   Appendix A.  Acknowledgments . . . . . . . . . . . . . . . . . . . 32
   Appendix B.  Document Change Log . . . . . . . . . . . . . . . . . 33
     B.1.  Changes to draft-ietf-lisp-lcaf-04.txt draft-ietf-lisp-lcaf-05.txt . . . . . . =
. . . . 33
     B.2.  Changes to draft-ietf-lisp-lcaf-03.txt draft-ietf-lisp-lcaf-04.txt . . . . . . =
. . . . 33
     B.3.  Changes to draft-ietf-lisp-lcaf-02.txt draft-ietf-lisp-lcaf-03.txt . . . . . . =
. . . . 33
     B.4.  Changes to draft-ietf-lisp-lcaf-01.txt draft-ietf-lisp-lcaf-02.txt . . . . . . =
. . . . 33
     B.5.  Changes to draft-ietf-lisp-lcaf-00.txt draft-ietf-lisp-lcaf-01.txt . . . . . . =
. . . . 33
     B.6.  Changes to =
draft-ietf-lisp-lcaf-00.txt . . . . . . . . . . 34
   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 35

1.  Introduction

   The LISP architecture and protocols [RFC6830] introduces two new
   numbering spaces, Endpoint Identifiers (EIDs) and Routing Locators
   (RLOCs) which are intended to replace most use of IP addresses on the
   Internet.  To provide flexibility for current and future
   applications, these values can be encoded in LISP control messages
   using a general syntax that includes Address Family Identifier (AFI),
   length, and value fields.

   Currently defined AFIs include IPv4 and IPv6 addresses, which are
   formatted according to code-points assigned in [AFI] as follows:

   IPv4 Encoded Address:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            AFI =3D 1            |       IPv4 Address ...        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     ...  IPv4 Address         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   IPv6 Encoded Address:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            AFI =3D 2            |       IPv6 Address ...        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                     ...  IPv6 Address  ...                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                     ...  IPv6 Address  ...                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                     ...  IPv6 Address  ...                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     ...  IPv6 Address         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   This document describes the currently-defined AFIs the LISP protocol
   uses along with their encodings and introduces the LISP Canonical
   Address Format (LCAF) that can be used to define the LISP-specific
   encodings for arbitrary AFI values.

2.  Definition of Terms

   Address Family Identifier (AFI):  a term used to describe an address
      encoding in a packet.  An address family currently defined for
      IPv4 or IPv6 addresses.  See [AFI] and [RFC1700] for details.  The
      reserved AFI value of 0 is used in this specification to indicate
      an unspecified encoded address where the the length of the address
      is 0 bytes following the 16-bit AFI value of 0.

   Unspecified Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            AFI =3D 0            |    <nothing follows AFI=3D0>=
    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Endpoint ID (EID):   a 32-bit (for IPv4) or 128-bit (for IPv6) value
      used in the source and destination address fields of the first
      (most inner) LISP header of a packet.  The host obtains a
      destination EID the same way it obtains a destination address
      today, for example through a DNS lookup or SIP exchange.  The
      source EID is obtained via existing mechanisms used to set a
      host's "local" IP address.  An EID is allocated to a host from an
      EID-prefix block associated with the site where the host is
      located.  An EID can be used by a host to refer to other hosts.

   Routing Locator (RLOC):   the IPv4 or IPv6 address of an egress
      tunnel router (ETR).  It is the output of a EID-to-RLOC mapping
      lookup.  An EID maps to one or more RLOCs.  Typically, RLOCs are
      numbered from topologically aggregatable blocks that are assigned
      to a site at each point to which it attaches to the global
      Internet; where the topology is defined by the connectivity of
      provider networks, RLOCs can be thought of as PA addresses.
      Multiple RLOCs can be assigned to the same ETR device or to
      multiple ETR devices at a site.

3.  LISP Canonical Address Format Encodings

   IANA has assigned AFI value 16387 (0x4003) to the LISP architecture
   and protocols.  This specification defines the encoding format of the
   LISP Canonical Address (LCA).

   The first 4 bytes of an LISP Canonical Address are followed by a
   variable length of fields:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |    Type       |     Rsvd2     |            Length             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Rsvd1:  this 8-bit field is reserved for future use and MUST be
      transmitted as 0 and ignored on receipt.

   Flags:  this 8-bit field is for future definition and use.  For now,
      set to zero on transmission and ignored on receipt.

   Type:  this 8-bit field is specific to the LISP Canonical Address
      formatted encodings, values are:

     Type 0:  Null Body Type

     Type 1:  AFI List Type

     Type 2:  Instance ID Type

     Type 3:  AS Number Type

     Type 4:  Application Data Type

     Type 5:  Geo Coordinates Type

     Type 6:  Opaque Key Type

     Type 7:  NAT-Traversal Type

     Type 8:  Nonce Locator Type

     Type 9:  Multicast Info Type
     Type 10:  Explicit Locator Path Type

     Type 11:  Security Key Type

     Type 12:  Source/Dest Key Type

     Type 13:  Replication List Entry Type

     Type 14:  JSON Data Model Type

     Type 15:  Key/Value Address Pair Type

   Rsvd2:  this 8-bit field is reserved for future use and MUST be
      transmitted as 0 and ignored on receipt.

   Length:  this 16-bit field is in units of bytes and covers all of the
      LISP Canonical Address payload, starting and including the byte
      after the Length field.  So any LCAF encoded address will have a
      minimum length of 8 bytes when the Length field is 0.  The 8 bytes
      include the AFI, Flags, Type, Reserved, and Length fields.  When
      the AFI is not next to encoded address in a control message, then
      the encoded address will have a minimum length of 6 bytes when the
      Length field is 0.  The 6 bytes include the Flags, Type, Reserved,
      and Length fields.

4.  LISP Canonical Address Applications

4.1.  Segmentation using LISP

   When multiple organizations inside of a LISP site are using private
   addresses [RFC1918] as EID-prefixes, their address spaces must remain
   segregated due to possible address duplication.  An Instance ID in
   the address encoding can aid in making the entire AFI based address
   unique.

   Another use for the Instance ID LISP Canonical Address Format is when
   creating multiple segmented VPNs inside of a LISP site where keeping
   EID-prefix based subnets is desirable.

   Instance ID LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 2    | IID mask-len  |             4 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                         Instance ID                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |         Address  ...          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   IID mask-len:  if the AFI is set to 0, then this format is not
      encoding an extended EID-prefix but rather an instance-ID range
      where the 'IID mask-len' indicates the number of high-order bits
      used in the Instance ID field for the range.

   Length value n:  length in bytes of the AFI address that follows the
      Instance ID field including the AFI field itself.

   Instance ID:  the low-order 24-bits that can go into a LISP data
      header when the I-bit is set.  See [RFC6830] for details.

   AFI =3D x:  x can be any AFI value from [AFI].

   This LISP Canonical Address Type can be used to encode either EID or
   RLOC addresses.

4.2.  Carrying AS Numbers in the Mapping Database

   When an AS number is stored in the LISP Mapping Database System for
   either policy or documentation reasons, it can be encoded in a LISP
   Canonical Address.

   AS Number LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 3    |     Rsvd2     |             4 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                           AS Number                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |         Address  ...          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of the AFI address that follows the
      AS Number field including the AFI field itself.

   AS Number:  the 32-bit AS number of the autonomous system that has
      been assigned either the EID or RLOC that follows.

   AFI =3D x:  x can be any AFI value from [AFI].

   The AS Number Canonical Address Type can be used to encode either EID
   or RLOC addresses.  The former is used to describe the LISP-ALT AS
   number the EID-prefix for the site is being carried for.  The latter
   is used to describe the AS that is carrying RLOC based prefixes in
   the underlying routing system.

4.3.  Convey Application Specific Data

   When a locator-set needs to be conveyed based on the type of
   application or the Per-Hop Behavior (PHB) of a packet, the
   Application Data Type can be used.

   Application Data LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 4    |     Rsvd2     |             8 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       IP TOS, IPv6 TC, or Flow Label          |    Protocol   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |    Local Port (lower-range)   |    Local Port (upper-range)   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Remote Port (lower-range)   |   Remote Port (upper-range)   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |         Address  ...          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of the AFI address that follows the
      8-byte Application Data fields including the AFI field itself.

   IP TOS, IPv6 TC, or Flow Label:  this field stores the 8-bit IPv4 TOS
      field used in an IPv4 header, the 8-bit IPv6 Traffic Class or Flow
      Label used in an IPv6 header.

   Local Port/Remote Port Ranges:  these fields are from the TCP, UDP,
      or SCTP transport header.  A range can be specified by using a
      lower value and an upper value.  When a single port is encoded,
      the lower and upper value fields are the same.

   AFI =3D x:  x can be any AFI value from [AFI].

   The Application Data Canonical Address Type is used for an EID
   encoding when an ITR wants a locator-set for a specific application.
   When used for an RLOC encoding, the ETR is supplying a locator-set
   for each specific application is has been configured to advertise.

4.4.  Assigning Geo Coordinates to Locator Addresses

   If an ETR desires to send a Map-Reply describing the Geo Coordinates
   for each locator in its locator-set, it can use the Geo Coordinate
   Type to convey physical location information.

   Coordinates are specified using the WGS-84 (World Geodetic System)
   reference coordinate system [WGS-84].

   Geo Coordinate LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 5    |     Rsvd2     |            12 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |N|     Latitude Degrees        |    Minutes    |    Seconds    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |E|     Longitude Degrees       |    Minutes    |    Seconds    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                            Altitude                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |         Address  ...          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of the AFI address that follows the
      8-byte Longitude and Latitude fields including the AFI field
      itself.

   N: When set to 1 means North, otherwise South.

   Latitude Degrees:  Valid values range from 0 to 90 degrees above or
      below the equator (northern or southern hemisphere, respectively).

   Latitude Minutes:  Valid values range from 0 to 59.

   Latitude Seconds:  Valid values range from 0 to 59.

   E: When set to 1 means East, otherwise West.

   Longitude Degrees:  Value values are from 0 to 180 degrees right or
      left of the Prime Meridian.

   Longitude Minutes:  Valid values range from 0 to 59.

   Longitude Seconds:  Valid values range from 0 to 59.

   Altitude:  Height relative to sea level in meters.  This is a signed
      integer meaning that the altitude could be below sea level.  A
      value of 0x7fffffff indicates no Altitude value is encoded.

   AFI =3D x:  x can be any AFI value from [AFI].

   The Geo Coordinates Canonical Address Type can be used to encode
   either EID or RLOC addresses.  When used for EID encodings, you can
   determine the physical location of an EID along with the topological
   location by observing the locator-set.

4.5.  Generic Database Mapping Lookups

   When the LISP Mapping Database system holds information accessed by a
   generic formatted key (where the key is not the usual IPv4 or IPv6
   address), an opaque key may be desirable.

   Opaque Key LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 6    |     Rsvd2     |               n               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    | Key Field Num |      Key Wildcard Fields      |   Key . . .   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                       . . . Key                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of the type's payload.  The value n
      is the number of bytes that follow this Length field.

   Key Field Num:  the number of fields (minus 1) the key can be broken
      up into.  The width of the fields are fixed length.  So for a key
      size of 8 bytes, with a Key Field Num of 4 allows 4 fields of 2
      bytes in length.  Valid values for this field range from 0 to 15
      supporting a maximum of 16 field separations.

   Key Wildcard Fields:  describes which fields in the key are not used
      as part of the key lookup.  This wildcard encoding is a bitfield.
      Each bit is a don't-care bit for a corresponding field in the key.
      Bit 0 (the low-order bit) in this bitfield corresponds the first
      field, right-justified in the key, bit 1 the second field, and so
      on.  When a bit is set in the bitfield it is a don't-care bit and
      should not be considered as part of the database lookup.  When the
      entire 16-bits is set to 0, then all bits of the key are used for
      the database lookup.

   Key:  the variable length key used to do a LISP Database Mapping
      lookup.  The length of the key is the value n (shown above) minus
      3.

4.6.  NAT Traversal Scenarios

   When a LISP system is conveying global address and mapped port
   information when traversing through a NAT device, the NAT-Traversal
   LCAF Type is used.  See [LISP-NATT] for details.

   NAT-Traversal Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 7    |     Rsvd2     |             4 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       MS UDP Port Number      |      ETR UDP Port Number      |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |  Global ETR RLOC Address  ... |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |       MS RLOC Address  ...    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          | Private ETR RLOC Address  ... |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |      RTR RLOC Address 1 ...   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |      RTR RLOC Address k ...   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of the AFI addresses that follows
      the UDP Port Number field including the AFI fields themselves.

   MS UDP Port Number:  this is the UDP port number of the Map-Server
      and is set to 4342.

   ETR UDP Port Number:  this is the port number returned to a LISP
      system which was copied from the source port from a packet that
      has flowed through a NAT device.

   AFI =3D x:  x can be any AFI value from [AFI].

   Global ETR RLOC Address:  this is an address known to be globally
      unique built by NAT-traversal functionality in a LISP router.

   MS RLOC Address:  this is the address of the Map-Server used in the
      destination RLOC of a packet that has flowed through a NAT device.

   Private ETR RLOC Address:  this is an address known to be a private
      address inserted in this LCAF format by a LISP router that resides
      on the private side of a NAT device.

   RTR RLOC Address:  this is an encapsulation address used by an ITR or
      PITR which resides behind a NAT device.  This address is known to
      have state in a NAT device so packets can flow from it to the LISP
      ETR behind the NAT.  There can be one or more NTR addresses
      supplied in these set of fields.  The number of NTRs encoded is
      determined by the LCAF length field.  When there are no NTRs
      supplied, the NTR fields can be omitted and reflected by the LCAF
      length field or an AFI of 0 can be used to indicate zero NTRs
      encoded.

4.7.  PETR Admission Control Functionality

   When a public PETR device wants to verify who is encapsulating to it,
   it can check for a specific nonce value in the LISP encapsulated
   packet.  To convey the nonce to admitted ITRs or PITRs, this LCAF
   format is used in a Map-Register or Map-Reply locator-record.

   Nonce Locator Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 8    |     Rsvd2     |             4 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Reserved    |                  Nonce                        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |         Address  ...          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of the AFI address that follows the
      Nonce field including the AFI field itself.

   Reserved:  must be set to zero and ignore on receipt.

   Nonce:  this is a nonce value returned by an ETR in a Map-Reply
      locator-record to be used by an ITR or PITR when encapsulating to
      the locator address encoded in the AFI field of this LCAF type.

   AFI =3D x:  x can be any AFI value from [AFI].

4.8.  Multicast Group Membership Information

   Multicast group information can be published in the mapping database
   so a lookup on an EID based group address can return a replication
   list of group addresses or a unicast addresses for single replication
   or multiple head-end replications.  The intent of this type of
   unicast replication is to deliver packets to multiple ETRs at
   receiver LISP multicast sites.  The locator-set encoding for this EID
   record type can be a list of ETRs when they each register with "Merge
   Semantics".  The encoding can be a typical AFI encoded locator
   address.  When an RTR list is being registered (with multiple levels
   according to [LISP-RE]), the Replication List Entry LCAF type is used
   for locator encoding.

   This LCAF encoding can be used to send broadcast packets to all
   members of a subnet when each EIDs are away from their home subnet
   location.

   Multicast Info Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 9    |  Rsvd2  |R|L|J|             8 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                         Instance-ID                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            Reserved           | Source MaskLen| Group MaskLen |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |   Source/Subnet Address  ...  |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |       Group Address  ...      |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of fields that follow.

   Reserved:  must be set to zero and ignore on receipt.

   R-bit:  this is the RP-bit that represents PIM (S,G,RP-bit) multicast
      state.  This bit can be set for Joins (when the J-bit is set) or
      for Leaves (when the L-bit is set).  See [LISP-MRSIG] for more
      usage details.

   L-bit:  this is the Leave-Request bit and is used when this LCAF type
      is present in the destination EID-prefix field of a Map-Request.
      See [LISP-MRSIG] for details.

   J-bit:  this is the Join-Request bit and is used when this LCAF type
      is present in the destination EID-prefix field of a Map-Request.
      See [LISP-MRSIG] for details.  The J-bit MUST not be set when the
      L-bit is also set in the same LCAF block.  A receiver should not
      take any specific Join or Leave action when both bits are set.

   Instance ID:  the low-order 24-bits that can go into a LISP data
      header when the I-bit is set.  See [RFC6830] for details.  The use
      of the Instance-ID in this LCAF type is to associate a multicast
      forwarding entry for a given VPN.  The instance-ID describes the
      VPN and is registered to the mapping database system as a 3-tuple
      of (Instance-ID, S-prefix, G-prefix).

   Source MaskLen:  the mask length of the source prefix that follows.

   Group MaskLen:  the mask length of the group prefix that follows.

   AFI =3D x:  x can be any AFI value from [AFI].  When a specific AFI =
has
      its own encoding of a multicast address, this field must be either
      a group address or a broadcast address.

4.9.  Traffic Engineering using Re-encapsulating Tunnels

   For a given EID lookup into the mapping database, this LCAF format
   can be returned to provide a list of locators in an explicit re-
   encapsulation path.  See [LISP-TE] for details.

   Explicit Locator Path (ELP) Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 10   |     Rsvd2     |               n               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Rsvd3         |L|P|S|           AFI =3D x             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                         Reencap Hop 1  ...                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Rsvd3         |L|P|S|           AFI =3D x             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                         Reencap Hop k  ...                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of fields that follow.

   Lookup bit (L):  this is the Lookup bit used to indicate to the user
      of the ELP to not use this address for encapsulation but to look
      it up in the mapping database system to obtain an encapsulating
      RLOC address.

   RLOC-Probe bit (P):  this is the RLOC-probe bit which means the
      Reencap Hop allows RLOC-probe messages to be sent to it.  When the
      R-bit is set to 0, RLOC-probes must not be sent.  When a Reencap
      Hop is an anycast address then multiple physical Reencap Hops are
      using the same RLOC address.  In this case, RLOC-probes are not
      needed because when the closest RLOC address is not reachable
      another RLOC address can reachable.

   Strict bit (S):  this the strict bit which means the associated
      Rencap Hop is required to be used.  If this bit is 0, the
      reencapsulator can skip this Reencap Hop and go to the next one in
      the list.

   AFI =3D x:  x can be any AFI value from [AFI].  When a specific AFI =
has
      its own encoding of a multicast address, this field must be either
      a group address or a broadcast address.

4.10.  Storing Security Data in the Mapping Database

   When a locator in a locator-set has a security key associated with
   it, this LCAF format will be used to encode key material.  See
   [LISP-DDT] for details.

   Security Key Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 11   |      Rsvd2    |             6 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Key Count   |      Rsvd3    | Key Algorithm |   Rsvd4     |R|
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Key Length          |       Key Material ...        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                        ... Key Material                       |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |       Locator Address ...     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of fields that start with the Key
      Material field.

   Key Count:  the Key Count field declares the number of Key sections
      included in this LCAF.

   Key Algorithm:  the Algorithm field identifies the key's
      cryptographic algorithm and specifies the format of the Public Key
      field.

   R bit:  this is the revoke bit and, if set, it specifies that this
      Key is being Revoked.

   Key Length:  this field determines the length in bytes of the Key
      Material field.

   Key Material:  the Key Material field stores the key material.  The
      format of the key material stored depends on the Key Algorithm
      field.

   AFI =3D x:  x can be any AFI value from [AFI].This is the locator
      address that owns the encoded security key.

4.11.  Source/Destination 2-Tuple Lookups

   When both a source and destination address of a flow needs
   consideration for different locator-sets, this 2-tuple key is used in
   EID fields in LISP control messages.  When the Source/Dest key is
   registered to the mapping database, it can be encoded as a source-
   prefix and destination-prefix.  When the Source/Dest is used as a key
   for a mapping database lookup the source and destination come from a
   data packet.

   Source/Dest Key Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 12   |     Rsvd2     |             4 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            Reserved           |   Source-ML   |    Dest-ML    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |         Source-Prefix ...     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |     Destination-Prefix ...    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of fields that follow.

   Reserved:  must be set to zero and ignore on receipt.

   Source-ML:  the mask length of the source prefix that follows.

   Dest-ML:  the mask length of the destination prefix that follows.

   AFI =3D x:  x can be any AFI value from [AFI].  When a specific AFI =
has
      its own encoding of a multicast address, this field must be either
      a group address or a broadcast address.

   Refer to [LISP-TE] for usage details.

4.12.  Replication List Entries for Multicast Forwarding

   The Replication List Entry LCAF type is an encoding for a locator
   being used for unicast replication according to the specification in
   [LISP-RE].  This locator encoding is pointed to by a Multicast Info
   LCAF Type and is registered by Re-encapsulating Tunnel Routers (RTRs)
   that are participating in an overlay distribution tree.  Each RTR
   will register its locator address and its configured level in the
   distribution tree.

   Replication List Entry Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 13   |    Rsvd2      |             4 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              Rsvd3            |     Rsvd4     |  Level Value  |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |           RTR/ETR #1 ...      |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              Rsvd3            |     Rsvd4     |  Level Value  |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |           RTR/ETR  #n ...     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of fields that follow.

   Rsvd{1,2,3,4}:  must be set to zero and ignore on receipt.

   Level Value:  this value is associated with the level within the
      overlay distribution tree hierarchy where the RTR resides.  The
      level numbers are ordered from lowest value being close to the ITR
      (meaning that ITRs replicate to level-0 RTRs) and higher levels
      are further downstream on the distribution tree closer to ETRs of
      multicast receiver sites.

   AFI =3D x:  x can be any AFI value from [AFI].  A specific AFI has =
its
      own encoding of either a unicast or multicast locator address.
      All RTR/ETR entries for the same level should be combined together
      by a Map-Server to avoid searching through the entire multi-level
      list of locator entries in a Map-Reply message.

4.13.  Data Model Encoding

   This type allows a JSON data model to be encoded either as an EID or
   RLOC.

   JSON Data Model Type Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 14   |    Rsvd2    |B|               n               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           JSON binary or =
text length         | JSON =
binary/text encoding ... |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |       Optional Address ...    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of fields that follow.

   Rsvd{1,2}:  must be set to zero and ignore on receipt.

   B bit:  indicates that the JSON field is binary encoded according to
      [JSON-BINARY] when the bit is set to 1.  Otherwise the encoding is
      based on text encoding according to [RFC4627].

   JSON length:  length in octets of the =
following 'JSON binary/text
      encoding' field.

   JSON binary/text encoding field:  a variable length =
field that
      contains either binary or text encodings.

   AFI =3D x:  x can be any AFI value from [AFI].  A specific AFI has =
its
      own encoding of either a unicast or multicast locator address.
      All RTR/ETR entries for the same level should be combined together
      by a Map-Server to avoid searching through the entire multi-level
      list of locator entries in a Map-Reply message.

4.14.  Encoding Key/Value Address Pairs

   The Key/Value pair is for example useful for attaching attributes to
   other elements of LISP packets, such as EIDs or RLOCs.  When
   attaching attributes to EIDs or RLOCs, it's necessary to distinguish
   between the element that should be used as EID or RLOC, and hence as
   key for lookups, and additional attributes.  This is especially the
   case when the difference cannot be determined from the types of the
   elements, such as when two IP addresses are being used.

   Key/Value Pair Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 15   |     Rsvd2     |               n               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |       Address as Key ...      |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |       Address as Value ...    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of fields that follow.

   Rsvd{1,2}:  must be set to zero and ignore on receipt.

   AFI =3D x:  x can be any AFI value from [AFI].  A specific AFI has =
its
      own encoding of either a unicast or multicast locator address.
      All RTR/ETR entries for the same level should be combined together
      by a Map-Server to avoid searching through the entire multi-level
      list of locator entries in a Map-Reply message.

   Address as Key:  this AFI encoded address will be attached with the
      attributes encoded in "Address as Value" which follows this field.

   Address as Value:  this AFI encoded address will be the attribute
      address that goes along with "Address as Key" which precedes this
      field.

4.15.  Applications for AFI List Type

4.15.1.  Binding IPv4 and IPv6 Addresses

   When header translation between IPv4 and IPv6 is desirable a LISP
   Canonical Address can use the AFI List Type to carry multiple AFIs in
   one LCAF AFI.

   Address Binding LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 1    |     Rsvd2     |         2 + 4 + 2 + 16        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            AFI =3D 1            |       IPv4 Address ...        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     ...  IPv4 Address         |            AFI =3D 2            |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                          IPv6 Address ...                     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                     ...  IPv6 Address  ...                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                     ...  IPv6 Address  ...                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                     ...  IPv6 Address                         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length:  length in bytes is fixed at 24 when IPv4 and IPv6 AFI
      encoded addresses are used.

   This type of address format can be included in a Map-Request when the
   address is being used as an EID, but the Mapping Database System
   lookup destination can use only the IPv4 address.  This is so a
   Mapping Database Service Transport System, such as LISP-ALT
   [RFC6836], can use the Map-Request destination address to route the
   control message to the desired LISP site.

4.15.2.  Layer-2 VPNs

   When MAC addresses are stored in the LISP Mapping Database System,
   the AFI List Type can be used to carry AFI 6.

   MAC Address LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 1    |     Rsvd2     |             2 + 6             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |             AFI =3D 6           |    Layer-2 MAC Address  ...   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                    ... Layer-2 MAC Address                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length:  length in bytes is fixed at 8 when MAC address AFI encoded
      addresses are used.

   This address format can be used to connect layer-2 domains together
   using LISP over an IPv4 or IPv6 core network to create a layer-2 VPN.
   In this use-case, a MAC address is being used as an EID, and the
   locator-set that this EID maps to can be an IPv4 or IPv6 RLOCs, or
   even another MAC address being used as an RLOC.

4.15.3.  ASCII Names in the Mapping Database

   If DNS names or URIs are stored in the LISP Mapping Database System,
   the AFI List Type can be used to carry an ASCII string where it is
   delimited by length 'n' of the LCAF Length encoding.

   ASCII LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 1    |     Rsvd2     |             2 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |             AFI =3D 17          |      DNS Name or URI  ...     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes AFI=3D17 field and the =
null-terminated
      ASCII string (the last byte of 0 is included).

4.15.4.  Using Recursive LISP Canonical Address Encodings

   When any combination of above is desirable, the AFI List Type value
   can be used to carry within the LCAF AFI another LCAF AFI.

   Recursive LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 1    |     Rsvd2     |         4 + 8 + 2 + 4         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 4    |     Rsvd2     |              12               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   IP TOS, IPv6 QQS or Flow Label              |    Protocol   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Local Port          |         Remote Port           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            AFI =3D 1            |       IPv4 Address ...        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     ...  IPv4 Address         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length:  length in bytes is fixed at 18 when an AFI=3D1 IPv4 address =
is
      included.

   This format could be used by a Mapping Database Transport System,
   such as LISP-ALT [RFC6836], where the AFI=3D1 IPv4 address is used as
   an EID and placed in the Map-Request destination address by the
   sending LISP system.  The ALT system can deliver the Map-Request to
   the LISP destination site independent of the Application Data Type
   AFI payload values.  When this AFI is processed by the destination
   LISP site, it can return different locator-sets based on the type of
   application or level of service that is being requested.

4.15.5.  Compatibility Mode Use Case

   A LISP system should use the AFI List Type format when sending to
   LISP systems that do not support a particular LCAF Type used to
   encode locators.  This allows the receiving system to be able to
   parse a locator address for encapsulation purposes.  The list of AFIs
   in an AFI List LCAF Type has no semantic ordering and a receiver
   should parse each AFI element no matter what the ordering.

   Compatibility Mode Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 1    |     Rsvd2     |            22 + 6             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 5    |     Rsvd2     |            12 + 2             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |N|     Latitude Degrees        |    Minutes    |    Seconds    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |E|     Longitude Degrees       |    Minutes    |    Seconds    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                            Altitude                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D 0          |           AFI =3D 1             =
|
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                          IPv4 Address                         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   If a system does not recognized the Geo Coordinate LCAF Type that is
   accompanying a locator address, an encoder can include the Geo
   Coordinate LCAF Type embedded in a AFI List LCAF Type where the AFI
   in the Geo Coordinate LCAF is set to 0 and the AFI encoded next in
   the list is encoded with a valid AFI value to identify the locator
   address.

   A LISP system is required to support the AFI List LCAF Type to use
   this procedure.  It would skip over 10 bytes of the Geo Coordinate
   LCAF Type to get to the locator address encoding (an IPv4 locator
   address).  A LISP system that does support the Geo Coordinate LCAF
   Type can support parsing the locator address within the Geo
   Coordinate LCAF encoding or in the locator encoding that follows in
   the AFI List LCAF.

5.  Security Considerations

   There are no security considerations for this specification.  The
   security considerations are documented for the protocols that use
   LISP Canonical Addressing.  Refer to the those relevant
   specifications.

6.  IANA Considerations

   The Address Family AFI definitions from [AFI] only allocate code-
   points for the AFI value itself.  The length of the address or entity
   that follows is not defined and is implied based on conventional
   experience.  Where the LISP protocol uses LISP Canonical Addresses
   specifically, the address length definitions will be in this
   specification and take precedent over any other specification.

   An IANA Registry for LCAF Type values will be created.  The values
   that are considered for use by the main LISP specification [RFC6830]
   will be in the IANA Registry.  Other Type values used for
   experimentation will be defined and described in this document.

7.  References

7.1.  Normative References

   [RFC1700]  Reynolds, J. and J. Postel, "Assigned Numbers", RFC 1700,
              October 1994.

   [RFC1918]  Rekhter, Y., Moskowitz, R., Karrenberg, D., Groot, G., and
              E. Lear, "Address Allocation for Private Internets",
              BCP 5, RFC 1918, February 1996.

   [RFC4627]  Crockford, D., "The application/json Media Type for
              JavaScript Object Notation (JSON)", RFC 4627, July 2006.

   [RFC6830]  Farinacci, D., Fuller, V., Meyer, D., and D. Lewis, "The
              Locator/ID Separation Protocol (LISP)", RFC 6830,
              January 2013.

   [RFC6836]  Fuller, V., Farinacci, D., Meyer, D., and D. Lewis,
              "Locator/ID Separation Protocol Alternative Logical
              Topology (LISP+ALT)", RFC 6836, January 2013.

7.2.  Informative References

   [AFI]      IANA, "Address Family Identifier (AFIs)", ADDRESS FAMILY
              NUMBERS http://www.iana.org/numbers.html, Febuary 2007.

   [JSON-BINARY]
              "Universal Binary JSON Specification",
              URL http://ubjson.org.

   [LISP-DDT]
              Fuller, V., Lewis, D., and V. Ermagan, "LISP Delegated
              Database Tree", draft-ietf-lisp-ddt-01.txt (work in
              progress).

   [LISP-MRSIG]
              Farinacci, D. and M. Napierala, "LISP Control-Plane
              Multicast Signaling",
              draft-farinacci-lisp-mr-signaling-03.txt (work in
              progress).

   [LISP-NATT]
              Ermagan, V., Farinacci, D., Lewis, D., Skriver, J., Maino,
              F., and C. White, "NAT traversal for LISP",
              draft-ermagan-lisp-nat-traversal-03.txt (work in
              progress).

   [LISP-RE]  Coras, F., Cabellos-Aparicio, A., Domingo-Pascual, J.,
              Maino, F., and D. Farinacci, "LISP Replication
              Engineering", draft-coras-lisp-re-03.txt (work in
              progress).

   [LISP-TE]  Farinacci, D., Lahiri, P., and M. Kowal, "LISP Traffic
              Engineering Use-Cases", draft-farinacci-lisp-te-03.txt
              (work in progress).

   [WGS-84]   Geodesy and Geophysics Department, DoD., "World Geodetic
              System 1984", NIMA TR8350.2, January 2000, <http://
              earth-info.nga.mil/GandG/publications/tr8350.2/
              wgs84fin.pdf>.

Appendix A.  Acknowledgments

   The authors would like to thank Vince Fuller, Gregg Schudel, Jesper
   Skriver, Luigi Iannone, Isidor Kouvelas, and Sander Steffann for
   their technical and editorial commentary.

   The authors would like to thank Victor Moreno for discussions that
   lead to the definition of the Multicast Info LCAF type.

   The authors would like to thank Parantap Lahiri and Michael Kowal for
   discussions that lead to the definition of the Explicit Locator Path
   (ELP) LCAF type.

   The authors would like to thank Fabio Maino and Vina Ermagan for
   discussions that lead to the definition of the Security Key LCAF
   type.

   The authors would like to thank Albert Cabellos-Aparicio and Florin
   Coras for discussions that lead to the definition of the Replication
   List Entry LCAF type.

   Thanks goes to Michiel Blokzijl and Alberto Rodriguez-Natal for
   suggesting new LCAF types.

   Thanks also goes to Terry Manderson for assistance obtaining a LISP
   AFI value from IANA.

Appendix B.  Document Change Log

B.1.  Changes to draft-ietf-lisp-lcaf-05.txt=


   o  Submitted May 2014.

   o  Add a length field of the JSON payload that can be used for either
      binary or text encoding of JSON data.

B.2.  Changes to draft-ietf-lisp-lcaf-04.txt

   o  Submitted January 2014.

   o  Agreement among ELP implementors to have the AFI 16-bit field
      adjacent to the address.  This will make the encoding consistent
      with all other LCAF type address encodings.

B.2.

B.3.  Changes to =
draft-ietf-lisp-lcaf-03.txt

   o  Submitted September 2013.

   o  Updated references and author's affilations.

   o  Added Instance-ID to the Multicast Info Type so there is relative
      ease in parsing (S,G) entries within a VPN.

   o  Add port range encodings to the Application Data LCAF Type.

   o  Add a new JSON LCAF Type.

   o  Add Address Key/Value LCAF Type to allow attributes to be attached
      to an address.

B.3.

B.4.  Changes to =
draft-ietf-lisp-lcaf-02.txt

   o  Submitted March 2013.

   o  Added new LCAF Type "Replication List Entry" to support LISP
      replication engineering use-cases.

   o  Changed references to new LISP RFCs.

B.4.

B.5.  Changes to =
draft-ietf-lisp-lcaf-01.txt

   o  Submitted January 2013.

   o  Change longitude range from 0-90 to 0-180 in section 4.4.

   o  Added reference to WGS-84 in section 4.4.

B.5.

B.6.  Changes to =
draft-ietf-lisp-lcaf-00.txt

   o  Posted first working group draft August 2012.

   o  This draft was renamed from draft-farinacci-lisp-lcaf-10.txt.

Authors' Addresses

   Dino Farinacci
   lispers.net
   San Jose, CA
   USA

   Email: farinacci@gmail.com

   Dave Meyer
   Brocade
   San Jose, CA
   USA

   Email: dmm@1-4-5.net

   Job Snijders
   Hibernia Networks
   Tupolevlaan 103a
   Schiphol-Rijk,   1119 PA
   NL

   Email: job.snijders@hibernianetworks.com
X-Generator: pyht 0.35 = --Apple-Mail=_3BC4A146-4E67-4245-89D0-CEAF46C4FA3F Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii --Apple-Mail=_3BC4A146-4E67-4245-89D0-CEAF46C4FA3F Content-Disposition: attachment; filename=draft-ietf-lisp-lcaf-05.txt Content-Type: text/plain; x-unix-mode=0644; name="draft-ietf-lisp-lcaf-05.txt" Content-Transfer-Encoding: quoted-printable Network Working Group D. Farinacci Internet-Draft lispers.net Intended status: Experimental D. Meyer Expires: November 7, 2014 Brocade J. Snijders Hibernia Networks May 6, 2014 LISP Canonical Address Format (LCAF) draft-ietf-lisp-lcaf-05 Abstract This draft defines a canonical address format encoding used in LISP control messages and in the encoding of lookup keys for the LISP Mapping Database System. Status of this Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on November 7, 2014. Copyright Notice Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as Farinacci, et al. Expires November 7, 2014 [Page 1] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Definition of Terms . . . . . . . . . . . . . . . . . . . . . 4 3. LISP Canonical Address Format Encodings . . . . . . . . . . . 5 4. LISP Canonical Address Applications . . . . . . . . . . . . . 7 4.1. Segmentation using LISP . . . . . . . . . . . . . . . . . 7 4.2. Carrying AS Numbers in the Mapping Database . . . . . . . 8 4.3. Convey Application Specific Data . . . . . . . . . . . . . 9 4.4. Assigning Geo Coordinates to Locator Addresses . . . . . . 10 4.5. Generic Database Mapping Lookups . . . . . . . . . . . . . 12 4.6. NAT Traversal Scenarios . . . . . . . . . . . . . . . . . 13 4.7. PETR Admission Control Functionality . . . . . . . . . . . 15 4.8. Multicast Group Membership Information . . . . . . . . . . 16 4.9. Traffic Engineering using Re-encapsulating Tunnels . . . . 18 4.10. Storing Security Data in the Mapping Database . . . . . . 19 4.11. Source/Destination 2-Tuple Lookups . . . . . . . . . . . . 20 4.12. Replication List Entries for Multicast Forwarding . . . . 21 4.13. Data Model Encoding . . . . . . . . . . . . . . . . . . . 22 4.14. Encoding Key/Value Address Pairs . . . . . . . . . . . . . 23 4.15. Applications for AFI List Type . . . . . . . . . . . . . . 23 4.15.1. Binding IPv4 and IPv6 Addresses . . . . . . . . . . . 23 4.15.2. Layer-2 VPNs . . . . . . . . . . . . . . . . . . . . 25 4.15.3. ASCII Names in the Mapping Database . . . . . . . . . 25 4.15.4. Using Recursive LISP Canonical Address Encodings . . 26 4.15.5. Compatibility Mode Use Case . . . . . . . . . . . . . 27 5. Security Considerations . . . . . . . . . . . . . . . . . . . 28 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 29 7. References . . . . . . . . . . . . . . . . . . . . . . . . . . 30 7.1. Normative References . . . . . . . . . . . . . . . . . . . 30 7.2. Informative References . . . . . . . . . . . . . . . . . . 30 Appendix A. Acknowledgments . . . . . . . . . . . . . . . . . . . 32 Appendix B. Document Change Log . . . . . . . . . . . . . . . . . 33 B.1. Changes to draft-ietf-lisp-lcaf-05.txt . . . . . . . . . . 33 B.2. Changes to draft-ietf-lisp-lcaf-04.txt . . . . . . . . . . 33 B.3. Changes to draft-ietf-lisp-lcaf-03.txt . . . . . . . . . . 33 B.4. Changes to draft-ietf-lisp-lcaf-02.txt . . . . . . . . . . 33 B.5. Changes to draft-ietf-lisp-lcaf-01.txt . . . . . . . . . . 33 B.6. Changes to draft-ietf-lisp-lcaf-00.txt . . . . . . . . . . 34 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 35 Farinacci, et al. Expires November 7, 2014 [Page 2] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 1. Introduction The LISP architecture and protocols [RFC6830] introduces two new numbering spaces, Endpoint Identifiers (EIDs) and Routing Locators (RLOCs) which are intended to replace most use of IP addresses on the Internet. To provide flexibility for current and future applications, these values can be encoded in LISP control messages using a general syntax that includes Address Family Identifier (AFI), length, and value fields. Currently defined AFIs include IPv4 and IPv6 addresses, which are formatted according to code-points assigned in [AFI] as follows: IPv4 Encoded Address: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 1 | IPv4 Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... IPv4 Address | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ IPv6 Encoded Address: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 2 | IPv6 Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... IPv6 Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... IPv6 Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... IPv6 Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... IPv6 Address | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ This document describes the currently-defined AFIs the LISP protocol uses along with their encodings and introduces the LISP Canonical Address Format (LCAF) that can be used to define the LISP-specific encodings for arbitrary AFI values. Farinacci, et al. Expires November 7, 2014 [Page 3] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 2. Definition of Terms Address Family Identifier (AFI): a term used to describe an address encoding in a packet. An address family currently defined for IPv4 or IPv6 addresses. See [AFI] and [RFC1700] for details. The reserved AFI value of 0 is used in this specification to indicate an unspecified encoded address where the the length of the address is 0 bytes following the 16-bit AFI value of 0. Unspecified Address Format: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 0 | = | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Endpoint ID (EID): a 32-bit (for IPv4) or 128-bit (for IPv6) value used in the source and destination address fields of the first (most inner) LISP header of a packet. The host obtains a destination EID the same way it obtains a destination address today, for example through a DNS lookup or SIP exchange. The source EID is obtained via existing mechanisms used to set a host's "local" IP address. An EID is allocated to a host from an EID-prefix block associated with the site where the host is located. An EID can be used by a host to refer to other hosts. Routing Locator (RLOC): the IPv4 or IPv6 address of an egress tunnel router (ETR). It is the output of a EID-to-RLOC mapping lookup. An EID maps to one or more RLOCs. Typically, RLOCs are numbered from topologically aggregatable blocks that are assigned to a site at each point to which it attaches to the global Internet; where the topology is defined by the connectivity of provider networks, RLOCs can be thought of as PA addresses. Multiple RLOCs can be assigned to the same ETR device or to multiple ETR devices at a site. Farinacci, et al. Expires November 7, 2014 [Page 4] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 3. LISP Canonical Address Format Encodings IANA has assigned AFI value 16387 (0x4003) to the LISP architecture and protocols. This specification defines the encoding format of the LISP Canonical Address (LCA). The first 4 bytes of an LISP Canonical Address are followed by a variable length of fields: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 16387 | Rsvd1 | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type | Rsvd2 | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Rsvd1: this 8-bit field is reserved for future use and MUST be transmitted as 0 and ignored on receipt. Flags: this 8-bit field is for future definition and use. For now, set to zero on transmission and ignored on receipt. Type: this 8-bit field is specific to the LISP Canonical Address formatted encodings, values are: Type 0: Null Body Type Type 1: AFI List Type Type 2: Instance ID Type Type 3: AS Number Type Type 4: Application Data Type Type 5: Geo Coordinates Type Type 6: Opaque Key Type Type 7: NAT-Traversal Type Type 8: Nonce Locator Type Type 9: Multicast Info Type Farinacci, et al. Expires November 7, 2014 [Page 5] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 Type 10: Explicit Locator Path Type Type 11: Security Key Type Type 12: Source/Dest Key Type Type 13: Replication List Entry Type Type 14: JSON Data Model Type Type 15: Key/Value Address Pair Type Rsvd2: this 8-bit field is reserved for future use and MUST be transmitted as 0 and ignored on receipt. Length: this 16-bit field is in units of bytes and covers all of the LISP Canonical Address payload, starting and including the byte after the Length field. So any LCAF encoded address will have a minimum length of 8 bytes when the Length field is 0. The 8 bytes include the AFI, Flags, Type, Reserved, and Length fields. When the AFI is not next to encoded address in a control message, then the encoded address will have a minimum length of 6 bytes when the Length field is 0. The 6 bytes include the Flags, Type, Reserved, and Length fields. Farinacci, et al. Expires November 7, 2014 [Page 6] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 4. LISP Canonical Address Applications 4.1. Segmentation using LISP When multiple organizations inside of a LISP site are using private addresses [RFC1918] as EID-prefixes, their address spaces must remain segregated due to possible address duplication. An Instance ID in the address encoding can aid in making the entire AFI based address unique. Another use for the Instance ID LISP Canonical Address Format is when creating multiple segmented VPNs inside of a LISP site where keeping EID-prefix based subnets is desirable. Instance ID LISP Canonical Address Format: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 16387 | Rsvd1 | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type =3D 2 | IID mask-len | 4 + n | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Instance ID | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D x | Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ IID mask-len: if the AFI is set to 0, then this format is not encoding an extended EID-prefix but rather an instance-ID range where the 'IID mask-len' indicates the number of high-order bits used in the Instance ID field for the range. Length value n: length in bytes of the AFI address that follows the Instance ID field including the AFI field itself. Instance ID: the low-order 24-bits that can go into a LISP data header when the I-bit is set. See [RFC6830] for details. AFI =3D x: x can be any AFI value from [AFI]. This LISP Canonical Address Type can be used to encode either EID or RLOC addresses. Farinacci, et al. Expires November 7, 2014 [Page 7] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 4.2. Carrying AS Numbers in the Mapping Database When an AS number is stored in the LISP Mapping Database System for either policy or documentation reasons, it can be encoded in a LISP Canonical Address. AS Number LISP Canonical Address Format: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 16387 | Rsvd1 | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type =3D 3 | Rsvd2 | 4 + n | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AS Number | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D x | Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Length value n: length in bytes of the AFI address that follows the AS Number field including the AFI field itself. AS Number: the 32-bit AS number of the autonomous system that has been assigned either the EID or RLOC that follows. AFI =3D x: x can be any AFI value from [AFI]. The AS Number Canonical Address Type can be used to encode either EID or RLOC addresses. The former is used to describe the LISP-ALT AS number the EID-prefix for the site is being carried for. The latter is used to describe the AS that is carrying RLOC based prefixes in the underlying routing system. Farinacci, et al. Expires November 7, 2014 [Page 8] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 4.3. Convey Application Specific Data When a locator-set needs to be conveyed based on the type of application or the Per-Hop Behavior (PHB) of a packet, the Application Data Type can be used. Application Data LISP Canonical Address Format: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 16387 | Rsvd1 | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type =3D 4 | Rsvd2 | 8 + n | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | IP TOS, IPv6 TC, or Flow Label | Protocol | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Local Port (lower-range) | Local Port (upper-range) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Remote Port (lower-range) | Remote Port (upper-range) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D x | Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Length value n: length in bytes of the AFI address that follows the 8-byte Application Data fields including the AFI field itself. IP TOS, IPv6 TC, or Flow Label: this field stores the 8-bit IPv4 TOS field used in an IPv4 header, the 8-bit IPv6 Traffic Class or Flow Label used in an IPv6 header. Local Port/Remote Port Ranges: these fields are from the TCP, UDP, or SCTP transport header. A range can be specified by using a lower value and an upper value. When a single port is encoded, the lower and upper value fields are the same. AFI =3D x: x can be any AFI value from [AFI]. The Application Data Canonical Address Type is used for an EID encoding when an ITR wants a locator-set for a specific application. When used for an RLOC encoding, the ETR is supplying a locator-set for each specific application is has been configured to advertise. Farinacci, et al. Expires November 7, 2014 [Page 9] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 4.4. Assigning Geo Coordinates to Locator Addresses If an ETR desires to send a Map-Reply describing the Geo Coordinates for each locator in its locator-set, it can use the Geo Coordinate Type to convey physical location information. Coordinates are specified using the WGS-84 (World Geodetic System) reference coordinate system [WGS-84]. Geo Coordinate LISP Canonical Address Format: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 16387 | Rsvd1 | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type =3D 5 | Rsvd2 | 12 + n | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |N| Latitude Degrees | Minutes | Seconds | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |E| Longitude Degrees | Minutes | Seconds | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Altitude | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D x | Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Length value n: length in bytes of the AFI address that follows the 8-byte Longitude and Latitude fields including the AFI field itself. N: When set to 1 means North, otherwise South. Latitude Degrees: Valid values range from 0 to 90 degrees above or below the equator (northern or southern hemisphere, respectively). Latitude Minutes: Valid values range from 0 to 59. Latitude Seconds: Valid values range from 0 to 59. E: When set to 1 means East, otherwise West. Longitude Degrees: Value values are from 0 to 180 degrees right or left of the Prime Meridian. Farinacci, et al. Expires November 7, 2014 [Page 10] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 Longitude Minutes: Valid values range from 0 to 59. Longitude Seconds: Valid values range from 0 to 59. Altitude: Height relative to sea level in meters. This is a signed integer meaning that the altitude could be below sea level. A value of 0x7fffffff indicates no Altitude value is encoded. AFI =3D x: x can be any AFI value from [AFI]. The Geo Coordinates Canonical Address Type can be used to encode either EID or RLOC addresses. When used for EID encodings, you can determine the physical location of an EID along with the topological location by observing the locator-set. Farinacci, et al. Expires November 7, 2014 [Page 11] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 4.5. Generic Database Mapping Lookups When the LISP Mapping Database system holds information accessed by a generic formatted key (where the key is not the usual IPv4 or IPv6 address), an opaque key may be desirable. Opaque Key LISP Canonical Address Format: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 16387 | Rsvd1 | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type =3D 6 | Rsvd2 | n | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Key Field Num | Key Wildcard Fields | Key . . . | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | . . . Key | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Length value n: length in bytes of the type's payload. The value n is the number of bytes that follow this Length field. Key Field Num: the number of fields (minus 1) the key can be broken up into. The width of the fields are fixed length. So for a key size of 8 bytes, with a Key Field Num of 4 allows 4 fields of 2 bytes in length. Valid values for this field range from 0 to 15 supporting a maximum of 16 field separations. Key Wildcard Fields: describes which fields in the key are not used as part of the key lookup. This wildcard encoding is a bitfield. Each bit is a don't-care bit for a corresponding field in the key. Bit 0 (the low-order bit) in this bitfield corresponds the first field, right-justified in the key, bit 1 the second field, and so on. When a bit is set in the bitfield it is a don't-care bit and should not be considered as part of the database lookup. When the entire 16-bits is set to 0, then all bits of the key are used for the database lookup. Key: the variable length key used to do a LISP Database Mapping lookup. The length of the key is the value n (shown above) minus 3. Farinacci, et al. Expires November 7, 2014 [Page 12] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 4.6. NAT Traversal Scenarios When a LISP system is conveying global address and mapped port information when traversing through a NAT device, the NAT-Traversal LCAF Type is used. See [LISP-NATT] for details. NAT-Traversal Canonical Address Format: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 16387 | Rsvd1 | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type =3D 7 | Rsvd2 | 4 + n | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | MS UDP Port Number | ETR UDP Port Number | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D x | Global ETR RLOC Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D x | MS RLOC Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D x | Private ETR RLOC Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D x | RTR RLOC Address 1 ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D x | RTR RLOC Address k ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Length value n: length in bytes of the AFI addresses that follows the UDP Port Number field including the AFI fields themselves. MS UDP Port Number: this is the UDP port number of the Map-Server and is set to 4342. ETR UDP Port Number: this is the port number returned to a LISP system which was copied from the source port from a packet that has flowed through a NAT device. AFI =3D x: x can be any AFI value from [AFI]. Global ETR RLOC Address: this is an address known to be globally unique built by NAT-traversal functionality in a LISP router. MS RLOC Address: this is the address of the Map-Server used in the destination RLOC of a packet that has flowed through a NAT device. Farinacci, et al. Expires November 7, 2014 [Page 13] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 Private ETR RLOC Address: this is an address known to be a private address inserted in this LCAF format by a LISP router that resides on the private side of a NAT device. RTR RLOC Address: this is an encapsulation address used by an ITR or PITR which resides behind a NAT device. This address is known to have state in a NAT device so packets can flow from it to the LISP ETR behind the NAT. There can be one or more NTR addresses supplied in these set of fields. The number of NTRs encoded is determined by the LCAF length field. When there are no NTRs supplied, the NTR fields can be omitted and reflected by the LCAF length field or an AFI of 0 can be used to indicate zero NTRs encoded. Farinacci, et al. Expires November 7, 2014 [Page 14] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 4.7. PETR Admission Control Functionality When a public PETR device wants to verify who is encapsulating to it, it can check for a specific nonce value in the LISP encapsulated packet. To convey the nonce to admitted ITRs or PITRs, this LCAF format is used in a Map-Register or Map-Reply locator-record. Nonce Locator Canonical Address Format: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 16387 | Rsvd1 | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type =3D 8 | Rsvd2 | 4 + n | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Reserved | Nonce | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D x | Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Length value n: length in bytes of the AFI address that follows the Nonce field including the AFI field itself. Reserved: must be set to zero and ignore on receipt. Nonce: this is a nonce value returned by an ETR in a Map-Reply locator-record to be used by an ITR or PITR when encapsulating to the locator address encoded in the AFI field of this LCAF type. AFI =3D x: x can be any AFI value from [AFI]. Farinacci, et al. Expires November 7, 2014 [Page 15] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 4.8. Multicast Group Membership Information Multicast group information can be published in the mapping database so a lookup on an EID based group address can return a replication list of group addresses or a unicast addresses for single replication or multiple head-end replications. The intent of this type of unicast replication is to deliver packets to multiple ETRs at receiver LISP multicast sites. The locator-set encoding for this EID record type can be a list of ETRs when they each register with "Merge Semantics". The encoding can be a typical AFI encoded locator address. When an RTR list is being registered (with multiple levels according to [LISP-RE]), the Replication List Entry LCAF type is used for locator encoding. This LCAF encoding can be used to send broadcast packets to all members of a subnet when each EIDs are away from their home subnet location. Multicast Info Canonical Address Format: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 16387 | Rsvd1 | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type =3D 9 | Rsvd2 |R|L|J| 8 + n | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Instance-ID | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Reserved | Source MaskLen| Group MaskLen | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D x | Source/Subnet Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D x | Group Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Length value n: length in bytes of fields that follow. Reserved: must be set to zero and ignore on receipt. R-bit: this is the RP-bit that represents PIM (S,G,RP-bit) multicast state. This bit can be set for Joins (when the J-bit is set) or for Leaves (when the L-bit is set). See [LISP-MRSIG] for more usage details. Farinacci, et al. Expires November 7, 2014 [Page 16] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 L-bit: this is the Leave-Request bit and is used when this LCAF type is present in the destination EID-prefix field of a Map-Request. See [LISP-MRSIG] for details. J-bit: this is the Join-Request bit and is used when this LCAF type is present in the destination EID-prefix field of a Map-Request. See [LISP-MRSIG] for details. The J-bit MUST not be set when the L-bit is also set in the same LCAF block. A receiver should not take any specific Join or Leave action when both bits are set. Instance ID: the low-order 24-bits that can go into a LISP data header when the I-bit is set. See [RFC6830] for details. The use of the Instance-ID in this LCAF type is to associate a multicast forwarding entry for a given VPN. The instance-ID describes the VPN and is registered to the mapping database system as a 3-tuple of (Instance-ID, S-prefix, G-prefix). Source MaskLen: the mask length of the source prefix that follows. Group MaskLen: the mask length of the group prefix that follows. AFI =3D x: x can be any AFI value from [AFI]. When a specific AFI = has its own encoding of a multicast address, this field must be either a group address or a broadcast address. Farinacci, et al. Expires November 7, 2014 [Page 17] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 4.9. Traffic Engineering using Re-encapsulating Tunnels For a given EID lookup into the mapping database, this LCAF format can be returned to provide a list of locators in an explicit re- encapsulation path. See [LISP-TE] for details. Explicit Locator Path (ELP) Canonical Address Format: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 16387 | Rsvd1 | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type =3D 10 | Rsvd2 | n | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Rsvd3 |L|P|S| AFI =3D x | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Reencap Hop 1 ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Rsvd3 |L|P|S| AFI =3D x | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Reencap Hop k ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Length value n: length in bytes of fields that follow. Lookup bit (L): this is the Lookup bit used to indicate to the user of the ELP to not use this address for encapsulation but to look it up in the mapping database system to obtain an encapsulating RLOC address. RLOC-Probe bit (P): this is the RLOC-probe bit which means the Reencap Hop allows RLOC-probe messages to be sent to it. When the R-bit is set to 0, RLOC-probes must not be sent. When a Reencap Hop is an anycast address then multiple physical Reencap Hops are using the same RLOC address. In this case, RLOC-probes are not needed because when the closest RLOC address is not reachable another RLOC address can reachable. Strict bit (S): this the strict bit which means the associated Rencap Hop is required to be used. If this bit is 0, the reencapsulator can skip this Reencap Hop and go to the next one in the list. AFI =3D x: x can be any AFI value from [AFI]. When a specific AFI = has its own encoding of a multicast address, this field must be either a group address or a broadcast address. Farinacci, et al. Expires November 7, 2014 [Page 18] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 4.10. Storing Security Data in the Mapping Database When a locator in a locator-set has a security key associated with it, this LCAF format will be used to encode key material. See [LISP-DDT] for details. Security Key Canonical Address Format: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 16387 | Rsvd1 | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type =3D 11 | Rsvd2 | 6 + n | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Key Count | Rsvd3 | Key Algorithm | Rsvd4 |R| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Key Length | Key Material ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... Key Material | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D x | Locator Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Length value n: length in bytes of fields that start with the Key Material field. Key Count: the Key Count field declares the number of Key sections included in this LCAF. Key Algorithm: the Algorithm field identifies the key's cryptographic algorithm and specifies the format of the Public Key field. R bit: this is the revoke bit and, if set, it specifies that this Key is being Revoked. Key Length: this field determines the length in bytes of the Key Material field. Key Material: the Key Material field stores the key material. The format of the key material stored depends on the Key Algorithm field. AFI =3D x: x can be any AFI value from [AFI].This is the locator address that owns the encoded security key. Farinacci, et al. Expires November 7, 2014 [Page 19] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 4.11. Source/Destination 2-Tuple Lookups When both a source and destination address of a flow needs consideration for different locator-sets, this 2-tuple key is used in EID fields in LISP control messages. When the Source/Dest key is registered to the mapping database, it can be encoded as a source- prefix and destination-prefix. When the Source/Dest is used as a key for a mapping database lookup the source and destination come from a data packet. Source/Dest Key Canonical Address Format: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 16387 | Rsvd1 | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type =3D 12 | Rsvd2 | 4 + n | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Reserved | Source-ML | Dest-ML | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D x | Source-Prefix ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D x | Destination-Prefix ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Length value n: length in bytes of fields that follow. Reserved: must be set to zero and ignore on receipt. Source-ML: the mask length of the source prefix that follows. Dest-ML: the mask length of the destination prefix that follows. AFI =3D x: x can be any AFI value from [AFI]. When a specific AFI = has its own encoding of a multicast address, this field must be either a group address or a broadcast address. Refer to [LISP-TE] for usage details. Farinacci, et al. Expires November 7, 2014 [Page 20] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 4.12. Replication List Entries for Multicast Forwarding The Replication List Entry LCAF type is an encoding for a locator being used for unicast replication according to the specification in [LISP-RE]. This locator encoding is pointed to by a Multicast Info LCAF Type and is registered by Re-encapsulating Tunnel Routers (RTRs) that are participating in an overlay distribution tree. Each RTR will register its locator address and its configured level in the distribution tree. Replication List Entry Address Format: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 16387 | Rsvd1 | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type =3D 13 | Rsvd2 | 4 + n | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Rsvd3 | Rsvd4 | Level Value | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D x | RTR/ETR #1 ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Rsvd3 | Rsvd4 | Level Value | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D x | RTR/ETR #n ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Length value n: length in bytes of fields that follow. Rsvd{1,2,3,4}: must be set to zero and ignore on receipt. Level Value: this value is associated with the level within the overlay distribution tree hierarchy where the RTR resides. The level numbers are ordered from lowest value being close to the ITR (meaning that ITRs replicate to level-0 RTRs) and higher levels are further downstream on the distribution tree closer to ETRs of multicast receiver sites. AFI =3D x: x can be any AFI value from [AFI]. A specific AFI has = its own encoding of either a unicast or multicast locator address. All RTR/ETR entries for the same level should be combined together by a Map-Server to avoid searching through the entire multi-level list of locator entries in a Map-Reply message. Farinacci, et al. Expires November 7, 2014 [Page 21] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 4.13. Data Model Encoding This type allows a JSON data model to be encoded either as an EID or RLOC. JSON Data Model Type Address Format: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 16387 | Rsvd1 | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type =3D 14 | Rsvd2 |B| n | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | JSON length | JSON binary/text encoding ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D x | Optional Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Length value n: length in bytes of fields that follow. Rsvd{1,2}: must be set to zero and ignore on receipt. B bit: indicates that the JSON field is binary encoded according to [JSON-BINARY] when the bit is set to 1. Otherwise the encoding is based on text encoding according to [RFC4627]. JSON length: length in octets of the following 'JSON binary/text encoding' field. JSON binary/text encoding field: a variable length field that contains either binary or text encodings. AFI =3D x: x can be any AFI value from [AFI]. A specific AFI has = its own encoding of either a unicast or multicast locator address. All RTR/ETR entries for the same level should be combined together by a Map-Server to avoid searching through the entire multi-level list of locator entries in a Map-Reply message. Farinacci, et al. Expires November 7, 2014 [Page 22] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 4.14. Encoding Key/Value Address Pairs The Key/Value pair is for example useful for attaching attributes to other elements of LISP packets, such as EIDs or RLOCs. When attaching attributes to EIDs or RLOCs, it's necessary to distinguish between the element that should be used as EID or RLOC, and hence as key for lookups, and additional attributes. This is especially the case when the difference cannot be determined from the types of the elements, such as when two IP addresses are being used. Key/Value Pair Address Format: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 16387 | Rsvd1 | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type =3D 15 | Rsvd2 | n | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D x | Address as Key ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D x | Address as Value ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Length value n: length in bytes of fields that follow. Rsvd{1,2}: must be set to zero and ignore on receipt. AFI =3D x: x can be any AFI value from [AFI]. A specific AFI has = its own encoding of either a unicast or multicast locator address. All RTR/ETR entries for the same level should be combined together by a Map-Server to avoid searching through the entire multi-level list of locator entries in a Map-Reply message. Address as Key: this AFI encoded address will be attached with the attributes encoded in "Address as Value" which follows this field. Address as Value: this AFI encoded address will be the attribute address that goes along with "Address as Key" which precedes this field. 4.15. Applications for AFI List Type 4.15.1. Binding IPv4 and IPv6 Addresses When header translation between IPv4 and IPv6 is desirable a LISP Canonical Address can use the AFI List Type to carry multiple AFIs in one LCAF AFI. Farinacci, et al. Expires November 7, 2014 [Page 23] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 Address Binding LISP Canonical Address Format: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 16387 | Rsvd1 | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type =3D 1 | Rsvd2 | 2 + 4 + 2 + 16 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 1 | IPv4 Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... IPv4 Address | AFI =3D 2 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | IPv6 Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... IPv6 Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... IPv6 Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... IPv6 Address | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Length: length in bytes is fixed at 24 when IPv4 and IPv6 AFI encoded addresses are used. This type of address format can be included in a Map-Request when the address is being used as an EID, but the Mapping Database System lookup destination can use only the IPv4 address. This is so a Mapping Database Service Transport System, such as LISP-ALT [RFC6836], can use the Map-Request destination address to route the control message to the desired LISP site. Farinacci, et al. Expires November 7, 2014 [Page 24] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 4.15.2. Layer-2 VPNs When MAC addresses are stored in the LISP Mapping Database System, the AFI List Type can be used to carry AFI 6. MAC Address LISP Canonical Address Format: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 16387 | Rsvd1 | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type =3D 1 | Rsvd2 | 2 + 6 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 6 | Layer-2 MAC Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... Layer-2 MAC Address | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Length: length in bytes is fixed at 8 when MAC address AFI encoded addresses are used. This address format can be used to connect layer-2 domains together using LISP over an IPv4 or IPv6 core network to create a layer-2 VPN. In this use-case, a MAC address is being used as an EID, and the locator-set that this EID maps to can be an IPv4 or IPv6 RLOCs, or even another MAC address being used as an RLOC. 4.15.3. ASCII Names in the Mapping Database If DNS names or URIs are stored in the LISP Mapping Database System, the AFI List Type can be used to carry an ASCII string where it is delimited by length 'n' of the LCAF Length encoding. ASCII LISP Canonical Address Format: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 16387 | Rsvd1 | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type =3D 1 | Rsvd2 | 2 + n | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 17 | DNS Name or URI ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Farinacci, et al. Expires November 7, 2014 [Page 25] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 Length value n: length in bytes AFI=3D17 field and the = null-terminated ASCII string (the last byte of 0 is included). 4.15.4. Using Recursive LISP Canonical Address Encodings When any combination of above is desirable, the AFI List Type value can be used to carry within the LCAF AFI another LCAF AFI. Recursive LISP Canonical Address Format: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 16387 | Rsvd1 | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type =3D 1 | Rsvd2 | 4 + 8 + 2 + 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 16387 | Rsvd1 | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type =3D 4 | Rsvd2 | 12 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | IP TOS, IPv6 QQS or Flow Label | Protocol | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Local Port | Remote Port | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 1 | IPv4 Address ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... IPv4 Address | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Length: length in bytes is fixed at 18 when an AFI=3D1 IPv4 address = is included. This format could be used by a Mapping Database Transport System, such as LISP-ALT [RFC6836], where the AFI=3D1 IPv4 address is used as an EID and placed in the Map-Request destination address by the sending LISP system. The ALT system can deliver the Map-Request to the LISP destination site independent of the Application Data Type AFI payload values. When this AFI is processed by the destination LISP site, it can return different locator-sets based on the type of application or level of service that is being requested. Farinacci, et al. Expires November 7, 2014 [Page 26] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 4.15.5. Compatibility Mode Use Case A LISP system should use the AFI List Type format when sending to LISP systems that do not support a particular LCAF Type used to encode locators. This allows the receiving system to be able to parse a locator address for encapsulation purposes. The list of AFIs in an AFI List LCAF Type has no semantic ordering and a receiver should parse each AFI element no matter what the ordering. Compatibility Mode Address Format: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 16387 | Rsvd1 | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type =3D 1 | Rsvd2 | 22 + 6 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 16387 | Rsvd1 | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type =3D 5 | Rsvd2 | 12 + 2 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |N| Latitude Degrees | Minutes | Seconds | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |E| Longitude Degrees | Minutes | Seconds | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Altitude | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AFI =3D 0 | AFI =3D 1 = | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | IPv4 Address | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ If a system does not recognized the Geo Coordinate LCAF Type that is accompanying a locator address, an encoder can include the Geo Coordinate LCAF Type embedded in a AFI List LCAF Type where the AFI in the Geo Coordinate LCAF is set to 0 and the AFI encoded next in the list is encoded with a valid AFI value to identify the locator address. A LISP system is required to support the AFI List LCAF Type to use this procedure. It would skip over 10 bytes of the Geo Coordinate LCAF Type to get to the locator address encoding (an IPv4 locator address). A LISP system that does support the Geo Coordinate LCAF Type can support parsing the locator address within the Geo Coordinate LCAF encoding or in the locator encoding that follows in the AFI List LCAF. Farinacci, et al. Expires November 7, 2014 [Page 27] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 5. Security Considerations There are no security considerations for this specification. The security considerations are documented for the protocols that use LISP Canonical Addressing. Refer to the those relevant specifications. Farinacci, et al. Expires November 7, 2014 [Page 28] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 6. IANA Considerations The Address Family AFI definitions from [AFI] only allocate code- points for the AFI value itself. The length of the address or entity that follows is not defined and is implied based on conventional experience. Where the LISP protocol uses LISP Canonical Addresses specifically, the address length definitions will be in this specification and take precedent over any other specification. An IANA Registry for LCAF Type values will be created. The values that are considered for use by the main LISP specification [RFC6830] will be in the IANA Registry. Other Type values used for experimentation will be defined and described in this document. Farinacci, et al. Expires November 7, 2014 [Page 29] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 7. References 7.1. Normative References [RFC1700] Reynolds, J. and J. Postel, "Assigned Numbers", RFC 1700, October 1994. [RFC1918] Rekhter, Y., Moskowitz, R., Karrenberg, D., Groot, G., and E. Lear, "Address Allocation for Private Internets", BCP 5, RFC 1918, February 1996. [RFC4627] Crockford, D., "The application/json Media Type for JavaScript Object Notation (JSON)", RFC 4627, July 2006. [RFC6830] Farinacci, D., Fuller, V., Meyer, D., and D. Lewis, "The Locator/ID Separation Protocol (LISP)", RFC 6830, January 2013. [RFC6836] Fuller, V., Farinacci, D., Meyer, D., and D. Lewis, "Locator/ID Separation Protocol Alternative Logical Topology (LISP+ALT)", RFC 6836, January 2013. 7.2. Informative References [AFI] IANA, "Address Family Identifier (AFIs)", ADDRESS FAMILY NUMBERS http://www.iana.org/numbers.html, Febuary 2007. [JSON-BINARY] "Universal Binary JSON Specification", URL http://ubjson.org. [LISP-DDT] Fuller, V., Lewis, D., and V. Ermagan, "LISP Delegated Database Tree", draft-ietf-lisp-ddt-01.txt (work in progress). [LISP-MRSIG] Farinacci, D. and M. Napierala, "LISP Control-Plane Multicast Signaling", draft-farinacci-lisp-mr-signaling-03.txt (work in progress). [LISP-NATT] Ermagan, V., Farinacci, D., Lewis, D., Skriver, J., Maino, F., and C. White, "NAT traversal for LISP", draft-ermagan-lisp-nat-traversal-03.txt (work in progress). Farinacci, et al. Expires November 7, 2014 [Page 30] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 [LISP-RE] Coras, F., Cabellos-Aparicio, A., Domingo-Pascual, J., Maino, F., and D. Farinacci, "LISP Replication Engineering", draft-coras-lisp-re-03.txt (work in progress). [LISP-TE] Farinacci, D., Lahiri, P., and M. Kowal, "LISP Traffic Engineering Use-Cases", draft-farinacci-lisp-te-03.txt (work in progress). [WGS-84] Geodesy and Geophysics Department, DoD., "World Geodetic System 1984", NIMA TR8350.2, January 2000, . Farinacci, et al. Expires November 7, 2014 [Page 31] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 Appendix A. Acknowledgments The authors would like to thank Vince Fuller, Gregg Schudel, Jesper Skriver, Luigi Iannone, Isidor Kouvelas, and Sander Steffann for their technical and editorial commentary. The authors would like to thank Victor Moreno for discussions that lead to the definition of the Multicast Info LCAF type. The authors would like to thank Parantap Lahiri and Michael Kowal for discussions that lead to the definition of the Explicit Locator Path (ELP) LCAF type. The authors would like to thank Fabio Maino and Vina Ermagan for discussions that lead to the definition of the Security Key LCAF type. The authors would like to thank Albert Cabellos-Aparicio and Florin Coras for discussions that lead to the definition of the Replication List Entry LCAF type. Thanks goes to Michiel Blokzijl and Alberto Rodriguez-Natal for suggesting new LCAF types. Thanks also goes to Terry Manderson for assistance obtaining a LISP AFI value from IANA. Farinacci, et al. Expires November 7, 2014 [Page 32] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 Appendix B. Document Change Log B.1. Changes to draft-ietf-lisp-lcaf-05.txt o Submitted May 2014. o Add a length field of the JSON payload that can be used for either binary or text encoding of JSON data. B.2. Changes to draft-ietf-lisp-lcaf-04.txt o Submitted January 2014. o Agreement among ELP implementors to have the AFI 16-bit field adjacent to the address. This will make the encoding consistent with all other LCAF type address encodings. B.3. Changes to draft-ietf-lisp-lcaf-03.txt o Submitted September 2013. o Updated references and author's affilations. o Added Instance-ID to the Multicast Info Type so there is relative ease in parsing (S,G) entries within a VPN. o Add port range encodings to the Application Data LCAF Type. o Add a new JSON LCAF Type. o Add Address Key/Value LCAF Type to allow attributes to be attached to an address. B.4. Changes to draft-ietf-lisp-lcaf-02.txt o Submitted March 2013. o Added new LCAF Type "Replication List Entry" to support LISP replication engineering use-cases. o Changed references to new LISP RFCs. B.5. Changes to draft-ietf-lisp-lcaf-01.txt o Submitted January 2013. o Change longitude range from 0-90 to 0-180 in section 4.4. Farinacci, et al. Expires November 7, 2014 [Page 33] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 o Added reference to WGS-84 in section 4.4. B.6. Changes to draft-ietf-lisp-lcaf-00.txt o Posted first working group draft August 2012. o This draft was renamed from draft-farinacci-lisp-lcaf-10.txt. Farinacci, et al. Expires November 7, 2014 [Page 34] =0C Internet-Draft LISP Canonical Address Format (LCAF) May 2014 Authors' Addresses Dino Farinacci lispers.net San Jose, CA USA Email: farinacci@gmail.com Dave Meyer Brocade San Jose, CA USA Email: dmm@1-4-5.net Job Snijders Hibernia Networks Tupolevlaan 103a Schiphol-Rijk, 1119 PA NL Email: job.snijders@hibernianetworks.com Farinacci, et al. Expires November 7, 2014 [Page 35] =0C --Apple-Mail=_3BC4A146-4E67-4245-89D0-CEAF46C4FA3F Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii --Apple-Mail=_3BC4A146-4E67-4245-89D0-CEAF46C4FA3F-- From nobody Tue May 6 08:43:43 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F0181A077E; Tue, 6 May 2014 08:43:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jFg1L6XbDp9Z; Tue, 6 May 2014 08:43:32 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E77A21A0391; Tue, 6 May 2014 08:43:31 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 5.4.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20140506154331.6259.59551.idtracker@ietfa.amsl.com> Date: Tue, 06 May 2014 08:43:31 -0700 Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/-wc0MLXc4_Drlq7eVRtpth7cOIM Cc: lisp@ietf.org Subject: [lisp] I-D Action: draft-ietf-lisp-lcaf-05.txt X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 May 2014 15:43:34 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Locator/ID Separation Protocol Working Group of the IETF. Title : LISP Canonical Address Format (LCAF) Authors : Dino Farinacci Dave Meyer Job Snijders Filename : draft-ietf-lisp-lcaf-05.txt Pages : 35 Date : 2014-05-06 Abstract: This draft defines a canonical address format encoding used in LISP control messages and in the encoding of lookup keys for the LISP Mapping Database System. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-lisp-lcaf/ There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-lisp-lcaf-05 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=draft-ietf-lisp-lcaf-05 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri May 9 08:54:05 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51F881A0059 for ; Fri, 9 May 2014 08:54:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.502 X-Spam-Level: X-Spam-Status: No, score=-0.502 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1H6yLLlJl6iy for ; Fri, 9 May 2014 08:54:01 -0700 (PDT) Received: from mailc2.tigertech.net (mailc2.tigertech.net [208.80.4.156]) by ietfa.amsl.com (Postfix) with ESMTP id DA6AC1A02E8 for ; Fri, 9 May 2014 08:54:01 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mailc2.tigertech.net (Postfix) with ESMTP id 4A8131C2655B for ; Fri, 9 May 2014 08:53:57 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at c2.tigertech.net Received: from Joels-MacBook-Pro.local (unknown [190.112.55.105]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mailc2.tigertech.net (Postfix) with ESMTPSA id F09B91C26556 for ; Fri, 9 May 2014 08:53:56 -0700 (PDT) Message-ID: <536CFA13.4010102@joelhalpern.com> Date: Fri, 09 May 2014 11:53:55 -0400 From: "Joel M. Halpern" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.5.0 MIME-Version: 1.0 To: "lisp@ietf.org" Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/8WrDuVgrvk5iTU0a-rdsh_w83-E Subject: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 May 2014 15:54:03 -0000 Sorry for the delay getting this out. This email starts a new (and hopefully final) last call on draft-ietf-lisp-threats, version 9: http://datatracker.ietf.org/doc/draft-ietf-lisp-threats/ The last call will end in two weeks, close of business 23-May-2014. Thank you, Joel From nobody Mon May 12 10:11:45 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ADD951A073E for ; Mon, 12 May 2014 10:11:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MUSMA9D-fFb2 for ; Mon, 12 May 2014 10:11:34 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1blp0190.outbound.protection.outlook.com [207.46.163.190]) by ietfa.amsl.com (Postfix) with ESMTP id C22501A072A for ; Mon, 12 May 2014 10:11:33 -0700 (PDT) Received: from CO2PR05MB634.namprd05.prod.outlook.com (10.141.199.17) by CO2PR05MB747.namprd05.prod.outlook.com (10.141.227.147) with Microsoft SMTP Server (TLS) id 15.0.929.12; Mon, 12 May 2014 17:11:26 +0000 Received: from CO2PR05MB636.namprd05.prod.outlook.com (10.141.199.24) by CO2PR05MB634.namprd05.prod.outlook.com (10.141.199.17) with Microsoft SMTP Server (TLS) id 15.0.929.12; Mon, 12 May 2014 17:11:24 +0000 Received: from CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) by CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) with mapi id 15.00.0929.001; Mon, 12 May 2014 17:11:23 +0000 From: Ross Callon To: "Joel M. Halpern" , "lisp@ietf.org" Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58M9eFhkxJvMEaw1MEc+Ryfdps9FMJA Date: Mon, 12 May 2014 17:11:23 +0000 Message-ID: <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> References: <536CFA13.4010102@joelhalpern.com> In-Reply-To: <536CFA13.4010102@joelhalpern.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.14] x-forefront-prvs: 0209425D0A x-forefront-antispam-report: SFV:NSPM; SFS:(10009001)(6009001)(428001)(13464003)(189002)(199002)(377454003)(164054003)(51444003)(77982001)(31966008)(66066001)(4396001)(46102001)(54356999)(87936001)(76576001)(74662001)(2656002)(79102001)(85852003)(92566001)(99286001)(33646001)(86362001)(83072002)(76176999)(50986999)(15202345003)(74502001)(15975445006)(81342001)(80022001)(77096999)(83322001)(20776003)(551544002)(19580395003)(19580405001)(81542001)(99396002)(74316001)(76482001)(101416001)(24736002); DIR:OUT; SFP:1101; SCL:1; SRVR:CO2PR05MB634; H:CO2PR05MB636.namprd05.prod.outlook.com; FPR:EE5FF1D9.A7FA138E.B9F7318B.4AE4CB11.20843; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/inGOlVWADvdXzUhydlp-9N0nF20 Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 May 2014 17:11:42 -0000 Thanks Joel; I think that draft-ietf-lisp-threats-09.txt is a start towards a threats do= cument, but that it has serious omissions and needs more work before being = progressed. Here are some specific comments:=20 Section 2 (On-path Attackers), first paragraph:=20 On-path attackers are attackers that are able to capture and modify all the packets exchanged between an Ingress Tunnel Router (ITR) and an Egress Tunnel Router (ETR). To cope with such an attacker, cryptographic techniques such as those used by IPSec ([RFC4301]) are required. As with IP, LISP relies on higher layer cryptography to secure packet payloads from on path attacks, so this document does not consider on-path attackers. To me an on-path attacker is one which is on the data path. Such an attacke= r might attack the contents of the data packet. In this case the paragraph = seems mostly correct to me: You encrypt the contents if you don't want some= one on the path to the destination to look at the contents. However, as is = discussed later in the document, LISP allows systems which are not in the n= ormal physical path, through a gleaning attack, to inject themselves into t= he data path. This could be applied to allow attacker's systems to inject t= hemselves into the path of the key management protocol. This implies that a= legitimate user could get keys supplied by an attacker, just as easily as = it could get keys supplied by a legitimate Internet site. If you are propos= ing that end to end encryption is the solution to on path attackers then yo= u need to understand the implications of LISP on the operation of the proto= col needed for key management to support end to end encryption.=20 Also, you should mention in this section that a gleaning attack would allow= at least in the short term for an attacker to become temporarily on-path e= ven if they are not on what should be the normal path to the destination.=20 An on-path attacker might choose to only change something about the LISP ha= ndling details, such as exploding the map cache or redirecting a user to a = different site. Some of this is mentioned later in the document. One thing = that is not mentioned: Suppose that the encapsulated packet is encrypted. T= he on-path attacker could however see the LISP header, and thus could chang= e the nonce, or add a nonce, or reply to the nonce, change versioning infor= mation,... Are you proposing that the LISP header be encrypted also? If so= , where is this specified and what does it do to forwarding performance in = the xTR?=20 Section 4.3.1, second paragraph, third sentence:=20 This is not different from today's Internet where a spoofing off-path attacker may inject data packets in any flow. In terms of injecting traffic that the end system receives and acts upon, I= believe that this sentence is entirely true. However, in terms of the effe= ct on the router's control plane, and particularly the operation of xTR's, = this sentence is not true. Today there is very little that a spoofing attac= ker that is outside of a particular service provider can do to exercise the= control plane of that provider's routers. This is important and intentiona= l (see DOS discussion below).=20 Minor nit, next sentence: A non-spoofing off-path attacker (NSA)... Given recent events, I think that "NSA" is an unfortunate acronym to use he= re. How about NSOA?=20 Section 4.3.1.1 (Gleaning Attacks), last paragraph: By itself, an attack made solely using gleaning cannot last long, however it should be noted that with current network capacities, a large amount of packets might be exchanged during even a small fraction of time. The amount of damage that might be caused by this may depend upon what happ= ens to be exchanged in that "short amount of time". For example, the initia= l handshake between sites (at the application layer) could include sign in = information (account names and passwords), on the basis that this is the so= rt of information that needs to be exchanged at the beginning of, for examp= le, financial transactions. My understanding is that for Internet commerce,= it is normal for users to be redirected to a different site to enter credi= t card information. This appears to constitute a "new session" (or at least= may be to an entirely different location) and therefore the entire credit = card exchange could occur in a small period of time. I think it would be wo= rth mentioning here that the sensitivity of the information that could be e= xchanged during this "short amount of time" is not known, and could potenti= ally be serious.=20 Also, depending upon how long xTR's are willing to store gleaned informatio= n (before the map request comes back), the time that a user is misdirected = due to a gleaning attack might be extended by coordinating a DDOS attack wi= th the gleaning attack. For example, an attacker may send packets to a very= large number of sites, with a source EID which is from a major stock broke= r or bank and an RLOC from the attacker's captive servers. The many sites g= lean the EID to RLOC mapping from the arriving packets. Each pretty much si= multaneously initiates an EID lookup (to verify the EID to RLOC mapping). T= his creates a DOS attack on the control plane of the mapping function suppo= rting that stock broker or bank. This implies that the responses are going = to be delayed (and could be greatly delayed), which allows the incorrect ma= ppings to last longer than they otherwise would. This allows any systems th= at actually happen to be trying to connect to that stock or banking site to= be redirected to the attacker's site. The attacker then becomes a man in t= he middle and can for example can obtain the password and account informati= on for users. =20 Last paragraph of section 4.3.2.2:=20 If the size of the Map-Request message is larger than the size of the smallest LISP-encapsulated packet that could trigger such a message, this could lead to amplification attacks (see Section 4.4.1) so that more bandwidth is consumed on the target than the bandwidth necessary at the attacker side. The size of the packet is not the only issue. If the amount of processing r= equired to send a map-request and deal with the reply is greater than the a= mount of processing that is required to send a packet that triggers such a = request, then this could also result in an amplification attack. In princip= le it would seem that sending out a large number of packets to trigger such= a request would be relatively straightforward (for example the attacker mi= ght be sending out many packets only incrementing the EID in order to attac= k the ITR that will need to generate many map requests). We may note that f= or many systems, particularly very high speed routers (which might exist fo= r example as PE routers connecting very large enterprise customers), the co= ntrol plane may be several orders of magnitude slower than the data plane, = so that an attack that requires response from the router's control plane wo= uld be much more serious than an attack of the same size that can be handle= d in the data plane. I will say more about this in my comments below regard= ing DOS attacks.=20 Section 4.3.2.3, third paragraph (right after the bullets):=20 The first type of packet should not cause any major problem to ITRs. As the reachability test uses a 24 bits nonce, it is unlikely that an off-path attacker could send a single packet that causes an ITR to believe that the ETR it is testing is reachable while in reality it is not reachable. To increase the success likelihood of such attack, the attacker should create a massive amount of packets carrying all possible nonce values. However, this could be a problem if there are on-path attackers, since they= will see the nonce. They could insert nonce's where none are present, requ= iring a response from the ETR. Given that the control plane of very high sp= eed PE routers may be much slower than the data plane, this could cause a r= elatively moderate data stream that the data plane or the PE could easily h= andle to turn into a control plane attack that the control plane of a PE ro= uter could not handle. Also, the on-path attacker could see the nonce's and= respond "correctly" (or in a way that the ITR that sent the nonce *thinks*= is correct), thereby "verifying" connectivity when none is present. You di= smissed on-path attacks earlier in the document on the basis that the user = data could be encrypted, but these are examples of on-path attacks that wou= ld be on the LISP header and operation, and not on the user data.=20 Section 5.2 (Denial of Service): You need to mention here the relative difference in speed between the data = plane and the control plane of high speed routers. For example, there are p= lenty of examples currently widely deployed of routers which can handle a f= ew terabits of data in the data plane. These routers might typically have g= igabit Ethernet links to the control processor, but I doubt that any of the= m could handle Map-Requests coming in at line rate at a gigabit. Thus the r= atio between the speed of the control plane the speed of the data plane is = significantly greater than 1000. I understand that many PE routers have slo= wer data planes (and the CE "wireless router" that sits in each of our home= s is of course a lot slower than this), but large data centers or large ent= erprise sites could very well be connected to their service provider via a = few very high speed PE routers. Therefore an attack that would be trivial t= o handle in the data plane (say, a few gigabits) could overwhelm the contro= l plane.=20 Gleaning allows incoming packets to create map requests, which allows a dat= a plane attack to turn into a control plane attack. Given the difference in= speeds between the data plane and the control plane, this makes it much ea= sier to create an effective DOS attack.=20 Section 8 (Security Considerations).=20 I am pleased that you removed the sentence from section 1 of the previous (= -08) draft that read: "As a result of the performed analysis, the document= discusses the severity of the threats and proposes recommendations to reac= h the same level of security in LISP than in Internet today (e.g., without = LISP)". This sentence was not actually correct. However, in looking through= the document and in thinking about the implications (see the rest of this = email) it is quite clear that the security of an Internet using LISP would = be significantly less than the current Internet (at least if you assume tha= t there is *any* security at all in the current Internet). I am thinking th= at there should be a sentence at the end of section 8 to the effect that "A= t the current time it appears that LISP would have significant security imp= lications if deployed on an Internet-wide scale". Finally, two items left out: I don't see any discussion on the effect of LISP on firewalls. I am assumin= g that pretty much all currently deployed firewalls are not able to look pa= st a LISP header to inspect the contents of packets. At a minimum, this wou= ld seem to imply that LISP will need to be deployed toward the Internet cor= e from the current firewalls, so that the firewalls can be looking at norma= l (unchanged) IP packets. There is another issue which might belong in the section on privacy: In the= Internet today if you want to attack a network with prefix aa.bb/16, and y= ou see this advertisement in the BGP routes, you can pick a random address = and send a packet and see if anything happens. You get little feedback. Wit= h LISP you can send a map request to a random address in the block and get = back a map reply. This gives you an RLOC which is in general the actual IP = address of a real PE or CE router. Of course you can repeat this across the= entire /16, or even the Internet (given sufficient time and traffic), and = get something close to a complete list of LISP xTRs. This implies that if s= ervice providers implement LISP on PE routers, then they will be exposing t= he identity of their PE routers to worldwide inspection. Given the number o= f PE routers in the world (obviously much larger than the number of service= providers, and given PA address aggregation probably larger than the numbe= r of routes that show up in the BGP routing table) we should expect that th= ere are lots of PE routers that have not been carefully secured, and exposi= ng their existence to open worldwide easy discovery would likely open the d= oor to a number of attacks that involve compromise of PE routers. Of course= if LISP is deployed on CE routers then their RLOC would similarly be expos= ed.=20 Thanks, Ross -----Original Message----- From: lisp [mailto:lisp-bounces@ietf.org] On Behalf Of Joel M. Halpern Sent: Friday, May 09, 2014 11:54 AM To: lisp@ietf.org Subject: [lisp] Restarting last call on LISP threats Sorry for the delay getting this out. This email starts a new (and hopefully final) last call on=20 draft-ietf-lisp-threats, version 9: http://datatracker.ietf.org/doc/draft-ietf-lisp-threats/ The last call will end in two weeks, close of business 23-May-2014. Thank you, Joel _______________________________________________ lisp mailing list lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp From nobody Tue May 13 00:48:01 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 52A461A0851 for ; Tue, 13 May 2014 00:47:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.7 X-Spam-Level: X-Spam-Status: No, score=-1.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, MIME_8BIT_HEADER=0.3, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6GC-qdEOD9-r for ; Tue, 13 May 2014 00:47:58 -0700 (PDT) Received: from mail-we0-x22a.google.com (mail-we0-x22a.google.com [IPv6:2a00:1450:400c:c03::22a]) by ietfa.amsl.com (Postfix) with ESMTP id CDAF11A084A for ; Tue, 13 May 2014 00:47:57 -0700 (PDT) Received: by mail-we0-f170.google.com with SMTP id u57so8028575wes.1 for ; Tue, 13 May 2014 00:47:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=pY62u+dtq4pzYJuMHvLJ0bwoIKl3I15wka/nieleV2M=; b=yhAvi8uocqd/8AR0DBfGc0MwE2YlSmnMtFMMdy8jUA2lTLuwVhwBSFZi3nPmZtjY83 6pS9vLZc5sqJO5pQYGys/GiAcf+nya/Zsd5Mbq/iD+cx4YUZCTbXrFDJHkD6tdUWgUgB 1cJHdk+aHE4c0kTH/6TNKWKexrU9r3e6RO4VeBLY6U6sj5JOQ9davQxeaSguK6jSw+r3 0Lviz/Nv63MurkWsk84gnc91cnJurtg/QNSdyFM6D84vEUwlgDR36aFEndFxITCW2h18 BjBJEez3Pf4+LcGvkkQCzwVcHyQMMiPwxfk89dVo3tGt89ExaAxl2mQV+SYYwgjgBJQj TOPQ== MIME-Version: 1.0 X-Received: by 10.194.48.100 with SMTP id k4mr6396084wjn.49.1399967271189; Tue, 13 May 2014 00:47:51 -0700 (PDT) Received: by 10.216.210.6 with HTTP; Tue, 13 May 2014 00:47:51 -0700 (PDT) In-Reply-To: <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> Date: Tue, 13 May 2014 09:47:51 +0200 Message-ID: From: =?UTF-8?Q?Roger_J=C3=B8rgensen?= To: Ross Callon Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/u41zvtAcpjnm23QVBnSjbCYp4t0 Cc: "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 May 2014 07:47:59 -0000 Hi Ross, See inline, On Mon, May 12, 2014 at 7:11 PM, Ross Callon wrote: > Thanks Joel; > > I think that draft-ietf-lisp-threats-09.txt is a start towards a threats = document, but that it has serious omissions and needs more work before bein= g progressed. Here are some specific comments: > > > Section 2 (On-path Attackers), first paragraph: > > On-path attackers are attackers that are able to capture and modify > all the packets exchanged between an Ingress Tunnel Router (ITR) and > an Egress Tunnel Router (ETR). To cope with such an attacker, > cryptographic techniques such as those used by IPSec ([RFC4301]) are > required. As with IP, LISP relies on higher layer cryptography to > secure packet payloads from on path attacks, so this document does > not consider on-path attackers. > > To me an on-path attacker is one which is on the data path. Such an attac= ker might attack the contents of the data packet. In this case the paragrap= h seems mostly correct to me: You encrypt the contents if you don't want so= meone on the path to the destination to look at the contents. However, as i= s discussed later in the document, LISP allows systems which are not in the= normal physical path, through a gleaning attack, to inject themselves into= the data path. This could be applied to allow attacker's systems to inject= themselves into the path of the key management protocol. This implies that= a legitimate user could get keys supplied by an attacker, just as easily a= s it could get keys supplied by a legitimate Internet site. If you are prop= osing that end to end encryption is the solution to on path attackers then = you need to understand the implications of LISP on the operation of the pro= tocol needed for key management to support end to end encryption. There exist two draft that are relevant to what you address. You have https://datatracker.ietf.org/doc/draft-farinacci-lisp-crypto/ where the payload of a LISP encapsulated packet are encrypted. None of the keys for encrypting/decrypting are stored in the mapping system but is calculated by the xTR's involved. Then you have https://datatracker.ietf.org/doc/draft-ietf-lisp-sec/ that attempts to secure the xTR to xTR relationship. --=20 Roger Jorgensen | ROJO9-RIPE rogerj@gmail.com | - IPv6 is The Key! http://www.jorgensen.no | roger@jorgensen.no From nobody Tue May 13 09:31:41 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3930B1A011B for ; Tue, 13 May 2014 09:31:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.601 X-Spam-Level: X-Spam-Status: No, score=-1.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1KOdeY4yb44W for ; Tue, 13 May 2014 09:31:37 -0700 (PDT) Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2on0095.outbound.protection.outlook.com [65.55.169.95]) by ietfa.amsl.com (Postfix) with ESMTP id D3AFC1A0117 for ; Tue, 13 May 2014 09:31:36 -0700 (PDT) Received: from CO2PR05MB636.namprd05.prod.outlook.com (10.141.199.24) by CO2PR05MB634.namprd05.prod.outlook.com (10.141.199.17) with Microsoft SMTP Server (TLS) id 15.0.944.11; Tue, 13 May 2014 16:31:22 +0000 Received: from CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) by CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) with mapi id 15.00.0929.001; Tue, 13 May 2014 16:31:21 +0000 From: Ross Callon To: =?utf-8?B?Um9nZXIgSsO4cmdlbnNlbg==?= Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58M9eFhkxJvMEaw1MEc+Ryfdps9FMJAgAETSICAAIz2sA== Date: Tue, 13 May 2014 16:31:20 +0000 Message-ID: References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.17] x-forefront-prvs: 0210479ED8 x-forefront-antispam-report: SFV:NSPM; SFS:(10009001)(6009001)(428001)(189002)(199002)(51704005)(13464003)(24454002)(377454003)(87936001)(15975445006)(99396002)(46102001)(15202345003)(2656002)(20776003)(19580405001)(99286001)(21056001)(83322001)(19580395003)(101416001)(80022001)(86362001)(66066001)(77096999)(16601075003)(85852003)(54356999)(33646001)(4396001)(76482001)(81342001)(79102001)(81542001)(83072002)(74502001)(1411001)(77982001)(76176999)(74316001)(50986999)(74662001)(76576001)(24736002); DIR:OUT; SFP:1101; SCL:1; SRVR:CO2PR05MB634; H:CO2PR05MB636.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rcallon@juniper.net; Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/N9Bba4eXuBEhf5OMkZULEy3AokE Cc: "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 May 2014 16:31:39 -0000 SSBkb24ndCB0aGluayB0aGF0IHRoZSB0d28gZHJhZnRzIHRoYXQgeW91IHJlZmVyZW5jZSBzb2x2 ZSB0aGUgcHJvYmxlbSB0aGF0IEkgYW0gY29uY2VybmVkIGFib3V0ICh0aGV5IGFkZHJlc3MgYW5k IG1heSBzb2x2ZSBvdGhlciBwcm9ibGVtcywgb2YgY291cnNlKS4gDQoNCkZvciBleGFtcGxlLCBs b29raW5nIGF0IGRyYWZ0LWlldGYtbGlzcC1zZWMtMDYsIGl0IHNheXM6DQoNCiAgIFRoaXMgbWVt byBzcGVjaWZpZXMgTElTUC1TRUMsIGEgc2V0IG9mIHNlY3VyaXR5IG1lY2hhbmlzbXMgdGhhdA0K ICAgcHJvdmlkZXMgb3JpZ2luIGF1dGhlbnRpY2F0aW9uLCBpbnRlZ3JpdHkgYW5kIGFudGktcmVw bGF5IHByb3RlY3Rpb24NCiAgIHRvIExJU1AncyBFSUQtdG8tUkxPQyBtYXBwaW5nIGRhdGEgY29u dmV5ZWQgdmlhIG1hcHBpbmcgbG9va3VwDQogICBwcm9jZXNzLiAgTElTUC1TRUMgYWxzbyBlbmFi bGVzIHZlcmlmaWNhdGlvbiBvZiBhdXRob3JpemF0aW9uIG9uIEVJRC0NCiAgIHByZWZpeCBjbGFp bXMgaW4gTWFwLVJlcGx5IG1lc3NhZ2VzLg0KDQpUaHVzIGlmIHdlIGFzc3VtZSB0aGF0IGRyYWZ0 LWlldGYtbGlzcC1zZWMtMDYgd29ya3MsIHRoZW4gd2hhdCB3ZSBoZWFyIGJhY2sgZnJvbSB0aGUg bWFwcGluZyBzeXN0ZW0gc2hvdWxkIGJlIGNvcnJlY3QgKG9yIHNob3VsZCBiZSBlcXVhbGx5IHJl bGlhYmxlIHRvIHdoYXQgd2UgaGVhciBiYWNrIGZyb20gdGhlIEROUyBzeXN0ZW0gdG9kYXksIGFu ZCB3ZSBkbyB0b2RheSByZWx5IG9uIEROUyB3aGVuIHdlIGFyZSBjb250YWN0aW5nIG91ciBiYW5r IG9yIGJyb2tlcmFnZSBzZXJ2aWNlIHRvIGNvbmR1Y3QgZmluYW5jaWFsIHRyYW5zYWN0aW9ucyku IA0KDQpXaGF0IEkgYW0gY29uY2VybmVkIGFib3V0IGlzIHRoYXQgKmJlZm9yZSogd2UgaGVhciBi YWNrIGZyb20gdGhlIG1hcHBpbmcgc3lzdGVtLCB3ZSBhcmUgYmVsaWV2aW5nIHdoYXQgd2UgaGF2 ZSBnbGVhbmVkLCBhbmQgdGhpcyBtYXkgY2F1c2UgdXMgdG8gYmUgdGFsa2luZyB0byB0aGUgd3Jv bmcgc3lzdGVtLiBXZSBtaWdodCBiZSBjb25kdWN0aW5nIGtleSBuZWdvdGlhdGlvbiB3aXRoIHRo ZSB3cm9uZyBzeXN0ZW0ganVzdCBhcyBlYXNpbHkgYXMgd2UgY291bGQgYmUgZXhjaGFuZ2luZyBi YW5raW5nIG9yIGJyb2tlcmFnZSBpbmZvcm1hdGlvbiB3aXRoIHRoZSB3cm9uZyBzeXN0ZW0uIA0K DQpSb3NzICANCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IFJvZ2VyIErDuHJn ZW5zZW4gW21haWx0bzpyb2dlcmpAZ21haWwuY29tXSANClNlbnQ6IFR1ZXNkYXksIE1heSAxMywg MjAxNCAzOjQ4IEFNDQpUbzogUm9zcyBDYWxsb24NCkNjOiBsaXNwQGlldGYub3JnDQpTdWJqZWN0 OiBSZTogW2xpc3BdIFJlc3RhcnRpbmcgbGFzdCBjYWxsIG9uIExJU1AgdGhyZWF0cw0KDQpIaSBS b3NzLA0KDQpTZWUgaW5saW5lLA0KDQoNCk9uIE1vbiwgTWF5IDEyLCAyMDE0IGF0IDc6MTEgUE0s IFJvc3MgQ2FsbG9uIDxyY2FsbG9uQGp1bmlwZXIubmV0PiB3cm90ZToNCj4gVGhhbmtzIEpvZWw7 DQo+DQo+IEkgdGhpbmsgdGhhdCBkcmFmdC1pZXRmLWxpc3AtdGhyZWF0cy0wOS50eHQgaXMgYSBz dGFydCB0b3dhcmRzIGEgdGhyZWF0cyBkb2N1bWVudCwgYnV0IHRoYXQgaXQgaGFzIHNlcmlvdXMg b21pc3Npb25zIGFuZCBuZWVkcyBtb3JlIHdvcmsgYmVmb3JlIGJlaW5nIHByb2dyZXNzZWQuIEhl cmUgYXJlIHNvbWUgc3BlY2lmaWMgY29tbWVudHM6DQo+DQo+DQo+IFNlY3Rpb24gMiAoT24tcGF0 aCBBdHRhY2tlcnMpLCBmaXJzdCBwYXJhZ3JhcGg6DQo+DQo+ICAgIE9uLXBhdGggYXR0YWNrZXJz IGFyZSBhdHRhY2tlcnMgdGhhdCBhcmUgYWJsZSB0byBjYXB0dXJlIGFuZCBtb2RpZnkNCj4gICAg YWxsIHRoZSBwYWNrZXRzIGV4Y2hhbmdlZCBiZXR3ZWVuIGFuIEluZ3Jlc3MgVHVubmVsIFJvdXRl ciAoSVRSKSBhbmQNCj4gICAgYW4gRWdyZXNzIFR1bm5lbCBSb3V0ZXIgKEVUUikuICBUbyBjb3Bl IHdpdGggc3VjaCBhbiBhdHRhY2tlciwNCj4gICAgY3J5cHRvZ3JhcGhpYyB0ZWNobmlxdWVzIHN1 Y2ggYXMgdGhvc2UgdXNlZCBieSBJUFNlYyAoW1JGQzQzMDFdKSBhcmUNCj4gICAgcmVxdWlyZWQu ICBBcyB3aXRoIElQLCBMSVNQIHJlbGllcyBvbiBoaWdoZXIgbGF5ZXIgY3J5cHRvZ3JhcGh5IHRv DQo+ICAgIHNlY3VyZSBwYWNrZXQgcGF5bG9hZHMgZnJvbSBvbiBwYXRoIGF0dGFja3MsIHNvIHRo aXMgZG9jdW1lbnQgZG9lcw0KPiAgICBub3QgY29uc2lkZXIgb24tcGF0aCBhdHRhY2tlcnMuDQo+ DQo+IFRvIG1lIGFuIG9uLXBhdGggYXR0YWNrZXIgaXMgb25lIHdoaWNoIGlzIG9uIHRoZSBkYXRh IHBhdGguIFN1Y2ggYW4gYXR0YWNrZXIgbWlnaHQgYXR0YWNrIHRoZSBjb250ZW50cyBvZiB0aGUg ZGF0YSBwYWNrZXQuIEluIHRoaXMgY2FzZSB0aGUgcGFyYWdyYXBoIHNlZW1zIG1vc3RseSBjb3Jy ZWN0IHRvIG1lOiBZb3UgZW5jcnlwdCB0aGUgY29udGVudHMgaWYgeW91IGRvbid0IHdhbnQgc29t ZW9uZSBvbiB0aGUgcGF0aCB0byB0aGUgZGVzdGluYXRpb24gdG8gbG9vayBhdCB0aGUgY29udGVu dHMuIEhvd2V2ZXIsIGFzIGlzIGRpc2N1c3NlZCBsYXRlciBpbiB0aGUgZG9jdW1lbnQsIExJU1Ag YWxsb3dzIHN5c3RlbXMgd2hpY2ggYXJlIG5vdCBpbiB0aGUgbm9ybWFsIHBoeXNpY2FsIHBhdGgs IHRocm91Z2ggYSBnbGVhbmluZyBhdHRhY2ssIHRvIGluamVjdCB0aGVtc2VsdmVzIGludG8gdGhl IGRhdGEgcGF0aC4gVGhpcyBjb3VsZCBiZSBhcHBsaWVkIHRvIGFsbG93IGF0dGFja2VyJ3Mgc3lz dGVtcyB0byBpbmplY3QgdGhlbXNlbHZlcyBpbnRvIHRoZSBwYXRoIG9mIHRoZSBrZXkgbWFuYWdl bWVudCBwcm90b2NvbC4gVGhpcyBpbXBsaWVzIHRoYXQgYSBsZWdpdGltYXRlIHVzZXIgY291bGQg Z2V0IGtleXMgc3VwcGxpZWQgYnkgYW4gYXR0YWNrZXIsIGp1c3QgYXMgZWFzaWx5IGFzIGl0IGNv dWxkIGdldCBrZXlzIHN1cHBsaWVkIGJ5IGEgbGVnaXRpbWF0ZSBJbnRlcm5ldCBzaXRlLiBJZiB5 b3UgYXJlIHByb3Bvc2luZyB0aGF0IGVuZCB0byBlbmQgZW5jcnlwdGlvbiBpcyB0aGUgc29sdXRp b24gdG8gb24gcGF0aCBhdHRhY2tlcnMgdGhlbiB5b3UgbmVlZCB0byB1bmRlcnN0YW5kIHRoZSBp bXBsaWNhdGlvbnMgb2YgTElTUCBvbiB0aGUgb3BlcmF0aW9uIG9mIHRoZSBwcm90b2NvbCBuZWVk ZWQgZm9yIGtleSBtYW5hZ2VtZW50IHRvIHN1cHBvcnQgZW5kIHRvIGVuZCBlbmNyeXB0aW9uLg0K DQoNCg0KVGhlcmUgZXhpc3QgdHdvIGRyYWZ0IHRoYXQgYXJlIHJlbGV2YW50IHRvIHdoYXQgeW91 IGFkZHJlc3MuDQoNCllvdSBoYXZlIGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2Ry YWZ0LWZhcmluYWNjaS1saXNwLWNyeXB0by8NCndoZXJlIHRoZSBwYXlsb2FkIG9mIGEgTElTUCBl bmNhcHN1bGF0ZWQgcGFja2V0IGFyZSBlbmNyeXB0ZWQuIE5vbmUgb2YNCnRoZSBrZXlzIGZvciBl bmNyeXB0aW5nL2RlY3J5cHRpbmcgYXJlIHN0b3JlZCBpbiB0aGUgbWFwcGluZyBzeXN0ZW0NCmJ1 dCBpcyBjYWxjdWxhdGVkIGJ5IHRoZSB4VFIncyBpbnZvbHZlZC4NClRoZW4geW91IGhhdmUgaHR0 cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtaWV0Zi1saXNwLXNlYy8NCnRoYXQg YXR0ZW1wdHMgdG8gc2VjdXJlIHRoZSB4VFIgdG8geFRSIHJlbGF0aW9uc2hpcC4NCg0KDQoNCi0t IA0KDQpSb2dlciBKb3JnZW5zZW4gICAgICAgICAgIHwgUk9KTzktUklQRQ0Kcm9nZXJqQGdtYWls LmNvbSAgICAgICAgICB8IC0gSVB2NiBpcyBUaGUgS2V5IQ0KaHR0cDovL3d3dy5qb3JnZW5zZW4u bm8gICB8IHJvZ2VyQGpvcmdlbnNlbi5ubw0K From nobody Tue May 13 10:22:08 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C50081A018D for ; Tue, 13 May 2014 10:22:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.602 X-Spam-Level: X-Spam-Status: No, score=-101.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DOkT0NfAw2KL for ; Tue, 13 May 2014 10:22:02 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0139.outbound.protection.outlook.com [207.46.163.139]) by ietfa.amsl.com (Postfix) with ESMTP id A191F1A017E for ; Tue, 13 May 2014 10:21:59 -0700 (PDT) Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by DM2PR05MB639.namprd05.prod.outlook.com (10.141.157.150) with Microsoft SMTP Server (TLS) id 15.0.934.12; Tue, 13 May 2014 17:21:51 +0000 Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.25]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.25]) with mapi id 15.00.0939.000; Tue, 13 May 2014 17:21:51 +0000 From: Ronald Bonica To: =?iso-8859-1?Q?Roger_J=F8rgensen?= , Ross Callon Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8A== Date: Tue, 13 May 2014 17:21:50 +0000 Message-ID: <7aa1593be30a47d3a0edfc806d64796e@CO1PR05MB442.namprd05.prod.outlook.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.14] x-forefront-prvs: 0210479ED8 x-forefront-antispam-report: SFV:NSPM; SFS:(10009001)(6009001)(428001)(51704005)(199002)(189002)(46102001)(74502001)(33646001)(4396001)(76482001)(15975445006)(1941001)(83072002)(21056001)(86362001)(76576001)(85852003)(101416001)(77982001)(81542001)(2656002)(74316001)(99286001)(81342001)(83322001)(50986999)(74662001)(76176999)(20776003)(79102001)(87936001)(54356999)(66066001)(19580395003)(99396002)(80022001)(24736002); DIR:OUT; SFP:1101; SCL:1; SRVR:DM2PR05MB639; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/br2Mxd-7sgr2qSOs6G58_s6_kR8 Cc: "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 May 2014 17:22:05 -0000 Hi Roger, Can this draft stand on its own, without integrating content from the docum= ents that you reference? = Ron >=20 > There exist two draft that are relevant to what you address. >=20 > You have https://datatracker.ietf.org/doc/draft-farinacci-lisp-crypto/ > where the payload of a LISP encapsulated packet are encrypted. None of th= e > keys for encrypting/decrypting are stored in the mapping system but is > calculated by the xTR's involved. > Then you have https://datatracker.ietf.org/doc/draft-ietf-lisp-sec/ > that attempts to secure the xTR to xTR relationship. >=20 >=20 >=20 > -- >=20 From nobody Tue May 13 10:31:59 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53CEB1A012F for ; Tue, 13 May 2014 10:31:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.302 X-Spam-Level: X-Spam-Status: No, score=-102.302 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AjcdKHgdGwxd for ; Tue, 13 May 2014 10:31:55 -0700 (PDT) Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2lp0238.outbound.protection.outlook.com [207.46.163.238]) by ietfa.amsl.com (Postfix) with ESMTP id 5B1391A0116 for ; Tue, 13 May 2014 10:31:55 -0700 (PDT) Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by BLUPR05MB626.namprd05.prod.outlook.com (10.141.204.143) with Microsoft SMTP Server (TLS) id 15.0.934.12; Tue, 13 May 2014 17:31:47 +0000 Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.25]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.25]) with mapi id 15.00.0939.000; Tue, 13 May 2014 17:31:46 +0000 From: Ronald Bonica To: =?iso-8859-1?Q?Roger_J=F8rgensen?= , Ross Callon Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQ Date: Tue, 13 May 2014 17:31:45 +0000 Message-ID: <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.14] x-forefront-prvs: 0210479ED8 x-forefront-antispam-report: SFV:NSPM; SFS:(10009001)(6009001)(428001)(51704005)(189002)(199002)(377454003)(13464003)(83072002)(85852003)(1941001)(79102001)(86362001)(19580405001)(83322001)(76576001)(19580395003)(20776003)(15975445006)(46102001)(101416001)(76482001)(77982001)(87936001)(2656002)(66066001)(80022001)(54356999)(4396001)(99396002)(99286001)(33646001)(74502001)(74662001)(76176999)(50986999)(81342001)(21056001)(74316001)(81542001)(24736002); DIR:OUT; SFP:1101; SCL:1; SRVR:BLUPR05MB626; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/GfGwE92o6a7C8rClqvvgVK2fg3U Cc: "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 May 2014 17:31:57 -0000 Hi Roger, Or asked more explicitly, can the level of security claimed by the threats = document be achieved without implementing the protocol extensions described= in lisp-sec and lisp-crypto? Ron > -----Original Message----- > From: Ronald Bonica > Sent: Tuesday, May 13, 2014 1:22 PM > To: 'Roger J=F8rgensen'; Ross Callon > Cc: lisp@ietf.org > Subject: RE: [lisp] Restarting last call on LISP threats >=20 > Hi Roger, >=20 > Can this draft stand on its own, without integrating content from the > documents that you reference? >=20 > = Ron >=20 > > > > There exist two draft that are relevant to what you address. > > > > You have https://datatracker.ietf.org/doc/draft-farinacci-lisp-crypto/ > > where the payload of a LISP encapsulated packet are encrypted. None of > > the keys for encrypting/decrypting are stored in the mapping system > > but is calculated by the xTR's involved. > > Then you have https://datatracker.ietf.org/doc/draft-ietf-lisp-sec/ > > that attempts to secure the xTR to xTR relationship. > > > > > > > > -- > > From nobody Tue May 13 10:47:15 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDD1A1A0126 for ; Tue, 13 May 2014 10:47:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ylhM_v-Y_pbc for ; Tue, 13 May 2014 10:47:10 -0700 (PDT) Received: from mail-pa0-x22f.google.com (mail-pa0-x22f.google.com [IPv6:2607:f8b0:400e:c03::22f]) by ietfa.amsl.com (Postfix) with ESMTP id 4C5451A011A for ; Tue, 13 May 2014 10:47:10 -0700 (PDT) Received: by mail-pa0-f47.google.com with SMTP id lf10so544967pab.6 for ; Tue, 13 May 2014 10:47:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=WdQMh1NXogSb9KI/7ovTY6eY8VIpQfYQcEURVJ2Qzj4=; b=kv3mY3CeEhkkoE8myOT1RvClASlUOPrjkthVTTIMbxJ+FWRIDC4Uolzd+3tZEXraZ4 k8Nv11g+ffaKBxTCqTIf1ppbmoKFzWo8Y8ACkN5eFKlx4Ppu2k8skCqHhh41Vg8ZhKWk 4yHMCUeLCyFmukN9p0HJXIXnk9HJOu//SqkzjcXB4ypNf/zPHYYSyZ3XKJcF1bmwPXpG h+bcK5/mIaGH8BRUG0+Y8Yo8pdZtL1a4atYnGqgyXM0qzDsAFSrSafwXbhp5lPNzxwa6 FW4EX48muJIJGHwaVZcrCLdb7RYj5g77xQN68mkPJTXPG3MrkKDD/dupbZHLtpIUOxi2 Lmwg== X-Received: by 10.68.114.227 with SMTP id jj3mr4422042pbb.61.1400003224046; Tue, 13 May 2014 10:47:04 -0700 (PDT) Received: from [192.168.1.79] (173-8-188-29-SFBA.hfc.comcastbusiness.net. [173.8.188.29]) by mx.google.com with ESMTPSA id vf9sm29277974pbc.94.2014.05.13.10.47.01 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 13 May 2014 10:47:01 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\)) From: Dino Farinacci In-Reply-To: Date: Tue, 13 May 2014 10:47:00 -0700 Content-Transfer-Encoding: quoted-printable Message-Id: <11916828-2EE5-4B46-B6F3-994CD9DBA42D@gmail.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> To: Ross Callon X-Mailer: Apple Mail (2.1874) Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/iIn2081YB6QAxF6gSILjsLYodO4 Cc: Roger Jorgensen , "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 May 2014 17:47:12 -0000 > Thus if we assume that draft-ietf-lisp-sec-06 works, then what we hear = back from the mapping system should be correct (or should be equally = reliable to what we hear back from the DNS system today, and we do today = rely on DNS when we are contacting our bank or brokerage service to = conduct financial transactions).=20 The main LISP spec (RFC6830) indicates if you want to trust the mapping = system you can use the gleaned information as soon as you receive it. = And if you don't trust the mapping system, you can send a "verifying = Map-Request" to the mapping system which results in a signed Map-Reply = returned ala draft-ietf-lisp-sec-06. Dino From nobody Tue May 13 14:56:41 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53E971A01E2 for ; Tue, 13 May 2014 14:56:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.602 X-Spam-Level: X-Spam-Status: No, score=-1.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gRDZf4sPT7PY for ; Tue, 13 May 2014 14:56:39 -0700 (PDT) Received: from mailc2.tigertech.net (mailc2.tigertech.net [208.80.4.156]) by ietfa.amsl.com (Postfix) with ESMTP id 684C71A01A5 for ; Tue, 13 May 2014 14:56:39 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mailc2.tigertech.net (Postfix) with ESMTP id 4F4C0381DA1; Tue, 13 May 2014 14:56:33 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at c2.tigertech.net Received: from Joels-MacBook-Pro.local (pool-70-106-135-10.clppva.east.verizon.net [70.106.135.10]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mailc2.tigertech.net (Postfix) with ESMTPSA id 6CC63381D30; Tue, 13 May 2014 14:56:32 -0700 (PDT) Message-ID: <5372950E.3080704@joelhalpern.com> Date: Tue, 13 May 2014 17:56:30 -0400 From: "Joel M. Halpern" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.5.0 MIME-Version: 1.0 To: Ronald Bonica , =?ISO-8859-1?Q?Roger_J=F8rgens?= =?ISO-8859-1?Q?en?= , Ross Callon References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> In-Reply-To: <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/OkwIDIiit9P7WjWXQ62b-rXpBu8 Cc: "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 May 2014 21:56:40 -0000 Ron, I am having trouble with the question. The threats document describes the threats as they exist today, without the adoption of either document that Roger pointed to. Thus, I do not see any dependence. If there is a threat that is not well described in the base spec or this document, then we should add it. We should add it even if there are proposals to remediate it. But if there is a clear proposal of a missing threat, I missed it. Yours, Joel On 5/13/14, 1:31 PM, Ronald Bonica wrote: > Hi Roger, > > Or asked more explicitly, can the level of security claimed by the threats document be achieved without implementing the protocol extensions described in lisp-sec and lisp-crypto? > > Ron > > >> -----Original Message----- >> From: Ronald Bonica >> Sent: Tuesday, May 13, 2014 1:22 PM >> To: 'Roger Jørgensen'; Ross Callon >> Cc: lisp@ietf.org >> Subject: RE: [lisp] Restarting last call on LISP threats >> >> Hi Roger, >> >> Can this draft stand on its own, without integrating content from the >> documents that you reference? >> >> Ron >> >>> >>> There exist two draft that are relevant to what you address. >>> >>> You have https://datatracker.ietf.org/doc/draft-farinacci-lisp-crypto/ >>> where the payload of a LISP encapsulated packet are encrypted. None of >>> the keys for encrypting/decrypting are stored in the mapping system >>> but is calculated by the xTR's involved. >>> Then you have https://datatracker.ietf.org/doc/draft-ietf-lisp-sec/ >>> that attempts to secure the xTR to xTR relationship. >>> >>> >>> >>> -- >>> > > _______________________________________________ > lisp mailing list > lisp@ietf.org > https://www.ietf.org/mailman/listinfo/lisp > From nobody Wed May 14 00:59:03 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B50C01A0275 for ; Wed, 14 May 2014 00:59:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.7 X-Spam-Level: X-Spam-Status: No, score=-1.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, MIME_8BIT_HEADER=0.3, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KV8VYuAdcwyt for ; Wed, 14 May 2014 00:58:59 -0700 (PDT) Received: from mail-wi0-x230.google.com (mail-wi0-x230.google.com [IPv6:2a00:1450:400c:c05::230]) by ietfa.amsl.com (Postfix) with ESMTP id 05A711A0235 for ; Wed, 14 May 2014 00:58:58 -0700 (PDT) Received: by mail-wi0-f176.google.com with SMTP id n15so7548605wiw.3 for ; Wed, 14 May 2014 00:58:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=vBNPgxaw3kM4o50HTf90Tff1yNnX3y+Ia0lELKSfX/k=; b=oauMopm38rNSio4PG/FOY5F+XazgPH6/MGqzONAxthgxGK2D4ywymfvS+dEKVnlt4W Spb5jkqGtx95xJ0k1HKL+fldu/38VFDsqpxiQd1vf8APR5Yx5FsL7yNarWQUBKkJSnLP 30LTvWs0WpvWyQmqzXT+/AnRJWTRGsYUKt5pHdgk4uq9X3PnvelK3+QO2cw9Wv5zcPgy EDBwQ2xsGJWQgWgoeOEfIfJIZ8xUiXO6GlKBOAjd6uATCO84wQmjtQEmuOi+CNJF5Qjg iWTiMwH2+cV6AISC/DHlCzempXTzlDwPe/URcXus5dCYonl7yCoclpm4AA4/XAc3yMv9 HvSw== MIME-Version: 1.0 X-Received: by 10.180.80.232 with SMTP id u8mr24865181wix.13.1400054331912; Wed, 14 May 2014 00:58:51 -0700 (PDT) Received: by 10.216.210.6 with HTTP; Wed, 14 May 2014 00:58:51 -0700 (PDT) In-Reply-To: <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> Date: Wed, 14 May 2014 09:58:51 +0200 Message-ID: From: =?UTF-8?Q?Roger_J=C3=B8rgensen?= To: Ronald Bonica Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/6W-UYVuCO95NnUv8xGS9mCNwUqE Cc: "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 May 2014 07:59:00 -0000 On Tue, May 13, 2014 at 7:31 PM, Ronald Bonica wrote: > Hi Roger, > > Or asked more explicitly, can the level of security claimed by the threat= s document be achieved without implementing the protocol extensions describ= ed in lisp-sec and lisp-crypto? I've been pondering on what to answer you since yesterday but think the reply from Joel cover it well. However as an addon to Joel and partly reply to your question, see more inline. On Tue, May 13, 2014 at 11:56 PM, Joel M. Halpern wro= te: > Ron, I am having trouble with the question. > > The threats document describes the threats as they exist today, without t= he > adoption of either document that Roger pointed to. Thus, I do not see an= y > dependence. > > If there is a threat that is not well described in the base spec or this > document, then we should add it. We should add it even if there are > proposals to remediate it. But if there is a clear proposal of a missing > threat, I missed it. Your question made me question the purpose of the LISP threats draft - should it cover potential problem with RFC6830 and include pointers to other work that cover them? That will include we'll get a document that will be updated over time and is that a good thing? The other way to look at LISP threats document is to have it as a "review" of RFC6830, point out weaknesses and discuss them but with no references to other documents. It will be a upstream document that we can refer to from like the two draft I mention. I don't think LISP threat should point to the two draft I mention, but both drafts should have a reference to LISP threat since this will be create a more stable threat document. Then Dino mention: On Tue, May 13, 2014 at 7:47 PM, Dino Farinacci wrote= : > The main LISP spec (RFC6830) indicates if you want to trust the mapping s= ystem you can use the gleaned information as soon as you receive it. And if= you don't trust the mapping system, you can send a "verifying Map-Request"= to the mapping system which results in a signed Map-Reply returned ala dra= ft-ietf-lisp-sec-06. Is this covered in the document? I didn't see it but it's still early here.= .. --=20 Roger Jorgensen | ROJO9-RIPE rogerj@gmail.com | - IPv6 is The Key! http://www.jorgensen.no | roger@jorgensen.no From nobody Thu May 15 11:15:56 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 582581A02E6 for ; Thu, 15 May 2014 11:15:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.602 X-Spam-Level: X-Spam-Status: No, score=-101.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8S9wKaA7zNzb for ; Thu, 15 May 2014 11:15:50 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0142.outbound.protection.outlook.com [207.46.163.142]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6B3AE1A0317 for ; Thu, 15 May 2014 11:15:49 -0700 (PDT) Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by BLUPR05MB628.namprd05.prod.outlook.com (10.141.204.156) with Microsoft SMTP Server (TLS) id 15.0.939.12; Thu, 15 May 2014 18:15:40 +0000 Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) with mapi id 15.00.0944.000; Thu, 15 May 2014 18:15:39 +0000 From: Ronald Bonica To: "Joel M. Halpern" , =?iso-8859-1?Q?Roger_J=F8rgensen?= , Ross Callon Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgABKWQCAAuX8QA== Date: Thu, 15 May 2014 18:15:39 +0000 Message-ID: <172db6c3e26f458ebd70141bed7b7a8b@CO1PR05MB442.namprd05.prod.outlook.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <5372950E.3080704@joelhalpern.com> In-Reply-To: <5372950E.3080704@joelhalpern.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.14] x-forefront-prvs: 0212BDE3BE x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(377454003)(479174003)(24454002)(189002)(13464003)(199002)(51704005)(19580395003)(19580405001)(83322001)(1941001)(31966008)(74502001)(76576001)(66066001)(21056001)(79102001)(20776003)(64706001)(80022001)(15975445006)(4396001)(81342001)(81542001)(33646001)(74662001)(99396002)(85852003)(83072002)(46102001)(76482001)(77982001)(50986999)(54356999)(76176999)(99286001)(86362001)(2656002)(87936001)(101416001)(92566001)(74316001)(561944003)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:BLUPR05MB628; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/gFivDkL2sZ17Ov9MlTURFtrq0K4 Cc: "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 May 2014 18:15:52 -0000 Joel, The threats document should not depend on lisp-sec or lisp-crypto. However,= Roger's response did rely on those documents (see his response, below).=20 So, we are left to explore whether something was omitted from the threats d= ocument. Standby for my response to Roger. Ron > -----Original Message----- > From: Joel M. Halpern [mailto:jmh@joelhalpern.com] > Sent: Tuesday, May 13, 2014 5:57 PM > To: Ronald Bonica; Roger J=F8rgensen; Ross Callon > Cc: lisp@ietf.org > Subject: Re: [lisp] Restarting last call on LISP threats >=20 > Ron, I am having trouble with the question. >=20 > The threats document describes the threats as they exist today, without t= he > adoption of either document that Roger pointed to. Thus, I do not see an= y > dependence. >=20 > If there is a threat that is not well described in the base spec or this > document, then we should add it. We should add it even if there are > proposals to remediate it. But if there is a clear proposal of a missing= threat, I > missed it. >=20 > Yours, > Joel >=20 > On 5/13/14, 1:31 PM, Ronald Bonica wrote: > > Hi Roger, > > > > Or asked more explicitly, can the level of security claimed by the thre= ats > document be achieved without implementing the protocol extensions > described in lisp-sec and lisp-crypto? > > > > Ron > > > > > >> -----Original Message----- > >> From: Ronald Bonica > >> Sent: Tuesday, May 13, 2014 1:22 PM > >> To: 'Roger J=F8rgensen'; Ross Callon > >> Cc: lisp@ietf.org > >> Subject: RE: [lisp] Restarting last call on LISP threats > >> > >> Hi Roger, > >> > >> Can this draft stand on its own, without integrating content from the > >> documents that you reference? > >> > >> > >> Ron > >> > >>> > >>> There exist two draft that are relevant to what you address. > >>> > >>> You have > >>> https://datatracker.ietf.org/doc/draft-farinacci-lisp-crypto/ > >>> where the payload of a LISP encapsulated packet are encrypted. None > >>> of the keys for encrypting/decrypting are stored in the mapping > >>> system but is calculated by the xTR's involved. > >>> Then you have https://datatracker.ietf.org/doc/draft-ietf-lisp-sec/ > >>> that attempts to secure the xTR to xTR relationship. > >>> > >>> > >>> > >>> -- > >>> > > > > _______________________________________________ > > lisp mailing list > > lisp@ietf.org > > https://www.ietf.org/mailman/listinfo/lisp > > From nobody Thu May 15 11:29:43 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E98791A0317 for ; Thu, 15 May 2014 11:29:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.602 X-Spam-Level: X-Spam-Status: No, score=-1.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tcpkSamiVPhP for ; Thu, 15 May 2014 11:29:38 -0700 (PDT) Received: from mailc2.tigertech.net (mailc2.tigertech.net [208.80.4.156]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C5C5D1A030B for ; Thu, 15 May 2014 11:29:38 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mailc2.tigertech.net (Postfix) with ESMTP id D7671480781; Thu, 15 May 2014 11:29:31 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at c2.tigertech.net Received: from Joels-MacBook-Pro.local (pool-70-106-135-10.clppva.east.verizon.net [70.106.135.10]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mailc2.tigertech.net (Postfix) with ESMTPSA id C5A8C480780; Thu, 15 May 2014 11:29:30 -0700 (PDT) Message-ID: <53750788.900@joelhalpern.com> Date: Thu, 15 May 2014 14:29:28 -0400 From: Joel Halpern Direct User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.5.0 MIME-Version: 1.0 To: Ronald Bonica , "Joel M. Halpern" , =?ISO-8859-1?Q?Roger_J=F8rgensen?= , Ross Callon References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <5372950E.3080704@joelhalpern.com> <172db6c3e26f458ebd70141bed7b7a8b@CO1PR05MB442.namprd05.prod.outlook.com> In-Reply-To: <172db6c3e26f458ebd70141bed7b7a8b@CO1PR05MB442.namprd05.prod.outlook.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/YfkZ9XxKlLO-5VJXncJTBCxbbkM Cc: "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 May 2014 18:29:40 -0000 The threats document does not specify how to resolve the threats. It identifies problems. In this particular case, it already identifies the problem that Ross raised. Quite clearly. There is no dependence on the documents Roger pointed to. They are ways of remediating the threat. Yours, Joel On 5/15/14, 2:15 PM, Ronald Bonica wrote: > Joel, > > The threats document should not depend on lisp-sec or lisp-crypto. > However, Roger's response did rely on those documents (see his > response, below). > > So, we are left to explore whether something was omitted from the > threats document. Standby for my response to Roger. > > Ron > > > >> -----Original Message----- From: Joel M. Halpern >> [mailto:jmh@joelhalpern.com] Sent: Tuesday, May 13, 2014 5:57 PM >> To: Ronald Bonica; Roger Jørgensen; Ross Callon Cc: lisp@ietf.org >> Subject: Re: [lisp] Restarting last call on LISP threats >> >> Ron, I am having trouble with the question. >> >> The threats document describes the threats as they exist today, >> without the adoption of either document that Roger pointed to. >> Thus, I do not see any dependence. >> >> If there is a threat that is not well described in the base spec or >> this document, then we should add it. We should add it even if >> there are proposals to remediate it. But if there is a clear >> proposal of a missing threat, I missed it. >> >> Yours, Joel >> >> On 5/13/14, 1:31 PM, Ronald Bonica wrote: >>> Hi Roger, >>> >>> Or asked more explicitly, can the level of security claimed by >>> the threats >> document be achieved without implementing the protocol extensions >> described in lisp-sec and lisp-crypto? >>> >>> Ron >>> >>> >>>> -----Original Message----- From: Ronald Bonica Sent: Tuesday, >>>> May 13, 2014 1:22 PM To: 'Roger Jørgensen'; Ross Callon Cc: >>>> lisp@ietf.org Subject: RE: [lisp] Restarting last call on LISP >>>> threats >>>> >>>> Hi Roger, >>>> >>>> Can this draft stand on its own, without integrating content >>>> from the documents that you reference? >>>> >>>> >>>> Ron >>>> >>>>> >>>>> There exist two draft that are relevant to what you address. >>>>> >>>>> You have >>>>> https://datatracker.ietf.org/doc/draft-farinacci-lisp-crypto/ >>>>> >>>>> where the payload of a LISP encapsulated packet are encrypted. None >>>>> of the keys for encrypting/decrypting are stored in the >>>>> mapping system but is calculated by the xTR's involved. Then >>>>> you have >>>>> https://datatracker.ietf.org/doc/draft-ietf-lisp-sec/ that >>>>> attempts to secure the xTR to xTR relationship. >>>>> >>>>> >>>>> >>>>> -- >>>>> >>> >>> _______________________________________________ lisp mailing >>> list lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp >>> From nobody Thu May 15 11:42:34 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C3DE31A009C for ; Thu, 15 May 2014 11:42:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.602 X-Spam-Level: X-Spam-Status: No, score=-101.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mxmCT2AS-xPc for ; Thu, 15 May 2014 11:42:30 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0144.outbound.protection.outlook.com [207.46.163.144]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8ED201A0053 for ; Thu, 15 May 2014 11:42:30 -0700 (PDT) Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO2PR05MB634.namprd05.prod.outlook.com (10.141.199.17) with Microsoft SMTP Server (TLS) id 15.0.944.11; Thu, 15 May 2014 18:42:21 +0000 Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) with mapi id 15.00.0944.000; Thu, 15 May 2014 18:42:21 +0000 From: Ronald Bonica To: Joel Halpern Direct , "Joel M. Halpern" , =?iso-8859-1?Q?Roger_J=F8rgensen?= , Ross Callon Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgABKWQCAAuX8QIAABNUAgAADScA= Date: Thu, 15 May 2014 18:42:20 +0000 Message-ID: <11cf5759b99444189c9ac1621f3a8def@CO1PR05MB442.namprd05.prod.outlook.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <5372950E.3080704@joelhalpern.com> <172db6c3e26f458ebd70141bed7b7a8b@CO1PR05MB442.namprd05.prod.outlook.com> <53750788.900@joelhalpern.com> In-Reply-To: <53750788.900@joelhalpern.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.14] x-forefront-prvs: 0212BDE3BE x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(51704005)(199002)(189002)(377454003)(479174003)(24454002)(13464003)(33646001)(83322001)(87936001)(2656002)(19580395003)(21056001)(19580405001)(76176999)(92566001)(101416001)(86362001)(50986999)(54356999)(99286001)(99396002)(64706001)(20776003)(561944003)(79102001)(66066001)(80022001)(74662001)(31966008)(74502001)(76576001)(15975445006)(76482001)(46102001)(74316001)(77982001)(1941001)(4396001)(81342001)(81542001)(85852003)(83072002)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO2PR05MB634; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/Au6qMe81qRiLKrKtDOugsTD-N_g Cc: "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 May 2014 18:42:32 -0000 Joel, Please standby for my response to Roger. Ron > -----Original Message----- > From: Joel Halpern Direct [mailto:jmh.direct@joelhalpern.com] > Sent: Thursday, May 15, 2014 2:29 PM > To: Ronald Bonica; Joel M. Halpern; Roger J=F8rgensen; Ross Callon > Cc: lisp@ietf.org > Subject: Re: [lisp] Restarting last call on LISP threats >=20 > The threats document does not specify how to resolve the threats. It > identifies problems. In this particular case, it already identifies the = problem > that Ross raised. Quite clearly. >=20 > There is no dependence on the documents Roger pointed to. They are ways > of remediating the threat. >=20 > Yours, > Joel >=20 > On 5/15/14, 2:15 PM, Ronald Bonica wrote: > > Joel, > > > > The threats document should not depend on lisp-sec or lisp-crypto. > > However, Roger's response did rely on those documents (see his > > response, below). > > > > So, we are left to explore whether something was omitted from the > > threats document. Standby for my response to Roger. > > > > Ron > > > > > > > >> -----Original Message----- From: Joel M. Halpern > >> [mailto:jmh@joelhalpern.com] Sent: Tuesday, May 13, 2014 5:57 PM > >> To: Ronald Bonica; Roger J=F8rgensen; Ross Callon Cc: lisp@ietf.org > >> Subject: Re: [lisp] Restarting last call on LISP threats > >> > >> Ron, I am having trouble with the question. > >> > >> The threats document describes the threats as they exist today, > >> without the adoption of either document that Roger pointed to. > >> Thus, I do not see any dependence. > >> > >> If there is a threat that is not well described in the base spec or > >> this document, then we should add it. We should add it even if there > >> are proposals to remediate it. But if there is a clear proposal of a > >> missing threat, I missed it. > >> > >> Yours, Joel > >> > >> On 5/13/14, 1:31 PM, Ronald Bonica wrote: > >>> Hi Roger, > >>> > >>> Or asked more explicitly, can the level of security claimed by the > >>> threats > >> document be achieved without implementing the protocol extensions > >> described in lisp-sec and lisp-crypto? > >>> > >>> Ron > >>> > >>> > >>>> -----Original Message----- From: Ronald Bonica Sent: Tuesday, May > >>>> 13, 2014 1:22 PM To: 'Roger J=F8rgensen'; Ross Callon Cc: > >>>> lisp@ietf.org Subject: RE: [lisp] Restarting last call on LISP > >>>> threats > >>>> > >>>> Hi Roger, > >>>> > >>>> Can this draft stand on its own, without integrating content from > >>>> the documents that you reference? > >>>> > >>>> > >>>> Ron > >>>> > >>>>> > >>>>> There exist two draft that are relevant to what you address. > >>>>> > >>>>> You have > >>>>> https://datatracker.ietf.org/doc/draft-farinacci-lisp-crypto/ > >>>>> > >>>>> > where the payload of a LISP encapsulated packet are encrypted. None > >>>>> of the keys for encrypting/decrypting are stored in the mapping > >>>>> system but is calculated by the xTR's involved. Then you have > >>>>> https://datatracker.ietf.org/doc/draft-ietf-lisp-sec/ that > >>>>> attempts to secure the xTR to xTR relationship. > >>>>> > >>>>> > >>>>> > >>>>> -- > >>>>> > >>> > >>> _______________________________________________ lisp > mailing list > >>> lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp > >>> From nobody Thu May 15 12:47:18 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C16931A013C for ; Thu, 15 May 2014 12:47:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.902 X-Spam-Level: X-Spam-Status: No, score=-101.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ez5tp6F3BzsW for ; Thu, 15 May 2014 12:47:15 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1blp0187.outbound.protection.outlook.com [207.46.163.187]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 60AB71A016C for ; Thu, 15 May 2014 12:47:15 -0700 (PDT) Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO2PR05MB635.namprd05.prod.outlook.com (10.141.199.22) with Microsoft SMTP Server (TLS) id 15.0.944.11; Thu, 15 May 2014 19:47:05 +0000 Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) with mapi id 15.00.0944.000; Thu, 15 May 2014 19:47:05 +0000 From: Ronald Bonica To: Dino Farinacci , Ross Callon Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJJCAIAAFSQAgANEi6A= Date: Thu, 15 May 2014 19:47:04 +0000 Message-ID: References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <11916828-2EE5-4B46-B6F3-994CD9DBA42D@gmail.com> In-Reply-To: <11916828-2EE5-4B46-B6F3-994CD9DBA42D@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.14] x-forefront-prvs: 0212BDE3BE x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(377454003)(199002)(189002)(13464003)(51704005)(74316001)(66066001)(74662001)(80022001)(74502001)(31966008)(15975445006)(83072002)(2656002)(79102001)(101416001)(87936001)(85852003)(64706001)(76576001)(20776003)(54356999)(4396001)(99286001)(1941001)(99396002)(76482001)(83322001)(19580405001)(33646001)(77982001)(19580395003)(92566001)(21056001)(76176999)(50986999)(86362001)(46102001)(81542001)(81342001)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO2PR05MB635; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/bZj86_R5o8LhY3Hbo9O8v-8VzIY Cc: Roger Jorgensen , "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 May 2014 19:47:17 -0000 Dino, Don't you always have to trust the mapping system?=20 Did you mean to say, "If you want to trust the originator of the gleaned in= formation, ...." ? = Ron = =20 > -----Original Message----- > From: lisp [mailto:lisp-bounces@ietf.org] On Behalf Of Dino Farinacci > Sent: Tuesday, May 13, 2014 1:47 PM > To: Ross Callon > Cc: Roger Jorgensen; lisp@ietf.org > Subject: Re: [lisp] Restarting last call on LISP threats >=20 > > Thus if we assume that draft-ietf-lisp-sec-06 works, then what we hear > back from the mapping system should be correct (or should be equally > reliable to what we hear back from the DNS system today, and we do today > rely on DNS when we are contacting our bank or brokerage service to > conduct financial transactions). >=20 > The main LISP spec (RFC6830) indicates if you want to trust the mapping > system you can use the gleaned information as soon as you receive it. And= if > you don't trust the mapping system, you can send a "verifying Map-Request= " > to the mapping system which results in a signed Map-Reply returned ala > draft-ietf-lisp-sec-06. >=20 > Dino >=20 > _______________________________________________ > lisp mailing list > lisp@ietf.org > https://www.ietf.org/mailman/listinfo/lisp From nobody Thu May 15 12:55:55 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D61BF1A02E6 for ; Thu, 15 May 2014 12:55:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LKEiSGdXG-10 for ; Thu, 15 May 2014 12:55:52 -0700 (PDT) Received: from mail-yk0-x22d.google.com (mail-yk0-x22d.google.com [IPv6:2607:f8b0:4002:c07::22d]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ACD991A0146 for ; Thu, 15 May 2014 12:55:52 -0700 (PDT) Received: by mail-yk0-f173.google.com with SMTP id 142so1308077ykq.4 for ; Thu, 15 May 2014 12:55:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=P8hM/rbW1a2GJ6GYy9XuTKgymyt7qduiLWq472C2mzg=; b=z3XeGikAFuPk0zIONqg/Ca8yKsyOXdgytCBq+kD+7OM9FDoQHARLamg7E5DOlQI/YL ROHRT055XV2Rl9IrMXXMow6tLm9ZD9Y2qVV+PlA/NnvrRztK7hNefz3DOP+sW7ZX+d9Q /3FroG+D1GeOqoKqYF8W4oUsjVfyXjn8xk/YBg3d7xVyWFSSEjWHSxkwDYrTtjeM0Eh0 6SjN6T9ihyUt9uhvhbVob2V23ATLLd2pAcjXWVp/wOyH+zD64ihyc1Kw0/mSJb6MlKj8 h91VsWoDvB5ex3A1kM/kxMYytHfpMV/xeaVe4F8iUsvo2D0rMCm6EQfsHo6vcrbBcSa0 7vVg== X-Received: by 10.236.180.169 with SMTP id j29mr18216994yhm.47.1400183745257; Thu, 15 May 2014 12:55:45 -0700 (PDT) Received: from [10.241.191.15] ([166.205.49.172]) by mx.google.com with ESMTPSA id y3sm8657888yhd.28.2014.05.15.12.55.44 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Thu, 15 May 2014 12:55:44 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Dino Farinacci X-Mailer: iPhone Mail (11D167) In-Reply-To: Date: Thu, 15 May 2014 15:55:44 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <37C7547E-E012-41F3-B49D-994397310FB4@gmail.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <11916828-2EE5-4B46-B6F3-994CD9DBA42D@gmail.com> To: Ronald Bonica Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/knt1uyh5xZJhHSnBW19jFLolH64 Cc: Roger Jorgensen , "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 May 2014 19:55:54 -0000 >=20 > Don't you always have to trust the mapping system?=20 Yes.=20 > Did you mean to say, "If you want to trust the originator of the gleaned i= nformation, ...." ? Yes. But what I wrote was not incorrect. If the gleaned information comes fr= om an xTR from the site, you are not trusting the mapping system at this poi= nt.=20 Dino= From nobody Thu May 15 14:02:40 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0FEDA1A0124 for ; Thu, 15 May 2014 14:02:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.602 X-Spam-Level: X-Spam-Status: No, score=-101.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iiZlwOFxI2S8 for ; Thu, 15 May 2014 14:02:37 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0142.outbound.protection.outlook.com [207.46.163.142]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A23801A011B for ; Thu, 15 May 2014 14:02:36 -0700 (PDT) Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO2PR05MB636.namprd05.prod.outlook.com (10.141.199.24) with Microsoft SMTP Server (TLS) id 15.0.944.11; Thu, 15 May 2014 21:02:28 +0000 Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) with mapi id 15.00.0944.000; Thu, 15 May 2014 21:02:27 +0000 From: Ronald Bonica To: =?utf-8?B?Um9nZXIgSsO4cmdlbnNlbg==?= Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEA== Date: Thu, 15 May 2014 21:02:26 +0000 Message-ID: <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.14] x-forefront-prvs: 0212BDE3BE x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(24454002)(189002)(199002)(13464003)(377454003)(51704005)(15975445006)(86362001)(66066001)(80022001)(74662001)(31966008)(83322001)(19580395003)(19580405001)(81342001)(561944003)(54356999)(50986999)(79102001)(81542001)(74502001)(15202345003)(76176999)(33646001)(16601075003)(99396002)(99286001)(4396001)(20776003)(64706001)(76576001)(74316001)(101416001)(77982001)(83072002)(76482001)(92566001)(85852003)(46102001)(21056001)(2656002)(87936001)(1411001)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO2PR05MB636; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/1GGr-UOj9tw6TopkErbZ03XswPY Cc: "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 May 2014 21:02:39 -0000 Um9nZXIsDQoNCkhhdmluZyBjb25zaWRlcmVkIHRoaXMsIGl0IGFwcGVhcnMgdGhhdCB0aGUgTElT UCBkYXRhIHBsYW5lIGNhbiBvcGVyYXRlIGluIHRydXN0ZWQgb3IgdW50cnVzdGVkIG1vZGUuIElu IHRoZSB0cnVzdGVkIG1vZGUsIHdoZW4gb25lIFhUUiByZWNlaXZlcyBhIGRhdGEtcGxhbmUgcGFj a2V0IGZyb20gYW5vdGhlciwgaXQgY2FuIHRydXN0IGNvbnRyb2wgcGxhbmUgaW5mb3JtYXRpb24g dGhhdCBpdCBtaWdodCBnbGVhbiBmcm9tIHRoZSBwYWNrZXQncyBvdXRlciBJUCBoZWFkZXIgYW5k IExJU1AgaGVhZGVyLiBTdWNoIHRydXN0IGlzIGJhc2VkIG9uIHRoZSBhc3N1bXB0aW9uIHRoYXQ6 DQoNCi0gdGhlIHNlbmRpbmcgWFRSIGlzIHdobyBpdCBjbGFpbXMgdG8gYmUNCi0gdGhlIHNlbmRp bmcgWFRSIGlzIG5vdCBpbnRlbnRpb25hbGx5IG9mZmVyaW5nIGJhZCBtYXBwaW5nIGluZm9ybWF0 aW9uIHRvIHRoZSByZWNlaXZpbmcgWFRSDQoNCkluIHRydXN0ZWQgbW9kZSwgdGhlIHJlY2Vpdmlu ZyBYVFIgY2FuIGdsZWFuIGNvbnRyb2wgaW5mb3JtYXRpb24gZnJvbSB0aGUgZGF0YSBwbGFuZS4g SG93ZXZlciwgaW4gdW50cnVzdGVkIG1vZGUsIHRoZSByZWNlaXZpbmcgWFRSIG11c3Qgbm90IGRv IHNvLiBBbHRlcm5hdGl2ZWx5LCBpdCBtdXN0IHNlbmQgYSB2ZXJpZnlpbmcgTUFQLVJFUVVFU1Qg dG8gdGhlIG1hcHBpbmcgc3lzdGVtLg0KDQpTbyBmYXIsIGFsbCBvZiB0aGlzIGlzIGNvdmVyZWQg bmljZWx5IGJldHdlZW4gUkZDIDY4MzAgYW5kIHRoZSBMSVNQIHRocmVhdHMgZG9jdW1lbnQuIEhv d2V2ZXIsIHdlIGhhdmUgeWV0IHRvIGV4cGxvcmUgdGhlIHRocmVhdHMgYXNzb2NpYXRlZCB3aXRo IHVuc2VjdXJlZCBtb2RlIG9wZXJhdGlvbiwgd2hlcmUgZ2xlYW5lZCBpbmZvcm1hdGlvbiBjYW5u b3QgYmUgdXNlZC4NCg0KRm9yIGV4YW1wbGUsIGFzc3VtZSB0aGF0IHR3byBYVFJzIGFuZCBhbiBh dHRhY2tlciBhcmUgY29ubmVjdGVkIHRvIHRoZSBnbG9iYWwgSW50ZXJuZXQuIFRoZSBhdHRhY2tl ciBpcyBuZWl0aGVyIGFuIFhUUiBub3IgY29udGFpbmVkIGJ5IGEgTElTUCBzaXRlLiBUaGUgYXR0 YWNrZXIgaXMgY2FwYWJsZSBvZiBzcG9vZmluZyBpdHMgc291cmNlcyBhZGRyZXNzLg0KDQpUaGUg YXR0YWNrZXIgY2FuIGxhdW5jaCBhIERvUyBhdHRhY2sgYWdhaW5zdCBhbiBYVFJzIGNvbnRyb2wg cGxhbiBieSBzZW5kaW5nIGEgYmFycmFnZSBvZiBjcmFmdGVkIHBhY2tldHMgdG8gdGhlIHZpY3Rp bSBYVFIuIEVhY2ggY3JhZnRlZCBwYWNrZXQgY2F1c2UgdGhlIHZpY3RpbSBYVFIgdG8gc2VuZCBh IHZlcmlmeWluZyBNQVAtUkVRVUVTVCB0byB0aGUgbWFwcGluZyBzeXN0ZW0uICBUaGUgYXR0YWNr IHN0cmVhbSBtYXkgYmUgc28gbGFyZ2UgdGhhdCBpdCBjYXVzZXMgdGhlIHZpY3RpbSBYVFIgdG8g ZXhjZWVkIHRoZSByYXRlIGxpbWl0IGZvciBNQVAtUkVRVUVTVCBtZXNzYWdlcy4gDQoNCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUm9uDQoNCg0KPiAt LS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiBSb2dlciBKw7hyZ2Vuc2VuIFttYWls dG86cm9nZXJqQGdtYWlsLmNvbV0NCj4gU2VudDogV2VkbmVzZGF5LCBNYXkgMTQsIDIwMTQgMzo1 OSBBTQ0KPiBUbzogUm9uYWxkIEJvbmljYQ0KPiBDYzogUm9zcyBDYWxsb247IGxpc3BAaWV0Zi5v cmcNCj4gU3ViamVjdDogUmU6IFtsaXNwXSBSZXN0YXJ0aW5nIGxhc3QgY2FsbCBvbiBMSVNQIHRo cmVhdHMNCj4gDQo+IE9uIFR1ZSwgTWF5IDEzLCAyMDE0IGF0IDc6MzEgUE0sIFJvbmFsZCBCb25p Y2EgPHJib25pY2FAanVuaXBlci5uZXQ+DQo+IHdyb3RlOg0KPiA+IEhpIFJvZ2VyLA0KPiA+DQo+ ID4gT3IgYXNrZWQgbW9yZSBleHBsaWNpdGx5LCBjYW4gdGhlIGxldmVsIG9mIHNlY3VyaXR5IGNs YWltZWQgYnkgdGhlIHRocmVhdHMNCj4gZG9jdW1lbnQgYmUgYWNoaWV2ZWQgd2l0aG91dCBpbXBs ZW1lbnRpbmcgdGhlIHByb3RvY29sIGV4dGVuc2lvbnMNCj4gZGVzY3JpYmVkIGluIGxpc3Atc2Vj IGFuZCBsaXNwLWNyeXB0bz8NCj4gDQo+IEkndmUgYmVlbiBwb25kZXJpbmcgb24gd2hhdCB0byBh bnN3ZXIgeW91IHNpbmNlIHllc3RlcmRheSBidXQgdGhpbmsgdGhlDQo+IHJlcGx5IGZyb20gSm9l bCBjb3ZlciBpdCB3ZWxsLiBIb3dldmVyIGFzIGFuIGFkZG9uIHRvIEpvZWwgYW5kIHBhcnRseSBy ZXBseSB0bw0KPiB5b3VyIHF1ZXN0aW9uLCBzZWUgbW9yZSBpbmxpbmUuDQo+IA0KPiANCj4gT24g VHVlLCBNYXkgMTMsIDIwMTQgYXQgMTE6NTYgUE0sIEpvZWwgTS4gSGFscGVybiA8am1oQGpvZWxo YWxwZXJuLmNvbT4NCj4gd3JvdGU6DQo+ID4gUm9uLCBJIGFtIGhhdmluZyB0cm91YmxlIHdpdGgg dGhlIHF1ZXN0aW9uLg0KPiA+DQo+ID4gVGhlIHRocmVhdHMgZG9jdW1lbnQgZGVzY3JpYmVzIHRo ZSB0aHJlYXRzIGFzIHRoZXkgZXhpc3QgdG9kYXksDQo+ID4gd2l0aG91dCB0aGUgYWRvcHRpb24g b2YgZWl0aGVyIGRvY3VtZW50IHRoYXQgUm9nZXIgcG9pbnRlZCB0by4gIFRodXMsDQo+ID4gSSBk byBub3Qgc2VlIGFueSBkZXBlbmRlbmNlLg0KPiA+DQo+ID4gSWYgdGhlcmUgaXMgYSB0aHJlYXQg dGhhdCBpcyBub3Qgd2VsbCBkZXNjcmliZWQgaW4gdGhlIGJhc2Ugc3BlYyBvcg0KPiA+IHRoaXMg ZG9jdW1lbnQsIHRoZW4gd2Ugc2hvdWxkIGFkZCBpdC4gIFdlIHNob3VsZCBhZGQgaXQgZXZlbiBp ZiB0aGVyZQ0KPiA+IGFyZSBwcm9wb3NhbHMgdG8gcmVtZWRpYXRlIGl0LiAgQnV0IGlmIHRoZXJl IGlzIGEgY2xlYXIgcHJvcG9zYWwgb2YgYQ0KPiA+IG1pc3NpbmcgdGhyZWF0LCBJIG1pc3NlZCBp dC4NCj4gDQo+IFlvdXIgcXVlc3Rpb24gbWFkZSBtZSBxdWVzdGlvbiB0aGUgcHVycG9zZSBvZiB0 aGUgTElTUCB0aHJlYXRzIGRyYWZ0IC0NCj4gc2hvdWxkIGl0IGNvdmVyIHBvdGVudGlhbCBwcm9i bGVtIHdpdGggUkZDNjgzMCBhbmQgaW5jbHVkZSBwb2ludGVycyB0byBvdGhlcg0KPiB3b3JrIHRo YXQgY292ZXIgdGhlbT8gVGhhdCB3aWxsIGluY2x1ZGUgd2UnbGwgZ2V0IGEgZG9jdW1lbnQgdGhh dCB3aWxsIGJlDQo+IHVwZGF0ZWQgb3ZlciB0aW1lIGFuZCBpcyB0aGF0IGEgZ29vZCB0aGluZz8N Cj4gDQo+IFRoZSBvdGhlciB3YXkgdG8gbG9vayBhdCBMSVNQIHRocmVhdHMgZG9jdW1lbnQgaXMg dG8gaGF2ZSBpdCBhcyBhICJyZXZpZXciIG9mDQo+IFJGQzY4MzAsIHBvaW50IG91dCB3ZWFrbmVz c2VzIGFuZCBkaXNjdXNzIHRoZW0gYnV0IHdpdGggbm8gcmVmZXJlbmNlcyB0bw0KPiBvdGhlciBk b2N1bWVudHMuIEl0IHdpbGwgYmUgYSB1cHN0cmVhbSBkb2N1bWVudCB0aGF0IHdlIGNhbiByZWZl ciB0byBmcm9tDQo+IGxpa2UgdGhlIHR3byBkcmFmdCBJIG1lbnRpb24uDQo+IA0KPiBJIGRvbid0 IHRoaW5rIExJU1AgdGhyZWF0IHNob3VsZCBwb2ludCB0byB0aGUgdHdvIGRyYWZ0IEkgbWVudGlv biwgYnV0IGJvdGgNCj4gZHJhZnRzIHNob3VsZCBoYXZlIGEgcmVmZXJlbmNlIHRvIExJU1AgdGhy ZWF0IHNpbmNlIHRoaXMgd2lsbCBiZSBjcmVhdGUgYSBtb3JlDQo+IHN0YWJsZSB0aHJlYXQgZG9j dW1lbnQuDQo+IA0KPiANCj4gDQo+IFRoZW4gRGlubyBtZW50aW9uOg0KPiANCj4gT24gVHVlLCBN YXkgMTMsIDIwMTQgYXQgNzo0NyBQTSwgRGlubyBGYXJpbmFjY2kgPGZhcmluYWNjaUBnbWFpbC5j b20+DQo+IHdyb3RlOg0KPiA8c25pcD4NCj4gPiBUaGUgbWFpbiBMSVNQIHNwZWMgKFJGQzY4MzAp IGluZGljYXRlcyBpZiB5b3Ugd2FudCB0byB0cnVzdCB0aGUgbWFwcGluZw0KPiBzeXN0ZW0geW91 IGNhbiB1c2UgdGhlIGdsZWFuZWQgaW5mb3JtYXRpb24gYXMgc29vbiBhcyB5b3UgcmVjZWl2ZSBp dC4gQW5kIGlmDQo+IHlvdSBkb24ndCB0cnVzdCB0aGUgbWFwcGluZyBzeXN0ZW0sIHlvdSBjYW4g c2VuZCBhICJ2ZXJpZnlpbmcgTWFwLVJlcXVlc3QiDQo+IHRvIHRoZSBtYXBwaW5nIHN5c3RlbSB3 aGljaCByZXN1bHRzIGluIGEgc2lnbmVkIE1hcC1SZXBseSByZXR1cm5lZCBhbGENCj4gZHJhZnQt aWV0Zi1saXNwLXNlYy0wNi4NCj4gDQo+IA0KPiBJcyB0aGlzIGNvdmVyZWQgaW4gdGhlIGRvY3Vt ZW50PyBJIGRpZG4ndCBzZWUgaXQgYnV0IGl0J3Mgc3RpbGwgZWFybHkgaGVyZS4uLg0KPiANCj4g DQo+IA0KPiAtLQ0KPiANCj4gUm9nZXIgSm9yZ2Vuc2VuICAgICAgICAgICB8IFJPSk85LVJJUEUN Cj4gcm9nZXJqQGdtYWlsLmNvbSAgICAgICAgICB8IC0gSVB2NiBpcyBUaGUgS2V5IQ0KPiBodHRw Oi8vd3d3LmpvcmdlbnNlbi5ubyAgIHwgcm9nZXJAam9yZ2Vuc2VuLm5vDQo= From nobody Thu May 15 14:39:50 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F11E61A02A2 for ; Thu, 15 May 2014 14:39:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.602 X-Spam-Level: X-Spam-Status: No, score=-1.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oaRZdyIk9FBb for ; Thu, 15 May 2014 14:39:46 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0145.outbound.protection.outlook.com [207.46.163.145]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C824E1A014B for ; Thu, 15 May 2014 14:39:45 -0700 (PDT) Received: from CO2PR05MB636.namprd05.prod.outlook.com (10.141.199.24) by BN1PR05MB437.namprd05.prod.outlook.com (10.141.58.11) with Microsoft SMTP Server (TLS) id 15.0.939.12; Thu, 15 May 2014 21:39:37 +0000 Received: from CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) by CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) with mapi id 15.00.0944.000; Thu, 15 May 2014 21:39:36 +0000 From: Ross Callon To: Joel Halpern Direct , Ronald Bonica , "Joel M. Halpern" , =?iso-8859-1?Q?Roger_J=F8rgensen?= Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58M9eFhkxJvMEaw1MEc+Ryfdps9MyiAgAD04oCAAJ/u8IAAAtXQgABKWQCAAub1gIAAA9wAgAA0wSA= Date: Thu, 15 May 2014 21:39:35 +0000 Message-ID: <0f6d1eca517e45f7ac5217f3ba1e8d80@CO2PR05MB636.namprd05.prod.outlook.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <5372950E.3080704@joelhalpern.com> <172db6c3e26f458ebd70141bed7b7a8b@CO1PR05MB442.namprd05.prod.outlook.com> <53750788.900@joelhalpern.com> In-Reply-To: <53750788.900@joelhalpern.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.11] x-forefront-prvs: 0212BDE3BE x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(51704005)(199002)(189002)(24454002)(13464003)(479174003)(377454003)(33646001)(561944003)(101416001)(81542001)(81342001)(4396001)(46102001)(76576001)(1941001)(76482001)(77982001)(85852003)(74316001)(83072002)(92566001)(86362001)(99396002)(19580395003)(87936001)(99286001)(2656002)(19580405001)(15975445006)(83322001)(80022001)(66066001)(20776003)(64706001)(74502001)(79102001)(50986999)(31966008)(76176999)(21056001)(74662001)(54356999)(77096999)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:BN1PR05MB437; H:CO2PR05MB636.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rcallon@juniper.net; Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/adGLqpPt4fO_2Za7aCVd7U73Hgw Cc: "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 May 2014 21:39:47 -0000 I raised a list of problems. They are not all already mentioned in the thre= ats document (eg, note the privacy issue at the end of my detailed email).= =20 Ross -----Original Message----- From: Joel Halpern Direct [mailto:jmh.direct@joelhalpern.com]=20 Sent: Thursday, May 15, 2014 2:29 PM To: Ronald Bonica; Joel M. Halpern; Roger J=F8rgensen; Ross Callon Cc: lisp@ietf.org Subject: Re: [lisp] Restarting last call on LISP threats The threats document does not specify how to resolve the threats. It identifies problems. In this particular case, it already identifies the problem that Ross raised. Quite clearly. There is no dependence on the documents Roger pointed to. They are ways=20 of remediating the threat. Yours, Joel On 5/15/14, 2:15 PM, Ronald Bonica wrote: > Joel, > > The threats document should not depend on lisp-sec or lisp-crypto. > However, Roger's response did rely on those documents (see his > response, below). > > So, we are left to explore whether something was omitted from the > threats document. Standby for my response to Roger. > > Ron > > > >> -----Original Message----- From: Joel M. Halpern >> [mailto:jmh@joelhalpern.com] Sent: Tuesday, May 13, 2014 5:57 PM >> To: Ronald Bonica; Roger J=F8rgensen; Ross Callon Cc: lisp@ietf.org >> Subject: Re: [lisp] Restarting last call on LISP threats >> >> Ron, I am having trouble with the question. >> >> The threats document describes the threats as they exist today, >> without the adoption of either document that Roger pointed to. >> Thus, I do not see any dependence. >> >> If there is a threat that is not well described in the base spec or >> this document, then we should add it. We should add it even if >> there are proposals to remediate it. But if there is a clear >> proposal of a missing threat, I missed it. >> >> Yours, Joel >> >> On 5/13/14, 1:31 PM, Ronald Bonica wrote: >>> Hi Roger, >>> >>> Or asked more explicitly, can the level of security claimed by >>> the threats >> document be achieved without implementing the protocol extensions >> described in lisp-sec and lisp-crypto? >>> >>> Ron >>> >>> >>>> -----Original Message----- From: Ronald Bonica Sent: Tuesday, >>>> May 13, 2014 1:22 PM To: 'Roger J=F8rgensen'; Ross Callon Cc: >>>> lisp@ietf.org Subject: RE: [lisp] Restarting last call on LISP >>>> threats >>>> >>>> Hi Roger, >>>> >>>> Can this draft stand on its own, without integrating content >>>> from the documents that you reference? >>>> >>>> >>>> Ron >>>> >>>>> >>>>> There exist two draft that are relevant to what you address. >>>>> >>>>> You have >>>>> https://datatracker.ietf.org/doc/draft-farinacci-lisp-crypto/ >>>>> >>>>> where the payload of a LISP encapsulated packet are encrypted. None >>>>> of the keys for encrypting/decrypting are stored in the >>>>> mapping system but is calculated by the xTR's involved. Then >>>>> you have >>>>> https://datatracker.ietf.org/doc/draft-ietf-lisp-sec/ that >>>>> attempts to secure the xTR to xTR relationship. >>>>> >>>>> >>>>> >>>>> -- >>>>> >>> >>> _______________________________________________ lisp mailing >>> list lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp >>> From nobody Thu May 15 14:42:34 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C6B41A0144 for ; Thu, 15 May 2014 14:42:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.602 X-Spam-Level: X-Spam-Status: No, score=-1.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j8pYmf81C9aG for ; Thu, 15 May 2014 14:42:29 -0700 (PDT) Received: from mailc2.tigertech.net (mailc2.tigertech.net [208.80.4.156]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 71F4A1A0138 for ; Thu, 15 May 2014 14:42:29 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mailc2.tigertech.net (Postfix) with ESMTP id 6B951481C8D; Thu, 15 May 2014 14:42:22 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at c2.tigertech.net Received: from Joels-MacBook-Pro.local (pool-70-106-135-10.clppva.east.verizon.net [70.106.135.10]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mailc2.tigertech.net (Postfix) with ESMTPSA id 27EA4481C92; Thu, 15 May 2014 14:42:21 -0700 (PDT) Message-ID: <537534BA.6020106@joelhalpern.com> Date: Thu, 15 May 2014 17:42:18 -0400 From: "Joel M. Halpern" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.5.0 MIME-Version: 1.0 To: Ross Callon , Joel Halpern Direct , Ronald Bonica , =?ISO-8859-1?Q?Roger_J=F8rgensen?= References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <5372950E.3080704@joelhalpern.com> <172db6c3e26f458ebd70141bed7b7a8b@CO1PR05MB442.namprd05.prod.outlook.com> <53750788.900@joelhalpern.com> <0f6d1eca517e45f7ac5217f3ba1e8d80@CO2PR05MB636.namprd05.prod.outlook.com> In-Reply-To: <0f6d1eca517e45f7ac5217f3ba1e8d80@CO2PR05MB636.namprd05.prod.outlook.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/XEDWjJrwHqQ1rr22n05kHN4pnoA Cc: "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 May 2014 21:42:30 -0000 I may have misread the discussion. I was commenting only on the one topic of gleaning. I was leaving it to the authors to respond to your other comments. Yours, Joel On 5/15/14, 5:39 PM, Ross Callon wrote: > I raised a list of problems. They are not all already mentioned in the threats document (eg, note the privacy issue at the end of my detailed email). > > Ross > > -----Original Message----- > From: Joel Halpern Direct [mailto:jmh.direct@joelhalpern.com] > Sent: Thursday, May 15, 2014 2:29 PM > To: Ronald Bonica; Joel M. Halpern; Roger Jørgensen; Ross Callon > Cc: lisp@ietf.org > Subject: Re: [lisp] Restarting last call on LISP threats > > The threats document does not specify how to resolve the threats. It > identifies problems. In this particular case, it already identifies the > problem that Ross raised. Quite clearly. > > There is no dependence on the documents Roger pointed to. They are ways > of remediating the threat. > > Yours, > Joel > > On 5/15/14, 2:15 PM, Ronald Bonica wrote: >> Joel, >> >> The threats document should not depend on lisp-sec or lisp-crypto. >> However, Roger's response did rely on those documents (see his >> response, below). >> >> So, we are left to explore whether something was omitted from the >> threats document. Standby for my response to Roger. >> >> Ron >> >> >> >>> -----Original Message----- From: Joel M. Halpern >>> [mailto:jmh@joelhalpern.com] Sent: Tuesday, May 13, 2014 5:57 PM >>> To: Ronald Bonica; Roger Jørgensen; Ross Callon Cc: lisp@ietf.org >>> Subject: Re: [lisp] Restarting last call on LISP threats >>> >>> Ron, I am having trouble with the question. >>> >>> The threats document describes the threats as they exist today, >>> without the adoption of either document that Roger pointed to. >>> Thus, I do not see any dependence. >>> >>> If there is a threat that is not well described in the base spec or >>> this document, then we should add it. We should add it even if >>> there are proposals to remediate it. But if there is a clear >>> proposal of a missing threat, I missed it. >>> >>> Yours, Joel >>> >>> On 5/13/14, 1:31 PM, Ronald Bonica wrote: >>>> Hi Roger, >>>> >>>> Or asked more explicitly, can the level of security claimed by >>>> the threats >>> document be achieved without implementing the protocol extensions >>> described in lisp-sec and lisp-crypto? >>>> >>>> Ron >>>> >>>> >>>>> -----Original Message----- From: Ronald Bonica Sent: Tuesday, >>>>> May 13, 2014 1:22 PM To: 'Roger Jørgensen'; Ross Callon Cc: >>>>> lisp@ietf.org Subject: RE: [lisp] Restarting last call on LISP >>>>> threats >>>>> >>>>> Hi Roger, >>>>> >>>>> Can this draft stand on its own, without integrating content >>>>> from the documents that you reference? >>>>> >>>>> >>>>> Ron >>>>> >>>>>> >>>>>> There exist two draft that are relevant to what you address. >>>>>> >>>>>> You have >>>>>> https://datatracker.ietf.org/doc/draft-farinacci-lisp-crypto/ >>>>>> >>>>>> > where the payload of a LISP encapsulated packet are encrypted. None >>>>>> of the keys for encrypting/decrypting are stored in the >>>>>> mapping system but is calculated by the xTR's involved. Then >>>>>> you have >>>>>> https://datatracker.ietf.org/doc/draft-ietf-lisp-sec/ that >>>>>> attempts to secure the xTR to xTR relationship. >>>>>> >>>>>> >>>>>> >>>>>> -- >>>>>> >>>> >>>> _______________________________________________ lisp mailing >>>> list lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp >>>> > From nobody Thu May 15 14:48:05 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7453D1A0150 for ; Thu, 15 May 2014 14:48:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.301 X-Spam-Level: X-Spam-Status: No, score=-2.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8bNqs33Tz0VJ for ; Thu, 15 May 2014 14:48:00 -0700 (PDT) Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2lp0204.outbound.protection.outlook.com [207.46.163.204]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6B2D11A014B for ; Thu, 15 May 2014 14:48:00 -0700 (PDT) Received: from CO2PR05MB636.namprd05.prod.outlook.com (10.141.199.24) by BLUPR05MB433.namprd05.prod.outlook.com (10.141.27.140) with Microsoft SMTP Server (TLS) id 15.0.944.11; Thu, 15 May 2014 21:47:45 +0000 Received: from CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) by CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) with mapi id 15.00.0944.000; Thu, 15 May 2014 21:47:44 +0000 From: Ross Callon To: "Joel M. Halpern" , Joel Halpern Direct , Ronald Bonica , =?iso-8859-1?Q?Roger_J=F8rgensen?= Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58M9eFhkxJvMEaw1MEc+Ryfdps9MyiAgAD04oCAAJ/u8IAAAtXQgABKWQCAAub1gIAAA9wAgAA0wSCAAAEgAIAAAVZA Date: Thu, 15 May 2014 21:47:43 +0000 Message-ID: References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <5372950E.3080704@joelhalpern.com> <172db6c3e26f458ebd70141bed7b7a8b@CO1PR05MB442.namprd05.prod.outlook.com> <53750788.900@joelhalpern.com> <0f6d1eca517e45f7ac5217f3ba1e8d80@CO2PR05MB636.namprd05.prod.outlook.com> <537534BA.6020106@joelhalpern.com> In-Reply-To: <537534BA.6020106@joelhalpern.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.11] x-forefront-prvs: 0212BDE3BE x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(51704005)(199002)(189002)(24454002)(377454003)(13464003)(479174003)(19580405001)(76482001)(74502001)(561944003)(83322001)(50986999)(77096999)(76176999)(54356999)(31966008)(15975445006)(33646001)(77982001)(46102001)(99396002)(81342001)(81542001)(99286001)(74316001)(74662001)(19580395003)(80022001)(86362001)(66066001)(21056001)(76576001)(92566001)(20776003)(64706001)(79102001)(85852003)(1941001)(83072002)(87936001)(101416001)(2656002)(4396001)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:BLUPR05MB433; H:CO2PR05MB636.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rcallon@juniper.net; Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/t1O_9IYoreMpZA4BMgoabafTgDU Cc: "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 May 2014 21:48:03 -0000 No problem. I just didn't want the other issues to be forgotten in the exci= tement over gleaning.=20 Ross -----Original Message----- From: Joel M. Halpern [mailto:jmh@joelhalpern.com]=20 Sent: Thursday, May 15, 2014 5:42 PM To: Ross Callon; Joel Halpern Direct; Ronald Bonica; Roger J=F8rgensen Cc: lisp@ietf.org Subject: Re: [lisp] Restarting last call on LISP threats I may have misread the discussion. I was commenting only on the one topic of gleaning. I was leaving it to=20 the authors to respond to your other comments. Yours, Joel On 5/15/14, 5:39 PM, Ross Callon wrote: > I raised a list of problems. They are not all already mentioned in the th= reats document (eg, note the privacy issue at the end of my detailed email)= . > > Ross > > -----Original Message----- > From: Joel Halpern Direct [mailto:jmh.direct@joelhalpern.com] > Sent: Thursday, May 15, 2014 2:29 PM > To: Ronald Bonica; Joel M. Halpern; Roger J=F8rgensen; Ross Callon > Cc: lisp@ietf.org > Subject: Re: [lisp] Restarting last call on LISP threats > > The threats document does not specify how to resolve the threats. It > identifies problems. In this particular case, it already identifies the > problem that Ross raised. Quite clearly. > > There is no dependence on the documents Roger pointed to. They are ways > of remediating the threat. > > Yours, > Joel > > On 5/15/14, 2:15 PM, Ronald Bonica wrote: >> Joel, >> >> The threats document should not depend on lisp-sec or lisp-crypto. >> However, Roger's response did rely on those documents (see his >> response, below). >> >> So, we are left to explore whether something was omitted from the >> threats document. Standby for my response to Roger. >> >> Ron >> >> >> >>> -----Original Message----- From: Joel M. Halpern >>> [mailto:jmh@joelhalpern.com] Sent: Tuesday, May 13, 2014 5:57 PM >>> To: Ronald Bonica; Roger J=F8rgensen; Ross Callon Cc: lisp@ietf.org >>> Subject: Re: [lisp] Restarting last call on LISP threats >>> >>> Ron, I am having trouble with the question. >>> >>> The threats document describes the threats as they exist today, >>> without the adoption of either document that Roger pointed to. >>> Thus, I do not see any dependence. >>> >>> If there is a threat that is not well described in the base spec or >>> this document, then we should add it. We should add it even if >>> there are proposals to remediate it. But if there is a clear >>> proposal of a missing threat, I missed it. >>> >>> Yours, Joel >>> >>> On 5/13/14, 1:31 PM, Ronald Bonica wrote: >>>> Hi Roger, >>>> >>>> Or asked more explicitly, can the level of security claimed by >>>> the threats >>> document be achieved without implementing the protocol extensions >>> described in lisp-sec and lisp-crypto? >>>> >>>> Ron >>>> >>>> >>>>> -----Original Message----- From: Ronald Bonica Sent: Tuesday, >>>>> May 13, 2014 1:22 PM To: 'Roger J=F8rgensen'; Ross Callon Cc: >>>>> lisp@ietf.org Subject: RE: [lisp] Restarting last call on LISP >>>>> threats >>>>> >>>>> Hi Roger, >>>>> >>>>> Can this draft stand on its own, without integrating content >>>>> from the documents that you reference? >>>>> >>>>> >>>>> Ron >>>>> >>>>>> >>>>>> There exist two draft that are relevant to what you address. >>>>>> >>>>>> You have >>>>>> https://datatracker.ietf.org/doc/draft-farinacci-lisp-crypto/ >>>>>> >>>>>> > where the payload of a LISP encapsulated packet are encrypted. None >>>>>> of the keys for encrypting/decrypting are stored in the >>>>>> mapping system but is calculated by the xTR's involved. Then >>>>>> you have >>>>>> https://datatracker.ietf.org/doc/draft-ietf-lisp-sec/ that >>>>>> attempts to secure the xTR to xTR relationship. >>>>>> >>>>>> >>>>>> >>>>>> -- >>>>>> >>>> >>>> _______________________________________________ lisp mailing >>>> list lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp >>>> > From nobody Fri May 16 10:06:13 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BDDE31A02CC; Fri, 16 May 2014 10:06:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IJHo6_IDlC4D; Fri, 16 May 2014 10:06:09 -0700 (PDT) Received: from mailc2.tigertech.net (mailc2.tigertech.net [208.80.4.156]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F113A1A02AE; Fri, 16 May 2014 10:06:08 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mailc2.tigertech.net (Postfix) with ESMTP id B1AB5141E34; Fri, 16 May 2014 10:06:01 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at c2.tigertech.net Received: from Joels-MacBook-Pro.local (pool-70-106-135-10.clppva.east.verizon.net [70.106.135.10]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mailc2.tigertech.net (Postfix) with ESMTPSA id D7DC3141E33; Fri, 16 May 2014 10:06:00 -0700 (PDT) Message-ID: <53764577.6070502@joelhalpern.com> Date: Fri, 16 May 2014 13:05:59 -0400 From: "Joel M. Halpern" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.5.0 MIME-Version: 1.0 To: "lisp@ietf.org" , "karp@ietf.org" References: <9913.1400250296@sandelman.ca> In-Reply-To: <9913.1400250296@sandelman.ca> X-Forwarded-Message-Id: <9913.1400250296@sandelman.ca> Content-Type: multipart/mixed; boundary="------------090905030802060406060007" Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/inC4uqsa7w5h0zPZdyfZySD-Jto Subject: [lisp] Fwd: NomCom 2014-2015 Call for Volunteers X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 May 2014 17:06:11 -0000 This is a multi-part message in MIME format. --------------090905030802060406060007 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Please consider volunteering for the IETF nominating committee. Broad community participation is important for our process. Thank you, Joel -------- Original Message -------- Subject: NomCom 2014-2015 Call for Volunteers Date: Fri, 16 May 2014 10:24:56 -0400 From: Michael Richardson Reply-To: nomcom-chair-2014@ietf.org To: ietf@ietf.org {I have to post using my subscribed address. Appologies for duplicates} The IETF nominating committee (nomcom) process for 2014-15 has begun. The IETF nomcom appoints folks to fill the open slots on the IAOC, the IAB, and the IESG (including IETF Chair). Ten voting members for the nomcom are selected in a verifiably random way from a pool of volunteers. The more volunteers, the better chance we have of choosing a random yet representative cross section of the IETF population. Let's break the 200 volunteer mark again this year! The details of the operation of the nomcom can be found in RFC 3777, and BCP10/RFC3797 details the selection algorithm. Volunteers must have attended 3 of the past 5 IETF meetings. As specified in RFC 3777, that means three out of the five past meetings up to the time this email announcement goes out to start the solicitation of volunteers. The five meetings out of which you must have attended *three* are IETF 85(Atlanta), \ 86(Orlando), \ 87(Berlin), *** ANY THREE! 88(Vancouver), / 89(London) / If you qualify, please volunteer. However, much as we want this, before you decide to volunteer, please be sure you are willing to forgo appointment to any of the positions for which this nomcom is responsible. The list of people and posts whose terms end with the March 2015 IETF meeting, and thus the positions for which this nomcom is responsible, are IAOC: To be confirmed IAB: Joel Halpern Russ Housley Eliot Lear Xing Li Andrew Sullivan Dave Thaler IESG: Pete Resnick (Applications) Ted Lemon (Internet) Joel Jaeggli (Operations and Management) Richard Barnes (RAI) Adrian Farrel* (Routing) Stephen Farrell (Security) Spencer Dawkins (Transport) Jari Arkko (Gen) (names with * have publically indicated they will not serve another term) The primary activity for this nomcom will begin in July 2014 and should be completed in January 2015. The nomcom will have regularly scheduled conference calls to ensure progress. (We might dogfood WebRTC) There will be activities to collect requirements from the community, review candidate questionnaires, review feedback from community members about candidates, and talk to candidates. Thus, being a nomcom member does require some time commitment; but it is also a very rewarding experience. It is very important that you be able to attend IETF91 to conduct interviews. Being at IETF90 is useful for training. Being at IETF92 is not essential. Please volunteer by sending me an email before 11:59 pm EDT (UTC -4 hours) June 22, 2013, as follows: To: nomcom-chair-2014@ietf.org Subject: Nomcom 2014-15 Volunteer Please include the following information in the email body: // First/Given Name followed by Last/Family Name // matching how you enter it in the IETF Registration Form) // Typically what goes in the Company field // in the IETF Registration Form [] // For confirmation if selected You should expect an email response from me within 3 business days stating whether or not you are qualified. If you don't receive this response, please re-send your email with the tag "RESEND"" added to the subject line. If you are not yet sure if you would like to volunteer, please consider that nomcom members play a very important role in shaping the leadership of the IETF. Questions by email or voice are welcome. Volunteering for the nomcom is a great way to contribute to the IETF! You can find a detailed timeline on the nomcom web site at: https://datatracker.ietf.org/nomcom/2014/ I will be publishing a more detailed target timetable, as well as details of the randomness seeds to be used for the RFC 3797 selection process, within the next couple weeks. Thank you! Michael Richardson mcr+nomcom@sandelman.ca nomcom-chair-2014@ietf.org --------------090905030802060406060007 Content-Type: application/pgp-signature; name="Attached Message Part" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="Attached Message Part" LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KVmVyc2lvbjogR251UEcgdjEuNC4xMiAo R05VL0xpbnV4KQoKaVFFVkF3VUJVM1lmdDRDTGNQdmQwTjFsQVFLNEVnZi9WZmxWbmdiTHU3 NEhpai83WUtDbGVLcG8ybWZUVi90NAplcWhacndkWkh1SlhrbTdlZWEzbk5TdG5jQXRiY0dD R1hUZXY1WThEMkFMdkJtamdUZlpRano0YXNkcjVNU3BnCkZ3aEM1ZVNSRVJFbVpiSU5mbjdY L2NtOHZFc1RpWjFDbndPUUdHMWxPVjFUQ1Q4TWg0aEFNYnZpZWJtRHdOdFkKTWVmU1VkV21S YkF4TkdqbDJmQkRoeDRvV3lNaDNaa1hyWnNwMlNHMzloUWoweFZUcGEvdXJvMGRqNFB3Q0NK SgpjTXFnbUVKd1V1VXpLc3RCdzY4U3BsT3B5ZUIreDZxZ1QwcmVaK0Z2RXhtbk8rZlhDdDRI c25yRG9DQkREckp4CmdJQVBEaTVsdVpmSndzM1pxbmhJLzNoVTFNaHVpT0dickhRRkpoYURt aiswTk9YbzNXbkR2dz09Cj1PUHM3Ci0tLS0tRU5EIFBHUCBTSUdOQVRVUkUtLS0tLQo= --------------090905030802060406060007-- From nobody Fri May 16 11:36:31 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 512EC1A0354 for ; Fri, 16 May 2014 11:36:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TN4AqfI0IoBt for ; Fri, 16 May 2014 11:36:28 -0700 (PDT) Received: from mail-yh0-x22b.google.com (mail-yh0-x22b.google.com [IPv6:2607:f8b0:4002:c01::22b]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DDD5C1A0347 for ; Fri, 16 May 2014 11:36:27 -0700 (PDT) Received: by mail-yh0-f43.google.com with SMTP id v1so4709340yhn.30 for ; Fri, 16 May 2014 11:36:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=vR3w6cQdPAvFTnqPae7U9pvnbhtbgTVVt549Rz0NruI=; b=QvS6kLEidXMVVpsymKxzVV3hbMAwYMUHmPAbwSBgrw8P9gsn1bcAGQmnWjEg4FUK8J egWzF6+U8bGtZX1/g4JdcZLLS/QzgNfMU0r2xvxOs4q2k18UYhBJEKPHtmi32jhwFntW u91qVIYOLZnhaHiiOYSxEle+1VTJa1tRMa8HGE70kxUsewJa0KElTgSUUxrYLXRBtn71 wXjH2VS0e+VRAPkt2YUmtvPWfCBuNlx9WUsTUY+8FlofGDHt5OzTddxoWZfzjr1ZKmcR i5gWXCqmGW7zqygIqJPyXcK9twceCZG2AZL8Kb1qI3IUq9QAiBlDMqIIBHPQHsSEaB3H B6uw== X-Received: by 10.236.93.16 with SMTP id k16mr6469485yhf.140.1400265379942; Fri, 16 May 2014 11:36:19 -0700 (PDT) Received: from [192.168.0.150] ([72.252.14.172]) by mx.google.com with ESMTPSA id u5sm13009325yhg.25.2014.05.16.11.36.17 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 16 May 2014 11:36:17 -0700 (PDT) Content-Type: text/plain; charset=iso-8859-1 Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\)) From: Dino Farinacci In-Reply-To: <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> Date: Fri, 16 May 2014 11:36:18 -0700 Content-Transfer-Encoding: quoted-printable Message-Id: References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> To: Ronald Bonica X-Mailer: Apple Mail (2.1874) Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/r75sG-YEEYsX11PItZVbGN0tUDI Cc: Roger Jorgensen , "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 May 2014 18:36:30 -0000 > Roger, >=20 > Having considered this, it appears that the LISP data plane can = operate in trusted or untrusted mode. In the trusted mode, when one XTR = receives a data-plane packet from another, it can trust control plane = information that it might glean from the packet's outer IP header and = LISP header. Such trust is based on the assumption that: >=20 > - the sending XTR is who it claims to be > - the sending XTR is not intentionally offering bad mapping = information to the receiving XTR Determining "who" is rather nebulous. How can I trust this email is from = you Ron? It's because I have ultra meta-data about you. That is, I know = you can be versed in LISP so I am likely talking to another LISP spoofer = that looks like Ron. So if I am getting packets from an xTR that has a global locator that is = your DSL router at your house, I would expect to see the inner source = EID be from the mapping. I can tell that the EID->RLOC mapping is = authenticated and validated by asking the mapping system, but if Roger = managed to get packets to me with BOTH your EID and RLOC, then I really = don't know if those packets are coming from Ron.=20 Now how Roger does this will be an amazing feat because a lot of ISPs = between Roger and me would be very broken. > In trusted mode, the receiving XTR can glean control information from = the data plane. However, in untrusted mode, the receiving XTR must not = do so. Alternatively, it must send a verifying MAP-REQUEST to the = mapping system. If you encrypt data to me, I cannot tell you are actually Roger or Ron. = But the conversation between me and Roger (who is spoofing Ron) will be = confidential. ;-) We either have total privacy or we have NSA intrusion. ;-) You can't = have both so we should have the former. > So far, all of this is covered nicely between RFC 6830 and the LISP = threats document. However, we have yet to explore the threats associated = with unsecured mode operation, where gleaned information cannot be used. This is true. When a system receives an ARP-request it gleans the source = information in there to minimize broadcast traffic for returned unicast = traffic. That is a benefit willing to receive at a cost of knowing a LAN = is secure and scoped (if that is really true, it is another story). So = there is a value/risk tradeoff here. > For example, assume that two XTRs and an attacker are connected to the = global Internet. The attacker is neither an XTR nor contained by a LISP = site. The attacker is capable of spoofing its sources address. But will the entire path to any destination let him? > The attacker can launch a DoS attack against an XTRs control plan by = sending a barrage of crafted packets to the victim XTR. Each crafted = packet cause the victim XTR to send a verifying MAP-REQUEST to the = mapping system. The attack stream may be so large that it causes the = victim XTR to exceed the rate limit for MAP-REQUEST messages.=20 You can trust sources less if they ARE NOT in the mapping database. That = is, if you are a LISP site, you have more tools be verify trust. Dino >=20 > = Ron >=20 >=20 >> -----Original Message----- >> From: Roger J=F8rgensen [mailto:rogerj@gmail.com] >> Sent: Wednesday, May 14, 2014 3:59 AM >> To: Ronald Bonica >> Cc: Ross Callon; lisp@ietf.org >> Subject: Re: [lisp] Restarting last call on LISP threats >>=20 >> On Tue, May 13, 2014 at 7:31 PM, Ronald Bonica >> wrote: >>> Hi Roger, >>>=20 >>> Or asked more explicitly, can the level of security claimed by the = threats >> document be achieved without implementing the protocol extensions >> described in lisp-sec and lisp-crypto? >>=20 >> I've been pondering on what to answer you since yesterday but think = the >> reply from Joel cover it well. However as an addon to Joel and partly = reply to >> your question, see more inline. >>=20 >>=20 >> On Tue, May 13, 2014 at 11:56 PM, Joel M. Halpern = >> wrote: >>> Ron, I am having trouble with the question. >>>=20 >>> The threats document describes the threats as they exist today, >>> without the adoption of either document that Roger pointed to. = Thus, >>> I do not see any dependence. >>>=20 >>> If there is a threat that is not well described in the base spec or >>> this document, then we should add it. We should add it even if = there >>> are proposals to remediate it. But if there is a clear proposal of = a >>> missing threat, I missed it. >>=20 >> Your question made me question the purpose of the LISP threats draft = - >> should it cover potential problem with RFC6830 and include pointers = to other >> work that cover them? That will include we'll get a document that = will be >> updated over time and is that a good thing? >>=20 >> The other way to look at LISP threats document is to have it as a = "review" of >> RFC6830, point out weaknesses and discuss them but with no references = to >> other documents. It will be a upstream document that we can refer to = from >> like the two draft I mention. >>=20 >> I don't think LISP threat should point to the two draft I mention, = but both >> drafts should have a reference to LISP threat since this will be = create a more >> stable threat document. >>=20 >>=20 >>=20 >> Then Dino mention: >>=20 >> On Tue, May 13, 2014 at 7:47 PM, Dino Farinacci >> wrote: >> >>> The main LISP spec (RFC6830) indicates if you want to trust the = mapping >> system you can use the gleaned information as soon as you receive it. = And if >> you don't trust the mapping system, you can send a "verifying = Map-Request" >> to the mapping system which results in a signed Map-Reply returned = ala >> draft-ietf-lisp-sec-06. >>=20 >>=20 >> Is this covered in the document? I didn't see it but it's still early = here... >>=20 >>=20 >>=20 >> -- >>=20 >> Roger Jorgensen | ROJO9-RIPE >> rogerj@gmail.com | - IPv6 is The Key! >> http://www.jorgensen.no | roger@jorgensen.no > _______________________________________________ > lisp mailing list > lisp@ietf.org > https://www.ietf.org/mailman/listinfo/lisp From nobody Fri May 16 12:15:28 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF3F11A0338 for ; Fri, 16 May 2014 12:15:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.194 X-Spam-Level: X-Spam-Status: No, score=0.194 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_NL=0.55, HOST_EQ_NL=1.545, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z3rXW7AwqV43 for ; Fri, 16 May 2014 12:15:24 -0700 (PDT) Received: from mail.sintact.nl (mail.sintact.nl [IPv6:2001:9e0:803::6]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D4621A0103 for ; Fri, 16 May 2014 12:15:24 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.sintact.nl (Postfix) with ESMTP id A3EED3F; Fri, 16 May 2014 21:15:15 +0200 (CEST) X-Virus-Scanned: Debian amavisd-new at mail.sintact.nl Received: from mail.sintact.nl ([127.0.0.1]) by localhost (mail.sintact.nl [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fJiG8364PimH; Fri, 16 May 2014 21:15:07 +0200 (CEST) Received: from [172.20.10.3] (unknown [172.20.10.3]) by mail.sintact.nl (Postfix) with ESMTPSA id C58C23B; Fri, 16 May 2014 21:13:04 +0200 (CEST) Content-Type: text/plain; charset=iso-8859-1 Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\)) From: Sander Steffann In-Reply-To: Date: Fri, 16 May 2014 21:11:00 +0200 Content-Transfer-Encoding: quoted-printable Message-Id: <8891A030-B462-48D9-83B4-4E42525F38CE@steffann.nl> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> To: Dino Farinacci X-Mailer: Apple Mail (2.1874) Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/WpZToavdNMxaetJbmQNLUqKlaA4 Cc: Roger Jorgensen , "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 May 2014 19:15:26 -0000 Hi Dino, > If Roger managed to get packets to me with BOTH your EID and RLOC, = then I really don't know if those packets are coming from Ron.=20 >=20 > Now how Roger does this will be an amazing feat because a lot of ISPs = between Roger and me would be very broken. Unfortunately this is not unlikely :( I certainly wouldn't consider it = an amazing feat... BCP38 is not implemented as much as it should be. Cheers, Sander From nobody Fri May 16 16:37:39 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BFC651A01AB for ; Fri, 16 May 2014 16:37:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N7oBmXm9kZxV for ; Fri, 16 May 2014 16:37:35 -0700 (PDT) Received: from mail-yh0-x231.google.com (mail-yh0-x231.google.com [IPv6:2607:f8b0:4002:c01::231]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8E32A1A0195 for ; Fri, 16 May 2014 16:37:35 -0700 (PDT) Received: by mail-yh0-f49.google.com with SMTP id c41so5003080yho.36 for ; Fri, 16 May 2014 16:37:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=zyOaaRlGFqyBprtI66lC5OlZaFyEnqfZZClN3cY5qbE=; b=fmcIf/mAj0EhOOALq0aTRNAaLN5rD+RXr0zt2aFf5KVlRgbkStlZQefhjbtRXA68lQ Y5i/p7DooSRh4aFFWKNz80h/pa+IdykIkg7NwIkQBApzzLdcL3fg4eOpFE6K+OgYAsZl Rs2MUMgKHX85ZNrCezf9u+fqKx226jPc8ZdP/oJcMuTx1Rxo4YY7Q584LvOy4NVySNZI UWb2/1HZRnEjeOqMzSuqBAEJua+CNglo2g3nj2gN7mSjG8hIpqp3HQRl4hcDZx3h20E7 e6Ox8G0DHTa05UlEEZ6uA28/Bt19JzCBXqXxQsAsbfZb4Pkiae2hi5DUbMIyIL5g0J5c +OCQ== X-Received: by 10.236.32.178 with SMTP id o38mr29934489yha.119.1400283447743; Fri, 16 May 2014 16:37:27 -0700 (PDT) Received: from [192.168.2.122] ([72.252.14.172]) by mx.google.com with ESMTPSA id z2sm14077434yhm.30.2014.05.16.16.37.20 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 16 May 2014 16:37:26 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Dino Farinacci X-Mailer: iPhone Mail (11D167) In-Reply-To: <8891A030-B462-48D9-83B4-4E42525F38CE@steffann.nl> Date: Fri, 16 May 2014 19:37:14 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <8891A030-B462-48D9-83B4-4E42525F38CE@steffann.nl> To: Sander Steffann Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/RqpzJldpHa25yE85yRvLlfqg2WE Cc: Roger Jorgensen , "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 May 2014 23:37:36 -0000 > Unfortunately this is not unlikely :( I certainly wouldn't consider it an= amazing feat... BCP38 is not implemented as much as it should be. I know there are many cases where BCP38 is not practice but more and more ac= cess providers due uRPF.=20 You only need one in the path. And the ones that don't do it are using resou= rces to transit packets to possible black holes.=20 Dino= From nobody Sat May 17 13:37:03 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D0551A0216 for ; Sat, 17 May 2014 13:37:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.7 X-Spam-Level: X-Spam-Status: No, score=-1.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, MIME_8BIT_HEADER=0.3, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qLlnyvaeWKpy for ; Sat, 17 May 2014 13:36:56 -0700 (PDT) Received: from mail-we0-x22b.google.com (mail-we0-x22b.google.com [IPv6:2a00:1450:400c:c03::22b]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 011781A0208 for ; Sat, 17 May 2014 13:36:55 -0700 (PDT) Received: by mail-we0-f171.google.com with SMTP id w62so3914328wes.2 for ; Sat, 17 May 2014 13:36:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=p/mXum9l81uwUC6KSDydwqOwb/L3CKSEF8lDZY0jlaI=; b=wFzJkt4x7pO8JTszYFrgOrcJh94fghe08tWlediCMBg9FEqNpB4gEoYbkpfeWMmsTH whdW0EX5lhgHJG8lZuQRmF8aY51vOvqYOLzLnjGDAgwH7kECvx24DVQESt2MMb54qdKt mJ2QYAv0Gqtb7fme0UlBvRXeXuUvpmQdHgsJTjmI1UAguKHJJY/hnfNlycKX5+Efd7FS WX887yGvj3PYu3OeCvyNVlbHKL/t8MZiZqJY4/WBXcB/P7/fEq6bDbBL/NLiB5eEk+Gt qY4pIOFBfd5XWvWE3CIcnnr+iKqS9HTUSFxoM5MyNl/Mq0GBkoPJmT54Ur5+FAqP8rPs M23Q== MIME-Version: 1.0 X-Received: by 10.194.206.2 with SMTP id lk2mr20685391wjc.33.1400359014394; Sat, 17 May 2014 13:36:54 -0700 (PDT) Received: by 10.216.210.6 with HTTP; Sat, 17 May 2014 13:36:54 -0700 (PDT) In-Reply-To: <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> Date: Sat, 17 May 2014 22:36:54 +0200 Message-ID: From: =?UTF-8?Q?Roger_J=C3=B8rgensen?= To: Ronald Bonica Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/VZNASPgKj674_A8JjAnpfCxEMjM Cc: "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 May 2014 20:37:00 -0000 On Thu, May 15, 2014 at 11:02 PM, Ronald Bonica wrote= : > Roger, > > Having considered this, it appears that the LISP data plane can operate i= n trusted or untrusted mode. In the trusted mode, when one XTR receives a d= ata-plane packet from another, it can trust control plane information that = it might glean from the packet's outer IP header and LISP header. Such trus= t is based on the assumption that: > > - the sending XTR is who it claims to be > - the sending XTR is not intentionally offering bad mapping information t= o the receiving XTR > > In trusted mode, the receiving XTR can glean control information from the= data plane. However, in untrusted mode, the receiving XTR must not do so. = Alternatively, it must send a verifying MAP-REQUEST to the mapping system. > > So far, all of this is covered nicely between RFC 6830 and the LISP threa= ts document. However, we have yet to explore the threats associated with un= secured mode operation, where gleaned information cannot be used. > > For example, assume that two XTRs and an attacker are connected to the gl= obal Internet. The attacker is neither an XTR nor contained by a LISP site.= The attacker is capable of spoofing its sources address. > > The attacker can launch a DoS attack against an XTRs control plan by send= ing a barrage of crafted packets to the victim XTR. Each crafted packet cau= se the victim XTR to send a verifying MAP-REQUEST to the mapping system. T= he attack stream may be so large that it causes the victim XTR to exceed th= e rate limit for MAP-REQUEST messages. Lots of other people that know LISP way better than I do have responded alr= eady. Do I understand you correct that you think there is a hole in the threat draft, or are you talking about another miss, that is what will happen if the mapping-system fail to reply in time when encryption or other form for verification of both ends (iTR and eTR) are used? --=20 Roger Jorgensen | ROJO9-RIPE rogerj@gmail.com | - IPv6 is The Key! http://www.jorgensen.no | roger@jorgensen.no From nobody Mon May 19 07:14:20 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C52FA1A0387 for ; Mon, 19 May 2014 07:14:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.601 X-Spam-Level: X-Spam-Status: No, score=-102.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V4WDKcuFc-sl for ; Mon, 19 May 2014 07:14:14 -0700 (PDT) Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2lp0211.outbound.protection.outlook.com [207.46.163.211]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B638D1A0015 for ; Mon, 19 May 2014 07:14:13 -0700 (PDT) Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB441.namprd05.prod.outlook.com (10.141.73.147) with Microsoft SMTP Server (TLS) id 15.0.944.11; Mon, 19 May 2014 14:14:05 +0000 Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) with mapi id 15.00.0944.000; Mon, 19 May 2014 14:14:05 +0000 From: Ronald Bonica To: Dino Farinacci , Sander Steffann Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEIABfmkAgAAJsgCAAEpiAIAEFPjg Date: Mon, 19 May 2014 14:14:05 +0000 Message-ID: References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <8891A030-B462-48D9-83B4-4E42525F38CE@steffann.nl> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.12] x-forefront-prvs: 021670B4D2 x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(51704005)(13464003)(377454003)(189002)(199002)(46102001)(101416001)(21056001)(31966008)(79102001)(80022001)(66066001)(81342001)(4396001)(74502001)(74662001)(77982001)(76482001)(50986999)(76176999)(2656002)(15202345003)(99396002)(19580395003)(74316001)(54356999)(19580405001)(99286001)(83322001)(86362001)(85852003)(81542001)(83072002)(15975445006)(16799955002)(20776003)(64706001)(76576001)(87936001)(33646001)(92566001)(15188155005)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO1PR05MB441; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/MCDDiQwnYCqlROm6oecOxyDoXE8 Cc: Roger Jorgensen , "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 May 2014 14:14:18 -0000 Dino, The Spoofer Project (http://spoofer.cmand.org/summary.php) offers a longitu= dinal view of BCP 38 deployment. I think that the results that they report = validate Sander's objection. Furthermore, they may suggest that Sander's ob= jection will remain valid for years to come. = Ron > -----Original Message----- > From: Dino Farinacci [mailto:farinacci@gmail.com] > Sent: Friday, May 16, 2014 7:37 PM > To: Sander Steffann > Cc: Ronald Bonica; Roger Jorgensen; lisp@ietf.org > Subject: Re: [lisp] Restarting last call on LISP threats >=20 > > Unfortunately this is not unlikely :( I certainly wouldn't consider it= an > amazing feat... BCP38 is not implemented as much as it should be. >=20 > I know there are many cases where BCP38 is not practice but more and more > access providers due uRPF. >=20 > You only need one in the path. And the ones that don't do it are using > resources to transit packets to possible black holes. >=20 > Dino From nobody Mon May 19 10:57:27 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B45B1A00EA for ; Mon, 19 May 2014 10:57:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ds5saJfUX928 for ; Mon, 19 May 2014 10:57:24 -0700 (PDT) Received: from mail-pa0-x22f.google.com (mail-pa0-x22f.google.com [IPv6:2607:f8b0:400e:c03::22f]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A654D1A00B1 for ; Mon, 19 May 2014 10:57:24 -0700 (PDT) Received: by mail-pa0-f47.google.com with SMTP id lf10so6086424pab.34 for ; Mon, 19 May 2014 10:57:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=+ohcwOzriXIC4mqWempz176njmiluzDMw3e2nBg6OUw=; b=YRF/mSBZMrDLkHvVwpbNSo4EOBsnPaxNpsTI6BvljCILUwpGYQh8A+HNK4e4lBSraa 1Pv7KMlszJoB2fWLbHDJVYfKwAmXSZB0FKtowwjpboAr5ipBOOTtcqEPT+JZqVqzjKoL EDP6LcJs0xBhzr8D3rFVp27Ss7Owrp5Ht/cqxg0lF1pRAY2OKH25hYtqadgjscQhO9ZS 5oy7NQckD1kAClv4RfYsdwB/IgK1eEZbBYkP5zKLiUHY3M+A64IgE/NZitfVKd3kl5uf eLmE8yVC5nfa103LTFuIXT3QGKnmwfdRQsF80yHUtrYH0ARO9I6zWpcLzFocZ5EFLBw4 YKCw== X-Received: by 10.66.65.169 with SMTP id y9mr44387299pas.145.1400522244476; Mon, 19 May 2014 10:57:24 -0700 (PDT) Received: from [10.214.44.136] ([166.170.42.80]) by mx.google.com with ESMTPSA id gc3sm31179009pbd.93.2014.05.19.10.57.08 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 19 May 2014 10:57:23 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Dino Farinacci X-Mailer: iPhone Mail (11D167) In-Reply-To: Date: Mon, 19 May 2014 13:56:59 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <2D126379-BFF8-45FE-B6E1-B7E5E7FA5A6A@gmail.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <8891A030-B462-48D9-83B4-4E42525F38CE@steffann.nl> To: Ronald Bonica Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/74UyYUoLeAYQVmiCK4lNTz47vUk Cc: Roger Jorgensen , "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 May 2014 17:57:26 -0000 In those cases we do mapping database RPF lookups.=20 Dino > On May 19, 2014, at 10:14 AM, Ronald Bonica wrote: >=20 > Dino, >=20 > The Spoofer Project (http://spoofer.cmand.org/summary.php) offers a longit= udinal view of BCP 38 deployment. I think that the results that they report v= alidate Sander's objection. Furthermore, they may suggest that Sander's obje= ction will remain valid for years to come. >=20 > = Ron >=20 >=20 >> -----Original Message----- >> From: Dino Farinacci [mailto:farinacci@gmail.com] >> Sent: Friday, May 16, 2014 7:37 PM >> To: Sander Steffann >> Cc: Ronald Bonica; Roger Jorgensen; lisp@ietf.org >> Subject: Re: [lisp] Restarting last call on LISP threats >>=20 >>> Unfortunately this is not unlikely :( I certainly wouldn't consider it a= n >> amazing feat... BCP38 is not implemented as much as it should be. >>=20 >> I know there are many cases where BCP38 is not practice but more and more= >> access providers due uRPF. >>=20 >> You only need one in the path. And the ones that don't do it are using >> resources to transit packets to possible black holes. >>=20 >> Dino From nobody Mon May 19 15:25:51 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 387931A0412 for ; Mon, 19 May 2014 15:25:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.7 X-Spam-Level: X-Spam-Status: No, score=0.7 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GxX_faafBma2 for ; Mon, 19 May 2014 15:25:45 -0700 (PDT) Received: from mail-wg0-x22b.google.com (mail-wg0-x22b.google.com [IPv6:2a00:1450:400c:c00::22b]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 21F041A0195 for ; Mon, 19 May 2014 15:25:44 -0700 (PDT) Received: by mail-wg0-f43.google.com with SMTP id l18so8593125wgh.14 for ; Mon, 19 May 2014 15:25:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=/IUsBEprB5Q+vPTkevOMzuiai+ioUurzreuJe3C5pbM=; b=yHO2LoA+IJnof0ERAs2Dj+x9+NrF9E9E1M+86oeQMs+GyQ0KNjqHqr2OQcYFWk6F83 mcx8wj+MWaoGBwdPReq9s5/JP/NuLes0GYXNVWmPZXqG4X8T/t9gwqnXhXoQkYBGQIhn 0LAFRLxIbyxiHk6PFmVp15eBz1ggTAlckm8YVn3zMgxuG82eEcrXkVapZNZmzw4oDROu VYQ7UNPch41pWoU1mgf4wk0X09ThR6CzVjMx6hGCHpwO8nCV2F55NUwSFUxHuPfchVSp SvPvmsvBl4Vh8zR2tC/o9SkLIhZzZ5Dwc5lBrrJlqLxA4Qp3ax4C9YAtWTpbfy0LpRL3 vg+g== X-Received: by 10.180.13.139 with SMTP id h11mr1057706wic.34.1400538343652; Mon, 19 May 2014 15:25:43 -0700 (PDT) Received: from [10.207.103.153] (LLagny-156-35-13-133.w80-14.abo.wanadoo.fr. [80.14.125.133]) by mx.google.com with ESMTPSA id j3sm15775428wjw.38.2014.05.19.15.25.40 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 19 May 2014 15:25:42 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.2\)) From: Damien Saucez In-Reply-To: <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> Date: Tue, 20 May 2014 00:25:40 +0200 Content-Transfer-Encoding: quoted-printable Message-Id: References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> To: Ross Callon X-Mailer: Apple Mail (2.1878.2) Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/Z9KK93Dqr1BmJsmL9ZyJ6xyHJ44 Cc: LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 May 2014 22:25:49 -0000 Dear Ross, Thank you for your time. Before detailed comments below, we have to remind that the objective of this document is to identify global threats potentially introduced by LISP w.r.t. what exists today in the legacy Internet. The problem space is out of the scope of the document. comments inline. On 12 May 2014, at 19:11, Ross Callon wrote: > Thanks Joel; >=20 > I think that draft-ietf-lisp-threats-09.txt is a start towards a = threats document, but that it has serious omissions and needs more work = before being progressed. Here are some specific comments:=20 >=20 >=20 > Section 2 (On-path Attackers), first paragraph:=20 >=20 > On-path attackers are attackers that are able to capture and modify > all the packets exchanged between an Ingress Tunnel Router (ITR) and > an Egress Tunnel Router (ETR). To cope with such an attacker, > cryptographic techniques such as those used by IPSec ([RFC4301]) are > required. As with IP, LISP relies on higher layer cryptography to > secure packet payloads from on path attacks, so this document does > not consider on-path attackers. >=20 > To me an on-path attacker is one which is on the data path. Such an = attacker might attack the contents of the data packet. In this case the = paragraph seems mostly correct to me: You encrypt the contents if you = don't want someone on the path to the destination to look at the = contents. However, as is discussed later in the document, LISP allows = systems which are not in the normal physical path, through a gleaning = attack, to inject themselves into the data path. This could be applied = to allow attacker's systems to inject themselves into the path of the = key management protocol. This implies that a legitimate user could get = keys supplied by an attacker, just as easily as it could get keys = supplied by a legitimate Internet site. If you are proposing that end to = end encryption is the solution to on path attackers then you need to = understand the implications of LISP on the operation of the protocol = needed for key management to support end to end encryption.=20 The paragraph you are citing end with this document does _not_ consider on-path attackers.. While you remarks are generally valuable they do not apply here, the document is not proposing anything, it i just stating what is _not_ considered. >=20 > Also, you should mention in this section that a gleaning attack would = allow at least in the short term for an attacker to become temporarily = on-path even if they are not on what should be the normal path to the = destination.=20 >=20 The definition we give about on-path attacker includes your sub-category. It does not matter where you attacker physically is. If it is able to capture and modify packets then it is on-path (does not matter if physical shorter or not). > An on-path attacker might choose to only change something about the = LISP handling details, such as exploding the map cache or redirecting a = user to a different site. Some of this is mentioned later in the = document. One thing that is not mentioned: Suppose that the encapsulated = packet is encrypted. The on-path attacker could however see the LISP = header, and thus could change the nonce, or add a nonce, or reply to the = nonce, change versioning information,... Are you proposing that the = LISP header be encrypted also? If so, where is this specified and what = does it do to forwarding performance in the xTR?=20 >=20 The document is just an analysis, hence your question, while valid, is outside the scope of this document. >=20 > Section 4.3.1, second paragraph, third sentence:=20 >=20 > This is not different from today's > Internet where a spoofing off-path attacker may inject data packets > in any flow. >=20 > In terms of injecting traffic that the end system receives and acts = upon, I believe that this sentence is entirely true. However, in terms = of the effect on the router's control plane, and particularly the = operation of xTR's, this sentence is not true. Today there is very = little that a spoofing attacker that is outside of a particular service = provider can do to exercise the control plane of that provider's = routers. This is important and intentional (see DOS discussion below).=20= >=20 >=20 The section actually does not enter in any discussion about quantifying the damages. So the second part of your comment is correct if it does apply to section 4.3.1. The first half of your comment is, however, unfounded. Section 4.3.1 is about attacks _not_ leveraging on LISP header, so from this side it is exactly the same case like any other IP spoofed packet. In particular since LISP header is not used, xTR functions are not actually attacked. > Minor nit, next sentence: >=20 > A non-spoofing off-path attacker (NSA)... >=20 > Given recent events, I think that "NSA" is an unfortunate acronym to = use here. How about NSOA?=20 >=20 >=20 This can be fixed before pushing the document to the IESG. > Section 4.3.1.1 (Gleaning Attacks), last paragraph: >=20 > By itself, an attack made solely using gleaning cannot last long, > however it should be noted that with current network capacities, a > large amount of packets might be exchanged during even a small > fraction of time. >=20 > The amount of damage that might be caused by this may depend upon what = happens to be exchanged in that "short amount of time". For example, the = initial handshake between sites (at the application layer) could include = sign in information (account names and passwords), on the basis that = this is the sort of information that needs to be exchanged at the = beginning of, for example, financial transactions. My understanding is = that for Internet commerce, it is normal for users to be redirected to a = different site to enter credit card information. This appears to = constitute a "new session" (or at least may be to an entirely different = location) and therefore the entire credit card exchange could occur in a = small period of time. I think it would be worth mentioning here that the = sensitivity of the information that could be exchanged during this = "short amount of time" is not known, and could potentially be serious.=20= Exchanging critical information (e.g. password) in clear means that you have a serious problem, but not at the network layer. Also, the situation with LISP would not be worse than without LISP. >=20 > Also, depending upon how long xTR's are willing to store gleaned = information (before the map request comes back), the time that a user is = misdirected due to a gleaning attack might be extended by coordinating a = DDOS attack with the gleaning attack. For example, an attacker may send = packets to a very large number of sites, with a source EID which is from = a major stock broker or bank and an RLOC from the attacker's captive = servers. The many sites glean the EID to RLOC mapping from the arriving = packets. Each pretty much simultaneously initiates an EID lookup (to = verify the EID to RLOC mapping). This creates a DOS attack on the = control plane of the mapping function supporting that stock broker or = bank. This implies that the responses are going to be delayed (and could = be greatly delayed), which allows the incorrect mappings to last longer = than they otherwise would. This allows any systems that actually happen = to be trying to connect to that stock or banking site to be redirected = to the a > ttacker's site. The attacker then becomes a man in the middle and can = for example can obtain the password and account information for users. =20= >=20 >=20 Such a scenario would require a lot of synchronisation. Anyway, our opinion is that the current text is stating exactly the same thing you describe just in a succinct way. As a reminder, the present document studies LISP in a public network deployment. > Last paragraph of section 4.3.2.2:=20 >=20 > If the size of the Map-Request > message is larger than the size of the smallest LISP-encapsulated > packet that could trigger such a message, this could lead to > amplification attacks (see Section 4.4.1) so that more bandwidth is > consumed on the target than the bandwidth necessary at the attacker > side. >=20 > The size of the packet is not the only issue. If the amount of = processing required to send a map-request and deal with the reply is = greater than the amount of processing that is required to send a packet = that triggers such a request, then this could also result in an = amplification attack. In principle it would seem that sending out a = large number of packets to trigger such a request would be relatively = straightforward (for example the attacker might be sending out many = packets only incrementing the EID in order to attack the ITR that will = need to generate many map requests). We may note that for many systems, = particularly very high speed routers (which might exist for example as = PE routers connecting very large enterprise customers), the control = plane may be several orders of magnitude slower than the data plane, so = that an attack that requires response from the router's control plane = would be much more serious than an attack of the same size that can be = handled in the data plane. I=20 > will say more about this in my comments below regarding DOS attacks.=20= >=20 >=20 Your first point can be easily fixed by substituting the word bandwidth with bandwidth and/or processing or "resource" Your statement on the speed difference between control and data plane is true and is a general observation not limited to LISP. Note that one of the advantages of having the Map-Server/Map-Resolver elements in the LISPa architecture is exactly to avoid situations you are describing. > Section 4.3.2.3, third paragraph (right after the bullets):=20 >=20 > The first type of packet should not cause any major problem to ITRs. > As the reachability test uses a 24 bits nonce, it is unlikely that = an > off-path attacker could send a single packet that causes an ITR to > believe that the ETR it is testing is reachable while in reality it > is not reachable. To increase the success likelihood of such = attack, > the attacker should create a massive amount of packets carrying all > possible nonce values. >=20 > However, this could be a problem if there are on-path attackers, since = they will see the nonce. They could insert nonce's where none are = present, requiring a response from the ETR. Given that the control plane = of very high speed PE routers may be much slower than the data plane, = this could cause a relatively moderate data stream that the data plane = or the PE could easily handle to turn into a control plane attack that = the control plane of a PE router could not handle. Also, the on-path = attacker could see the nonce's and respond "correctly" (or in a way that = the ITR that sent the nonce *thinks* is correct), thereby "verifying" = connectivity when none is present. You dismissed on-path attacks earlier = in the document on the basis that the user data could be encrypted, but = these are examples of on-path attacks that would be on the LISP header = and operation, and not on the user data.=20 It is clearly stated at the beginning of the document that on-path attacks are out of the scope of the document. Also, Sec. 2 does not limit cryptography technique to the payload, actually section 2 makes the distinction saying: 1) "To cope with such an attacker, cryptographic techniques such as those used by IPSec ([RFC4301 ]) are required." which is reported to any form of packet manipulation and 2) "As with IP, LISP relies on higher layer cryptography to secure packet payloads from on path attacks, so this document does not consider on-path attackers." which is related to attacks targeting the payload. >=20 >=20 > Section 5.2 (Denial of Service): >=20 > You need to mention here the relative difference in speed between the = data plane and the control plane of high speed routers. For example, = there are plenty of examples currently widely deployed of routers which = can handle a few terabits of data in the data plane. These routers might = typically have gigabit Ethernet links to the control processor, but I = doubt that any of them could handle Map-Requests coming in at line rate = at a gigabit. Thus the ratio between the speed of the control plane the = speed of the data plane is significantly greater than 1000. I understand = that many PE routers have slower data planes (and the CE "wireless = router" that sits in each of our homes is of course a lot slower than = this), but large data centers or large enterprise sites could very well = be connected to their service provider via a few very high speed PE = routers. Therefore an attack that would be trivial to handle in the data = plane (say, a few gigabits) could overwhelm the control plane.=20 >=20 You are absolutely right, but why this is specific to LISP? It is not specific to LISP, so there is no reason to discuss such an issue in this document. > Gleaning allows incoming packets to create map requests, which allows = a data plane attack to turn into a control plane attack. Given the = difference in speeds between the data plane and the control plane, this = makes it much easier to create an effective DOS attack.=20 >=20 RFC6830 already considered rate limiting fo this very reason. >=20 > Section 8 (Security Considerations).=20 >=20 > I am pleased that you removed the sentence from section 1 of the = previous (-08) draft that read: "As a result of the performed analysis, = the document discusses the severity of the threats and proposes = recommendations to reach the same level of security in LISP than in = Internet today (e.g., without LISP)". This sentence was not actually = correct. However, in looking through the document and in thinking about = the implications (see the rest of this email) it is quite clear that the = security of an Internet using LISP would be significantly less than the = current Internet (at least if you assume that there is *any* security at = all in the current Internet). I am thinking that there should be a = sentence at the end of section 8 to the effect that "At the current time = it appears that LISP would have significant security implications if = deployed on an Internet-wide scale". >=20 >=20 Such sentence would not represent the discussions that took place in the LISP WG in the last four years. The arguments that you raised in the previous part of this mail are mainly not LISP-specific, while the experience gathered in the last years show that LISP is not worst that what we have today (and actually research work out there shows that it can even be helpful to use LISP) > Finally, two items left out: >=20 > I don't see any discussion on the effect of LISP on firewalls. I am = assuming that pretty much all currently deployed firewalls are not able = to look past a LISP header to inspect the contents of packets. At a = minimum, this would seem to imply that LISP will need to be deployed = toward the Internet core from the current firewalls, so that the = firewalls can be looking at normal (unchanged) IP packets. >=20 >=20 Deployment model is out of the scope of this document and the problem is not specific to LISP. > There is another issue which might belong in the section on privacy: = In the Internet today if you want to attack a network with prefix = aa.bb/16, and you see this advertisement in the BGP routes, you can pick = a random address and send a packet and see if anything happens. You get = little feedback. With LISP you can send a map request to a random = address in the block and get back a map reply. This gives you an RLOC = which is in general the actual IP address of a real PE or CE router. Of = course you can repeat this across the entire /16, or even the Internet = (given sufficient time and traffic), and get something close to a = complete list of LISP xTRs. This implies that if service providers = implement LISP on PE routers, then they will be exposing the identity of = their PE routers to worldwide inspection. Given the number of PE routers = in the world (obviously much larger than the number of service = providers, and given PA address aggregation probably larger than the = number of routes that show u > p in the BGP routing table) we should expect that there are lots of PE = routers that have not been carefully secured, and exposing their = existence to open worldwide easy discovery would likely open the door to = a number of attacks that involve compromise of PE routers. Of course if = LISP is deployed on CE routers then their RLOC would similarly be = exposed.=20 >=20 If routers are not correctly secured, there is no problem linked to LISP as today it is already possible to discover the IP address of theses routers thanks to various techniques. Moreover, section 6 already clearly states that privacy is not discussed in the document but that the attacks presented in the document can potentially play a role in privacy threats. Regards, The authors of the threats document. > Thanks, Ross >=20 > -----Original Message----- > From: lisp [mailto:lisp-bounces@ietf.org] On Behalf Of Joel M. Halpern > Sent: Friday, May 09, 2014 11:54 AM > To: lisp@ietf.org > Subject: [lisp] Restarting last call on LISP threats >=20 > Sorry for the delay getting this out. > This email starts a new (and hopefully final) last call on=20 > draft-ietf-lisp-threats, version 9: > http://datatracker.ietf.org/doc/draft-ietf-lisp-threats/ >=20 > The last call will end in two weeks, close of business 23-May-2014. >=20 > Thank you, > Joel >=20 > _______________________________________________ > lisp mailing list > lisp@ietf.org > https://www.ietf.org/mailman/listinfo/lisp >=20 > _______________________________________________ > lisp mailing list > lisp@ietf.org > https://www.ietf.org/mailman/listinfo/lisp From nobody Wed May 21 08:16:16 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E40C1A06D7 for ; Wed, 21 May 2014 08:16:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u748h4uFhT1X for ; Wed, 21 May 2014 08:16:09 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1blp0181.outbound.protection.outlook.com [207.46.163.181]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5EBC31A085B for ; Wed, 21 May 2014 08:16:09 -0700 (PDT) Received: from CO2PR05MB636.namprd05.prod.outlook.com (10.141.199.24) by CO2PR05MB636.namprd05.prod.outlook.com (10.141.199.24) with Microsoft SMTP Server (TLS) id 15.0.944.11; Wed, 21 May 2014 15:16:06 +0000 Received: from CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) by CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) with mapi id 15.00.0944.000; Wed, 21 May 2014 15:16:06 +0000 From: Ross Callon To: Damien Saucez Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58M9eFhkxJvMEaw1MEc+Ryfdps9FMJAgAt2hwCAAqNu4A== Date: Wed, 21 May 2014 15:16:05 +0000 Message-ID: <082ae04715e5432c9bf5b2d9fd00d568@CO2PR05MB636.namprd05.prod.outlook.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.15] x-forefront-prvs: 0218A015FA x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(189002)(199002)(13464003)(51744003)(24454002)(377454003)(51704005)(51444003)(164054003)(19580405001)(86362001)(4396001)(15202345003)(92566001)(19580395003)(80022001)(15975445006)(76482001)(77982001)(79102001)(64706001)(20776003)(85852003)(66066001)(33646001)(83072002)(87936001)(2656002)(77096999)(46102001)(54356999)(76576001)(74502001)(81542001)(31966008)(74316001)(99286001)(81342001)(21056001)(74662001)(99396002)(101416001)(50986999)(551544002)(76176999)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO2PR05MB636; H:CO2PR05MB636.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rcallon@juniper.net; Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/n0_vSnns4Knp6DfWBXeYYnbZ5OA Cc: LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 May 2014 15:16:13 -0000 I will respond to your email in detail (in a separate email), but I also=20 have one higher level meta-comment which is important which I think that=20 we should discuss first.=20 Specifically, we need to remember what LISP is proposed to do. LISP=20 has been proposed as a new routing and addressing architecture for the=20 Internet. If we believe this goal is realistic, and if we believe that=20 LISP could actually end up being deployed as the routing and addressing=20 architecture for the Internet, then the Internet could someday be entirely= =20 dependent upon LISP actually working and actually being secure when=20 deployed at scale.=20 The Internet has been described as the control plane for the world. The=20 Internet is of enormous importance for the world's economy (and all of=20 our jobs, and millions of others). IT HAS TO WORK. As such, any attack that might have the potential of disrupting the=20 operation of LISP, or that can be made worse by LISP, MUST be taken=20 seriously. If you declare some attacks as "outside of the scope of=20 LISP threats document" then either you are saying that the LISP WG is=20 not serious about widespread deployment of LISP, or you are putting the=20 world's economy at risk.=20 If there are any threats which is likely to be waged against the operation= =20 of LISP, then it is not acceptable to declare these threats as out of scope= , unless we are also going to agree that LISP must not be deployed on a wide scale. As such, as currently written the threats document is not ready for publication.=20 Sincerely,=20 Ross -----Original Message----- From: Damien Saucez [mailto:damien.saucez@gmail.com]=20 Sent: Monday, May 19, 2014 6:26 PM To: Ross Callon Cc: Joel M. Halpern; LISP mailing list list; Luigi Iannone Subject: Re: [lisp] Restarting last call on LISP threats Dear Ross, Thank you for your time. Before detailed comments below, we have to remind that the objective of this document is to identify global threats potentially introduced by LISP w.r.t. what exists today in the legacy Internet. The problem space is out of the scope of the document. comments inline. On 12 May 2014, at 19:11, Ross Callon wrote: > Thanks Joel; >=20 > I think that draft-ietf-lisp-threats-09.txt is a start towards a threats = document, but that it has serious omissions and needs more work before bein= g progressed. Here are some specific comments:=20 >=20 >=20 > Section 2 (On-path Attackers), first paragraph:=20 >=20 > On-path attackers are attackers that are able to capture and modify > all the packets exchanged between an Ingress Tunnel Router (ITR) and > an Egress Tunnel Router (ETR). To cope with such an attacker, > cryptographic techniques such as those used by IPSec ([RFC4301]) are > required. As with IP, LISP relies on higher layer cryptography to > secure packet payloads from on path attacks, so this document does > not consider on-path attackers. >=20 > To me an on-path attacker is one which is on the data path. Such an attac= ker might attack the contents of the data packet. In this case the paragrap= h seems mostly correct to me: You encrypt the contents if you don't want so= meone on the path to the destination to look at the contents. However, as i= s discussed later in the document, LISP allows systems which are not in the= normal physical path, through a gleaning attack, to inject themselves into= the data path. This could be applied to allow attacker's systems to inject= themselves into the path of the key management protocol. This implies that= a legitimate user could get keys supplied by an attacker, just as easily a= s it could get keys supplied by a legitimate Internet site. If you are prop= osing that end to end encryption is the solution to on path attackers then = you need to understand the implications of LISP on the operation of the pro= tocol needed for key management to support end to end encryption.=20 The paragraph you are citing end with this document does _not_ consider on-path attackers.. While you remarks are generally valuable they do not apply here, the document is not proposing anything, it i just stating what is _not_ considered. >=20 > Also, you should mention in this section that a gleaning attack would all= ow at least in the short term for an attacker to become temporarily on-path= even if they are not on what should be the normal path to the destination.= =20 >=20 The definition we give about on-path attacker includes your sub-category. It does not matter where you attacker physically is. If it is able to capture and modify packets then it is on-path (does not matter if physical shorter or not). > An on-path attacker might choose to only change something about the LISP = handling details, such as exploding the map cache or redirecting a user to = a different site. Some of this is mentioned later in the document. One thin= g that is not mentioned: Suppose that the encapsulated packet is encrypted.= The on-path attacker could however see the LISP header, and thus could cha= nge the nonce, or add a nonce, or reply to the nonce, change versioning inf= ormation,... Are you proposing that the LISP header be encrypted also? If = so, where is this specified and what does it do to forwarding performance i= n the xTR?=20 >=20 The document is just an analysis, hence your question, while valid, is outside the scope of this document. >=20 > Section 4.3.1, second paragraph, third sentence:=20 >=20 > This is not different from today's > Internet where a spoofing off-path attacker may inject data packets > in any flow. >=20 > In terms of injecting traffic that the end system receives and acts upon,= I believe that this sentence is entirely true. However, in terms of the ef= fect on the router's control plane, and particularly the operation of xTR's= , this sentence is not true. Today there is very little that a spoofing att= acker that is outside of a particular service provider can do to exercise t= he control plane of that provider's routers. This is important and intentio= nal (see DOS discussion below).=20 >=20 >=20 The section actually does not enter in any discussion about quantifying the damages. So the second part of your comment is correct if it does apply to section 4.3.1. The first half of your comment is, however, unfounded. Section 4.3.1 is about attacks _not_ leveraging on LISP header, so from this side it is exactly the same case like any other IP spoofed packet. In particular since LISP header is not used, xTR functions are not actually attacked. > Minor nit, next sentence: >=20 > A non-spoofing off-path attacker (NSA)... >=20 > Given recent events, I think that "NSA" is an unfortunate acronym to use = here. How about NSOA?=20 >=20 >=20 This can be fixed before pushing the document to the IESG. > Section 4.3.1.1 (Gleaning Attacks), last paragraph: >=20 > By itself, an attack made solely using gleaning cannot last long, > however it should be noted that with current network capacities, a > large amount of packets might be exchanged during even a small > fraction of time. >=20 > The amount of damage that might be caused by this may depend upon what ha= ppens to be exchanged in that "short amount of time". For example, the init= ial handshake between sites (at the application layer) could include sign i= n information (account names and passwords), on the basis that this is the = sort of information that needs to be exchanged at the beginning of, for exa= mple, financial transactions. My understanding is that for Internet commerc= e, it is normal for users to be redirected to a different site to enter cre= dit card information. This appears to constitute a "new session" (or at lea= st may be to an entirely different location) and therefore the entire credi= t card exchange could occur in a small period of time. I think it would be = worth mentioning here that the sensitivity of the information that could be= exchanged during this "short amount of time" is not known, and could poten= tially be serious.=20 Exchanging critical information (e.g. password) in clear means that you have a serious problem, but not at the network layer. Also, the situation with LISP would not be worse than without LISP. >=20 > Also, depending upon how long xTR's are willing to store gleaned informat= ion (before the map request comes back), the time that a user is misdirecte= d due to a gleaning attack might be extended by coordinating a DDOS attack = with the gleaning attack. For example, an attacker may send packets to a ve= ry large number of sites, with a source EID which is from a major stock bro= ker or bank and an RLOC from the attacker's captive servers. The many sites= glean the EID to RLOC mapping from the arriving packets. Each pretty much = simultaneously initiates an EID lookup (to verify the EID to RLOC mapping).= This creates a DOS attack on the control plane of the mapping function sup= porting that stock broker or bank. This implies that the responses are goin= g to be delayed (and could be greatly delayed), which allows the incorrect = mappings to last longer than they otherwise would. This allows any systems = that actually happen to be trying to connect to that stock or banking site = to be redirected to the a > ttacker's site. The attacker then becomes a man in the middle and can for= example can obtain the password and account information for users. =20 >=20 >=20 Such a scenario would require a lot of synchronisation. Anyway, our opinion is that the current text is stating exactly the same thing you describe just in a succinct way. As a reminder, the present document studies LISP in a public network deployment. > Last paragraph of section 4.3.2.2:=20 >=20 > If the size of the Map-Request > message is larger than the size of the smallest LISP-encapsulated > packet that could trigger such a message, this could lead to > amplification attacks (see Section 4.4.1) so that more bandwidth is > consumed on the target than the bandwidth necessary at the attacker > side. >=20 > The size of the packet is not the only issue. If the amount of processing= required to send a map-request and deal with the reply is greater than the= amount of processing that is required to send a packet that triggers such = a request, then this could also result in an amplification attack. In princ= iple it would seem that sending out a large number of packets to trigger su= ch a request would be relatively straightforward (for example the attacker = might be sending out many packets only incrementing the EID in order to att= ack the ITR that will need to generate many map requests). We may note that= for many systems, particularly very high speed routers (which might exist = for example as PE routers connecting very large enterprise customers), the = control plane may be several orders of magnitude slower than the data plane= , so that an attack that requires response from the router's control plane = would be much more serious than an attack of the same size that can be hand= led in the data plane. I=20 > will say more about this in my comments below regarding DOS attacks.=20 >=20 >=20 Your first point can be easily fixed by substituting the word bandwidth with bandwidth and/or processing or "resource" Your statement on the speed difference between control and data plane is true and is a general observation not limited to LISP. Note that one of the advantages of having the Map-Server/Map-Resolver elements in the LISPa architecture is exactly to avoid situations you are describing. > Section 4.3.2.3, third paragraph (right after the bullets):=20 >=20 > The first type of packet should not cause any major problem to ITRs. > As the reachability test uses a 24 bits nonce, it is unlikely that an > off-path attacker could send a single packet that causes an ITR to > believe that the ETR it is testing is reachable while in reality it > is not reachable. To increase the success likelihood of such attack, > the attacker should create a massive amount of packets carrying all > possible nonce values. >=20 > However, this could be a problem if there are on-path attackers, since th= ey will see the nonce. They could insert nonce's where none are present, re= quiring a response from the ETR. Given that the control plane of very high = speed PE routers may be much slower than the data plane, this could cause a= relatively moderate data stream that the data plane or the PE could easily= handle to turn into a control plane attack that the control plane of a PE = router could not handle. Also, the on-path attacker could see the nonce's a= nd respond "correctly" (or in a way that the ITR that sent the nonce *think= s* is correct), thereby "verifying" connectivity when none is present. You = dismissed on-path attacks earlier in the document on the basis that the use= r data could be encrypted, but these are examples of on-path attacks that w= ould be on the LISP header and operation, and not on the user data.=20 It is clearly stated at the beginning of the document that on-path attacks are out of the scope of the document. Also, Sec. 2 does not limit cryptography technique to the payload, actually section 2 makes the distinction saying: 1) "To cope with such an attacker, cryptographic techniques such as those used by IPSec ([RFC4301 ]) are required." which is reported to any form of packet manipulation and 2) "As with IP, LISP relies on higher layer cryptography to secure packet payloads from on path attacks, so this document does not consider on-path attackers." which is related to attacks targeting the payload. >=20 >=20 > Section 5.2 (Denial of Service): >=20 > You need to mention here the relative difference in speed between the dat= a plane and the control plane of high speed routers. For example, there are= plenty of examples currently widely deployed of routers which can handle a= few terabits of data in the data plane. These routers might typically have= gigabit Ethernet links to the control processor, but I doubt that any of t= hem could handle Map-Requests coming in at line rate at a gigabit. Thus the= ratio between the speed of the control plane the speed of the data plane i= s significantly greater than 1000. I understand that many PE routers have s= lower data planes (and the CE "wireless router" that sits in each of our ho= mes is of course a lot slower than this), but large data centers or large e= nterprise sites could very well be connected to their service provider via = a few very high speed PE routers. Therefore an attack that would be trivial= to handle in the data plane (say, a few gigabits) could overwhelm the cont= rol plane.=20 >=20 You are absolutely right, but why this is specific to LISP? It is not specific to LISP, so there is no reason to discuss such an issue in this document. > Gleaning allows incoming packets to create map requests, which allows a d= ata plane attack to turn into a control plane attack. Given the difference = in speeds between the data plane and the control plane, this makes it much = easier to create an effective DOS attack.=20 >=20 RFC6830 already considered rate limiting fo this very reason. >=20 > Section 8 (Security Considerations).=20 >=20 > I am pleased that you removed the sentence from section 1 of the previous= (-08) draft that read: "As a result of the performed analysis, the docume= nt discusses the severity of the threats and proposes recommendations to re= ach the same level of security in LISP than in Internet today (e.g., withou= t LISP)". This sentence was not actually correct. However, in looking throu= gh the document and in thinking about the implications (see the rest of thi= s email) it is quite clear that the security of an Internet using LISP woul= d be significantly less than the current Internet (at least if you assume t= hat there is *any* security at all in the current Internet). I am thinking = that there should be a sentence at the end of section 8 to the effect that = "At the current time it appears that LISP would have significant security i= mplications if deployed on an Internet-wide scale". >=20 >=20 Such sentence would not represent the discussions that took place in the LISP WG in the last four years. The arguments that you raised in the previous part of this mail are mainly not LISP-specific, while the experience gathered in the last years show that LISP is not worst that what we have today (and actually research work out there shows that it can even be helpful to use LISP) > Finally, two items left out: >=20 > I don't see any discussion on the effect of LISP on firewalls. I am assum= ing that pretty much all currently deployed firewalls are not able to look = past a LISP header to inspect the contents of packets. At a minimum, this w= ould seem to imply that LISP will need to be deployed toward the Internet c= ore from the current firewalls, so that the firewalls can be looking at nor= mal (unchanged) IP packets. >=20 >=20 Deployment model is out of the scope of this document and the problem is not specific to LISP. > There is another issue which might belong in the section on privacy: In t= he Internet today if you want to attack a network with prefix aa.bb/16, and= you see this advertisement in the BGP routes, you can pick a random addres= s and send a packet and see if anything happens. You get little feedback. W= ith LISP you can send a map request to a random address in the block and ge= t back a map reply. This gives you an RLOC which is in general the actual I= P address of a real PE or CE router. Of course you can repeat this across t= he entire /16, or even the Internet (given sufficient time and traffic), an= d get something close to a complete list of LISP xTRs. This implies that if= service providers implement LISP on PE routers, then they will be exposing= the identity of their PE routers to worldwide inspection. Given the number= of PE routers in the world (obviously much larger than the number of servi= ce providers, and given PA address aggregation probably larger than the num= ber of routes that show u > p in the BGP routing table) we should expect that there are lots of PE ro= uters that have not been carefully secured, and exposing their existence to= open worldwide easy discovery would likely open the door to a number of at= tacks that involve compromise of PE routers. Of course if LISP is deployed = on CE routers then their RLOC would similarly be exposed.=20 >=20 If routers are not correctly secured, there is no problem linked to LISP as today it is already possible to discover the IP address of theses routers thanks to various techniques. Moreover, section 6 already clearly states that privacy is not discussed in the document but that the attacks presented in the document can potentially play a role in privacy threats. Regards, The authors of the threats document. > Thanks, Ross >=20 > -----Original Message----- > From: lisp [mailto:lisp-bounces@ietf.org] On Behalf Of Joel M. Halpern > Sent: Friday, May 09, 2014 11:54 AM > To: lisp@ietf.org > Subject: [lisp] Restarting last call on LISP threats >=20 > Sorry for the delay getting this out. > This email starts a new (and hopefully final) last call on=20 > draft-ietf-lisp-threats, version 9: > http://datatracker.ietf.org/doc/draft-ietf-lisp-threats/ >=20 > The last call will end in two weeks, close of business 23-May-2014. >=20 > Thank you, > Joel >=20 > _______________________________________________ > lisp mailing list > lisp@ietf.org > https://www.ietf.org/mailman/listinfo/lisp >=20 > _______________________________________________ > lisp mailing list > lisp@ietf.org > https://www.ietf.org/mailman/listinfo/lisp From nobody Wed May 21 08:40:49 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 90C411A03DD for ; Wed, 21 May 2014 08:40:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.601 X-Spam-Level: X-Spam-Status: No, score=-102.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZU5PVgULz63n for ; Wed, 21 May 2014 08:40:45 -0700 (PDT) Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2lp0204.outbound.protection.outlook.com [207.46.163.204]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 028D61A0135 for ; Wed, 21 May 2014 08:40:44 -0700 (PDT) Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB444.namprd05.prod.outlook.com (10.141.73.140) with Microsoft SMTP Server (TLS) id 15.0.944.11; Wed, 21 May 2014 15:40:42 +0000 Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) with mapi id 15.00.0944.000; Wed, 21 May 2014 15:40:42 +0000 From: Ronald Bonica To: Dino Farinacci Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEIABfmkAgAefyVA= Date: Wed, 21 May 2014 15:40:41 +0000 Message-ID: References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.12] x-forefront-prvs: 0218A015FA x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(189002)(199002)(51704005)(87936001)(85852003)(101416001)(2656002)(99396002)(74662001)(74502001)(76576001)(83072002)(21056001)(31966008)(50986999)(99286001)(33646001)(81342001)(74316001)(86362001)(66066001)(54356999)(4396001)(80022001)(76176999)(1411001)(76482001)(81542001)(79102001)(64706001)(77982001)(20776003)(92566001)(46102001)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO1PR05MB444; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/eny07rBvBSYvYTximpJ72Qd__ig Cc: Roger Jorgensen , "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 May 2014 15:40:47 -0000 Dino, I don't understand your response. So, I will ask the question another way. Imagine a scenario in which a victim XTR and an attacker are attached to th= e global Internet. The attacker is neither an XTR nor contained by a LISP s= ite. The attacker sends a flow of crafted packets to the victim XTR. Each packet= is a well-formed LISP data packet. It contains: - an outer IP header (LOC->LOC) - a UDP header - a LISP Header - an IP header (EID->EID) - payload Each packet contains control plane information that is new to the victim XT= R. For example, the victim XTR has no mapping information regarding either = the source LOC or source EID prefix. Rather than gleaning this mapping info= rmation from the crafted packet, the victim XTR sends a verifying MAP-REQUE= ST to the mapping system. Assume that the attack flow is large (N packets per second). Assume also th= at the XTRs rate limit for MAP-REQUEST messages is less than N packets per = second. Has the attack not effectively DoS'd the victim XTR? To make this attack work, every packet in the attack flow may need to have = a unique, spoofed, source LOC. = Ron > > The attacker can launch a DoS attack against an XTRs control plan by > sending a barrage of crafted packets to the victim XTR. Each crafted pack= et > cause the victim XTR to send a verifying MAP-REQUEST to the mapping > system. The attack stream may be so large that it causes the victim XTR = to > exceed the rate limit for MAP-REQUEST messages. >=20 > You can trust sources less if they ARE NOT in the mapping database. That = is, if > you are a LISP site, you have more tools be verify trust. >=20 > Dino >=20 From nobody Wed May 21 08:41:50 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 371FE1A0847 for ; Wed, 21 May 2014 08:41:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cK1seIsCN-DA for ; Wed, 21 May 2014 08:41:36 -0700 (PDT) Received: from mail-ee0-x22b.google.com (mail-ee0-x22b.google.com [IPv6:2a00:1450:4013:c00::22b]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 632D31A0445 for ; Wed, 21 May 2014 08:41:32 -0700 (PDT) Received: by mail-ee0-f43.google.com with SMTP id d17so1728776eek.2 for ; Wed, 21 May 2014 08:41:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=references:mime-version:in-reply-to:content-type :content-transfer-encoding:message-id:cc:from:subject:date:to; bh=ZDdXggYILFrwRC5kBwGzm6mMMyx2RQr+/l7FENOB8Zw=; b=NRDESC9kqVvGak2H0yV4w9oPay6hjOEp6n7I1XJviGnKtaTP9MOnbA7tDpUFl2MOma 2UziPCxvu3QUtfb4DaEkfY1LWe3u5FyUNw+xd+FzFmkMeIBILfWnOQwD03MXGHu2yKVq 33FOMbW0xy84pGyjaenvQYUbhZ3WEHRJeOoZUXx9grHyKrYsGpTjHK870AZPeJeqz+QZ EBLcV9IQcT5srg89ewenzwjBWt1AGm2LvsMKTlSXy0b9gVU8K1s3yOFAw/sJTODG/DI7 1/7GE8GdqgGNx/o5WXlm8w5NjaPasMYSQ05y5WBa9lh7EK3SFV53QHo8JMpBw91R1Fb9 BMBQ== X-Received: by 10.14.178.195 with SMTP id f43mr5101137eem.58.1400686890352; Wed, 21 May 2014 08:41:30 -0700 (PDT) Received: from [10.226.144.78] (80-254-69-14.dynamic.monzoon.net. [80.254.69.14]) by mx.google.com with ESMTPSA id v47sm12760186eel.22.2014.05.21.08.41.29 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 21 May 2014 08:41:29 -0700 (PDT) References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <082ae04715e5432c9bf5b2d9fd00d568@CO2PR05MB636.namprd05.prod.outlook.com> Mime-Version: 1.0 (1.0) In-Reply-To: <082ae04715e5432c9bf5b2d9fd00d568@CO2PR05MB636.namprd05.prod.outlook.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Message-Id: <975D55AB-0489-4CA7-B690-0A7A45EF5588@gmail.com> X-Mailer: iPod touch Mail (11D201) From: Damien Saucez Date: Wed, 21 May 2014 17:41:25 +0200 To: Ross Callon Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/qjbbLUZc3GrfrjISTlnD_w-i3vs Cc: LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 May 2014 15:41:44 -0000 Hello, I fully agree with your argument that security breach could have impact at l= arge scale.=20 However we have to consider this document at the light of what is in the cha= rter. As a matter of fact the charter states lisp as a mean to make the inte= rnet more scalable. =46rom that point if view I think lisp is very well desi= gned. =46rom this angle, the document only aim to show if the proposition ma= kes security worst, same, or better than the system lisp is supposed to repl= ace: the legacy internet. For that I think the document is complete as it fo= cuses on what are the risks introduced by the new architecture, ignoring pro= blems that are not lisp specific.=20 Despite this, we see many activities around high security features leveragin= g lisp. Unfortunately these propositions are still out if the scope if the c= harter as security improvement is not part if current charter. For these pro= position to become part of lisp we first have to finish what the charter is a= sking us. Then we will be able to discuss whether or not we want lisp to be a= lso a solution for security issues currently in the internet. Thank you, Damien Saucez=20 > On 21 May 2014, at 17:16, Ross Callon wrote: >=20 > I will respond to your email in detail (in a separate email), but I also=20= > have one higher level meta-comment which is important which I think that=20= > we should discuss first.=20 >=20 > Specifically, we need to remember what LISP is proposed to do. LISP=20 > has been proposed as a new routing and addressing architecture for the=20 > Internet. If we believe this goal is realistic, and if we believe that=20 > LISP could actually end up being deployed as the routing and addressing=20= > architecture for the Internet, then the Internet could someday be entirely= =20 > dependent upon LISP actually working and actually being secure when=20 > deployed at scale.=20 >=20 > The Internet has been described as the control plane for the world. The=20= > Internet is of enormous importance for the world's economy (and all of=20 > our jobs, and millions of others). IT HAS TO WORK. >=20 > As such, any attack that might have the potential of disrupting the=20 > operation of LISP, or that can be made worse by LISP, MUST be taken=20 > seriously. If you declare some attacks as "outside of the scope of=20 > LISP threats document" then either you are saying that the LISP WG is=20 > not serious about widespread deployment of LISP, or you are putting the=20= > world's economy at risk.=20 >=20 > If there are any threats which is likely to be waged against the operation= =20 > of LISP, then it is not acceptable to declare these threats as out of scop= e, > unless we are also going to agree that LISP must not be deployed on a wide= > scale. As such, as currently written the threats document is not ready for= > publication.=20 >=20 > Sincerely,=20 > Ross >=20 > -----Original Message----- > From: Damien Saucez [mailto:damien.saucez@gmail.com]=20 > Sent: Monday, May 19, 2014 6:26 PM > To: Ross Callon > Cc: Joel M. Halpern; LISP mailing list list; Luigi Iannone > Subject: Re: [lisp] Restarting last call on LISP threats >=20 > Dear Ross, >=20 > Thank you for your time. >=20 > Before detailed comments below, we have to remind that the objective > of this document is to identify global threats potentially introduced > by LISP w.r.t. what exists today in the legacy Internet. The problem > space is out of the scope of the document. >=20 > comments inline. >=20 >> On 12 May 2014, at 19:11, Ross Callon wrote: >>=20 >> Thanks Joel; >>=20 >> I think that draft-ietf-lisp-threats-09.txt is a start towards a threats d= ocument, but that it has serious omissions and needs more work before being p= rogressed. Here are some specific comments:=20 >>=20 >>=20 >> Section 2 (On-path Attackers), first paragraph:=20 >>=20 >> On-path attackers are attackers that are able to capture and modify >> all the packets exchanged between an Ingress Tunnel Router (ITR) and >> an Egress Tunnel Router (ETR). To cope with such an attacker, >> cryptographic techniques such as those used by IPSec ([RFC4301]) are >> required. As with IP, LISP relies on higher layer cryptography to >> secure packet payloads from on path attacks, so this document does >> not consider on-path attackers. >>=20 >> To me an on-path attacker is one which is on the data path. Such an attac= ker might attack the contents of the data packet. In this case the paragraph= seems mostly correct to me: You encrypt the contents if you don't want some= one on the path to the destination to look at the contents. However, as is d= iscussed later in the document, LISP allows systems which are not in the nor= mal physical path, through a gleaning attack, to inject themselves into the d= ata path. This could be applied to allow attacker's systems to inject themse= lves into the path of the key management protocol. This implies that a legit= imate user could get keys supplied by an attacker, just as easily as it coul= d get keys supplied by a legitimate Internet site. If you are proposing that= end to end encryption is the solution to on path attackers then you need to= understand the implications of LISP on the operation of the protocol needed= for key management to support end to end encryption. >=20 > The paragraph you are citing end with this document does _not_ > consider on-path attackers.. While you remarks are generally valuable > they do not apply here, the document is not proposing anything, it i > just stating what is _not_ considered. >=20 >=20 >=20 >=20 >>=20 >> Also, you should mention in this section that a gleaning attack would all= ow at least in the short term for an attacker to become temporarily on-path e= ven if they are not on what should be the normal path to the destination. > The definition we give about on-path attacker includes your > sub-category. It does not matter where you attacker physically is. > If it is able to capture and modify packets then it is on-path (does > not matter if physical shorter or not). >=20 >=20 >> An on-path attacker might choose to only change something about the LISP h= andling details, such as exploding the map cache or redirecting a user to a d= ifferent site. Some of this is mentioned later in the document. One thing th= at is not mentioned: Suppose that the encapsulated packet is encrypted. The o= n-path attacker could however see the LISP header, and thus could change the= nonce, or add a nonce, or reply to the nonce, change versioning information= ,... Are you proposing that the LISP header be encrypted also? If so, where= is this specified and what does it do to forwarding performance in the xTR?= >=20 > The document is just an analysis, hence your question, while valid, is > outside the scope of this document. >>=20 >> Section 4.3.1, second paragraph, third sentence:=20 >>=20 >> This is not different from today's >> Internet where a spoofing off-path attacker may inject data packets >> in any flow. >>=20 >> In terms of injecting traffic that the end system receives and acts upon,= I believe that this sentence is entirely true. However, in terms of the eff= ect on the router's control plane, and particularly the operation of xTR's, t= his sentence is not true. Today there is very little that a spoofing attacke= r that is outside of a particular service provider can do to exercise the co= ntrol plane of that provider's routers. This is important and intentional (s= ee DOS discussion below). > The section actually does not enter in any discussion about > quantifying the damages. So the second part of your comment is > correct if it does apply to section 4.3.1. >=20 > The first half of your comment is, however, unfounded. Section 4.3.1 > is about attacks _not_ leveraging on LISP header, so from this side it > is exactly the same case like any other IP spoofed packet. In > particular since LISP header is not used, xTR functions are not > actually attacked. >=20 >> Minor nit, next sentence: >>=20 >> A non-spoofing off-path attacker (NSA)... >>=20 >> Given recent events, I think that "NSA" is an unfortunate acronym to use h= ere. How about NSOA? >=20 > This can be fixed before pushing the document to the IESG. >=20 >=20 >> Section 4.3.1.1 (Gleaning Attacks), last paragraph: >>=20 >> By itself, an attack made solely using gleaning cannot last long, >> however it should be noted that with current network capacities, a >> large amount of packets might be exchanged during even a small >> fraction of time. >>=20 >> The amount of damage that might be caused by this may depend upon what ha= ppens to be exchanged in that "short amount of time". For example, the initi= al handshake between sites (at the application layer) could include sign in i= nformation (account names and passwords), on the basis that this is the sort= of information that needs to be exchanged at the beginning of, for example,= financial transactions. My understanding is that for Internet commerce, it i= s normal for users to be redirected to a different site to enter credit card= information. This appears to constitute a "new session" (or at least may be= to an entirely different location) and therefore the entire credit card exc= hange could occur in a small period of time. I think it would be worth menti= oning here that the sensitivity of the information that could be exchanged d= uring this "short amount of time" is not known, and could potentially be ser= ious. >=20 > Exchanging critical information (e.g. password) in clear means that > you have a serious problem, but not at the network layer. Also, the > situation with LISP would not be worse than without LISP. >=20 >>=20 >> Also, depending upon how long xTR's are willing to store gleaned informat= ion (before the map request comes back), the time that a user is misdirected= due to a gleaning attack might be extended by coordinating a DDOS attack wi= th the gleaning attack. For example, an attacker may send packets to a very l= arge number of sites, with a source EID which is from a major stock broker o= r bank and an RLOC from the attacker's captive servers. The many sites glean= the EID to RLOC mapping from the arriving packets. Each pretty much simulta= neously initiates an EID lookup (to verify the EID to RLOC mapping). This cr= eates a DOS attack on the control plane of the mapping function supporting t= hat stock broker or bank. This implies that the responses are going to be de= layed (and could be greatly delayed), which allows the incorrect mappings to= last longer than they otherwise would. This allows any systems that actuall= y happen to be trying to connect to that stock or banking site to be redirec= ted to the a >> ttacker's site. The attacker then becomes a man in the middle and can for= example can obtain the password and account information for users. =20 >=20 > Such a scenario would require a lot of synchronisation. Anyway, our > opinion is that the current text is stating exactly the same thing you > describe just in a succinct way. >=20 > As a reminder, the present document studies LISP in a public network > deployment. >=20 >=20 >=20 >> Last paragraph of section 4.3.2.2:=20 >>=20 >> If the size of the Map-Request >> message is larger than the size of the smallest LISP-encapsulated >> packet that could trigger such a message, this could lead to >> amplification attacks (see Section 4.4.1) so that more bandwidth is >> consumed on the target than the bandwidth necessary at the attacker >> side. >>=20 >> The size of the packet is not the only issue. If the amount of processing= required to send a map-request and deal with the reply is greater than the a= mount of processing that is required to send a packet that triggers such a r= equest, then this could also result in an amplification attack. In principle= it would seem that sending out a large number of packets to trigger such a r= equest would be relatively straightforward (for example the attacker might b= e sending out many packets only incrementing the EID in order to attack the I= TR that will need to generate many map requests). We may note that for many s= ystems, particularly very high speed routers (which might exist for example a= s PE routers connecting very large enterprise customers), the control plane m= ay be several orders of magnitude slower than the data plane, so that an att= ack that requires response from the router's control plane would be much mor= e serious than an attack of the same size that can be handled in the data pl= ane. I=20 >> will say more about this in my comments below regarding DOS attacks. >=20 > Your first point can be easily fixed by substituting the word > bandwidth with bandwidth and/or processing or "resource" >=20 > Your statement on the speed difference between control and data plane > is true and is a general observation not limited to LISP. Note that > one of the advantages of having the Map-Server/Map-Resolver elements > in the LISPa architecture is exactly to avoid situations you are > describing. >=20 >> Section 4.3.2.3, third paragraph (right after the bullets):=20 >>=20 >> The first type of packet should not cause any major problem to ITRs. >> As the reachability test uses a 24 bits nonce, it is unlikely that an >> off-path attacker could send a single packet that causes an ITR to >> believe that the ETR it is testing is reachable while in reality it >> is not reachable. To increase the success likelihood of such attack, >> the attacker should create a massive amount of packets carrying all >> possible nonce values. >>=20 >> However, this could be a problem if there are on-path attackers, since th= ey will see the nonce. They could insert nonce's where none are present, req= uiring a response from the ETR. Given that the control plane of very high sp= eed PE routers may be much slower than the data plane, this could cause a re= latively moderate data stream that the data plane or the PE could easily han= dle to turn into a control plane attack that the control plane of a PE route= r could not handle. Also, the on-path attacker could see the nonce's and res= pond "correctly" (or in a way that the ITR that sent the nonce *thinks* is c= orrect), thereby "verifying" connectivity when none is present. You dismisse= d on-path attacks earlier in the document on the basis that the user data co= uld be encrypted, but these are examples of on-path attacks that would be on= the LISP header and operation, and not on the user data. >=20 > It is clearly stated at the beginning of the document that on-path > attacks are out of the scope of the document. Also, Sec. 2 does not > limit cryptography technique to the payload, actually section 2 makes > the distinction saying: >=20 > 1) > "To cope with such an attacker, cryptographic techniques such as > those used by IPSec ([RFC4301 ]) are required." >=20 > which is reported to any form of packet manipulation >=20 > and 2) > "As with IP, LISP relies on higher layer cryptography to secure packet > payloads from on path attacks, so this document does not consider > on-path attackers." >=20 > which is related to attacks targeting the payload. >=20 >=20 >>=20 >>=20 >> Section 5.2 (Denial of Service): >>=20 >> You need to mention here the relative difference in speed between the dat= a plane and the control plane of high speed routers. For example, there are p= lenty of examples currently widely deployed of routers which can handle a fe= w terabits of data in the data plane. These routers might typically have gig= abit Ethernet links to the control processor, but I doubt that any of them c= ould handle Map-Requests coming in at line rate at a gigabit. Thus the ratio= between the speed of the control plane the speed of the data plane is signi= ficantly greater than 1000. I understand that many PE routers have slower da= ta planes (and the CE "wireless router" that sits in each of our homes is of= course a lot slower than this), but large data centers or large enterprise s= ites could very well be connected to their service provider via a few very h= igh speed PE routers. Therefore an attack that would be trivial to handle in= the data plane (say, a few gigabits) could overwhelm the control plane. >=20 > You are absolutely right, but why this is specific to LISP? It is not > specific to LISP, so there is no reason to discuss such an issue in > this document. >=20 >> Gleaning allows incoming packets to create map requests, which allows a d= ata plane attack to turn into a control plane attack. Given the difference i= n speeds between the data plane and the control plane, this makes it much ea= sier to create an effective DOS attack. >=20 > RFC6830 already considered rate limiting fo this very reason. >=20 >>=20 >> Section 8 (Security Considerations).=20 >>=20 >> I am pleased that you removed the sentence from section 1 of the previous= (-08) draft that read: "As a result of the performed analysis, the documen= t discusses the severity of the threats and proposes recommendations to reac= h the same level of security in LISP than in Internet today (e.g., without L= ISP)". This sentence was not actually correct. However, in looking through t= he document and in thinking about the implications (see the rest of this ema= il) it is quite clear that the security of an Internet using LISP would be s= ignificantly less than the current Internet (at least if you assume that the= re is *any* security at all in the current Internet). I am thinking that the= re should be a sentence at the end of section 8 to the effect that "At the c= urrent time it appears that LISP would have significant security implication= s if deployed on an Internet-wide scale". >=20 >=20 > Such sentence would not represent the discussions that took place in > the LISP WG in the last four years. >=20 > The arguments that you raised in the previous part of this mail are > mainly not LISP-specific, while the experience gathered in the last > years show that LISP is not worst that what we have today (and > actually research work out there shows that it can even be helpful to > use LISP) >=20 >=20 >> Finally, two items left out: >>=20 >> I don't see any discussion on the effect of LISP on firewalls. I am assum= ing that pretty much all currently deployed firewalls are not able to look p= ast a LISP header to inspect the contents of packets. At a minimum, this wou= ld seem to imply that LISP will need to be deployed toward the Internet core= from the current firewalls, so that the firewalls can be looking at normal (= unchanged) IP packets. >=20 > Deployment model is out of the scope of this document and the problem > is not specific to LISP. >=20 >=20 >> There is another issue which might belong in the section on privacy: In t= he Internet today if you want to attack a network with prefix aa.bb/16, and y= ou see this advertisement in the BGP routes, you can pick a random address a= nd send a packet and see if anything happens. You get little feedback. With L= ISP you can send a map request to a random address in the block and get back= a map reply. This gives you an RLOC which is in general the actual IP addre= ss of a real PE or CE router. Of course you can repeat this across the entir= e /16, or even the Internet (given sufficient time and traffic), and get som= ething close to a complete list of LISP xTRs. This implies that if service p= roviders implement LISP on PE routers, then they will be exposing the identi= ty of their PE routers to worldwide inspection. Given the number of PE route= rs in the world (obviously much larger than the number of service providers,= and given PA address aggregation probably larger than the number of routes t= hat show u >> p in the BGP routing table) we should expect that there are lots of PE ro= uters that have not been carefully secured, and exposing their existence to o= pen worldwide easy discovery would likely open the door to a number of attac= ks that involve compromise of PE routers. Of course if LISP is deployed on C= E routers then their RLOC would similarly be exposed. >=20 > If routers are not correctly secured, there is no problem linked to > LISP as today it is already possible to discover the IP address of > theses routers thanks to various techniques. Moreover, section 6 > already clearly states that privacy is not discussed in the document > but that the attacks presented in the document can potentially play a > role in privacy threats. >=20 > Regards, >=20 > The authors of the threats document. >=20 >=20 >> Thanks, Ross >>=20 >> -----Original Message----- >> From: lisp [mailto:lisp-bounces@ietf.org] On Behalf Of Joel M. Halpern >> Sent: Friday, May 09, 2014 11:54 AM >> To: lisp@ietf.org >> Subject: [lisp] Restarting last call on LISP threats >>=20 >> Sorry for the delay getting this out. >> This email starts a new (and hopefully final) last call on=20 >> draft-ietf-lisp-threats, version 9: >> http://datatracker.ietf.org/doc/draft-ietf-lisp-threats/ >>=20 >> The last call will end in two weeks, close of business 23-May-2014. >>=20 >> Thank you, >> Joel >>=20 >> _______________________________________________ >> lisp mailing list >> lisp@ietf.org >> https://www.ietf.org/mailman/listinfo/lisp >>=20 >> _______________________________________________ >> lisp mailing list >> lisp@ietf.org >> https://www.ietf.org/mailman/listinfo/lisp >=20 From nobody Wed May 21 09:45:37 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B4091A06D3 for ; Wed, 21 May 2014 09:45:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rMflaCChGJGC for ; Wed, 21 May 2014 09:45:32 -0700 (PDT) Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2lp0209.outbound.protection.outlook.com [207.46.163.209]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 070FA1A06B3 for ; Wed, 21 May 2014 09:45:31 -0700 (PDT) Received: from CO2PR05MB636.namprd05.prod.outlook.com (10.141.199.24) by CO2PR05MB633.namprd05.prod.outlook.com (10.141.199.12) with Microsoft SMTP Server (TLS) id 15.0.944.11; Wed, 21 May 2014 16:45:28 +0000 Received: from CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) by CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) with mapi id 15.00.0944.000; Wed, 21 May 2014 16:45:28 +0000 From: Ross Callon To: Damien Saucez Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58M9eFhkxJvMEaw1MEc+Ryfdps9FMJAgAt2hwCAAqNu4IAAEEmAgAAP+dA= Date: Wed, 21 May 2014 16:45:28 +0000 Message-ID: References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <082ae04715e5432c9bf5b2d9fd00d568@CO2PR05MB636.namprd05.prod.outlook.com> <975D55AB-0489-4CA7-B690-0A7A45EF5588@gmail.com> In-Reply-To: <975D55AB-0489-4CA7-B690-0A7A45EF5588@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.15] x-forefront-prvs: 0218A015FA x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(13464003)(51744003)(51704005)(24454002)(51444003)(164054003)(189002)(199002)(377454003)(74662001)(20776003)(76576001)(74502001)(77096999)(31966008)(66066001)(83072002)(79102001)(64706001)(76482001)(80022001)(46102001)(50986999)(99286001)(76176999)(54356999)(81542001)(99396002)(33646001)(81342001)(86362001)(74316001)(15975445006)(85852003)(92566001)(19580395003)(101416001)(2656002)(21056001)(551544002)(87936001)(77982001)(15202345003)(19580405001)(4396001)(24736002)(579004); DIR:OUT; SFP:; SCL:1; SRVR:CO2PR05MB633; H:CO2PR05MB636.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rcallon@juniper.net; Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/3JeeGmWJFezj3n64kHm2B9ylSq4 Cc: LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 May 2014 16:45:36 -0000 To get the charter to say "fix these security holes" we need to know what t= he security holes are. The point of the threats document is to understand w= hat threats are there, not to limit ourselves to only discuss threats that = we are already chartered to fix. I am pretty sure that a thorough and compl= ete threats document is in the charter. There were multiple items in my original comments that point to places wher= e LISP makes security worse than what we have today in the current Internet= . I could point these out again in my detailed reply to your email (which m= ight take me a couple of work days to complete, and I am off on Friday and = for the long weekend).=20 Thanks, Ross -----Original Message----- From: Damien Saucez [mailto:damien.saucez@gmail.com]=20 Sent: Wednesday, May 21, 2014 11:41 AM To: Ross Callon Cc: Joel M. Halpern; LISP mailing list list; Luigi Iannone Subject: Re: [lisp] Restarting last call on LISP threats Hello, I fully agree with your argument that security breach could have impact at = large scale.=20 However we have to consider this document at the light of what is in the ch= arter. As a matter of fact the charter states lisp as a mean to make the in= ternet more scalable. From that point if view I think lisp is very well des= igned. From this angle, the document only aim to show if the proposition ma= kes security worst, same, or better than the system lisp is supposed to rep= lace: the legacy internet. For that I think the document is complete as it = focuses on what are the risks introduced by the new architecture, ignoring = problems that are not lisp specific.=20 Despite this, we see many activities around high security features leveragi= ng lisp. Unfortunately these propositions are still out if the scope if the= charter as security improvement is not part if current charter. For these = proposition to become part of lisp we first have to finish what the charter= is asking us. Then we will be able to discuss whether or not we want lisp = to be also a solution for security issues currently in the internet. Thank you, Damien Saucez=20 > On 21 May 2014, at 17:16, Ross Callon wrote: >=20 > I will respond to your email in detail (in a separate email), but I also= =20 > have one higher level meta-comment which is important which I think that= =20 > we should discuss first.=20 >=20 > Specifically, we need to remember what LISP is proposed to do. LISP=20 > has been proposed as a new routing and addressing architecture for the=20 > Internet. If we believe this goal is realistic, and if we believe that=20 > LISP could actually end up being deployed as the routing and addressing=20 > architecture for the Internet, then the Internet could someday be entirel= y=20 > dependent upon LISP actually working and actually being secure when=20 > deployed at scale.=20 >=20 > The Internet has been described as the control plane for the world. The=20 > Internet is of enormous importance for the world's economy (and all of=20 > our jobs, and millions of others). IT HAS TO WORK. >=20 > As such, any attack that might have the potential of disrupting the=20 > operation of LISP, or that can be made worse by LISP, MUST be taken=20 > seriously. If you declare some attacks as "outside of the scope of=20 > LISP threats document" then either you are saying that the LISP WG is=20 > not serious about widespread deployment of LISP, or you are putting the=20 > world's economy at risk.=20 >=20 > If there are any threats which is likely to be waged against the operatio= n=20 > of LISP, then it is not acceptable to declare these threats as out of sco= pe, > unless we are also going to agree that LISP must not be deployed on a wid= e > scale. As such, as currently written the threats document is not ready fo= r > publication.=20 >=20 > Sincerely,=20 > Ross >=20 > -----Original Message----- > From: Damien Saucez [mailto:damien.saucez@gmail.com]=20 > Sent: Monday, May 19, 2014 6:26 PM > To: Ross Callon > Cc: Joel M. Halpern; LISP mailing list list; Luigi Iannone > Subject: Re: [lisp] Restarting last call on LISP threats >=20 > Dear Ross, >=20 > Thank you for your time. >=20 > Before detailed comments below, we have to remind that the objective > of this document is to identify global threats potentially introduced > by LISP w.r.t. what exists today in the legacy Internet. The problem > space is out of the scope of the document. >=20 > comments inline. >=20 >> On 12 May 2014, at 19:11, Ross Callon wrote: >>=20 >> Thanks Joel; >>=20 >> I think that draft-ietf-lisp-threats-09.txt is a start towards a threats= document, but that it has serious omissions and needs more work before bei= ng progressed. Here are some specific comments:=20 >>=20 >>=20 >> Section 2 (On-path Attackers), first paragraph:=20 >>=20 >> On-path attackers are attackers that are able to capture and modify >> all the packets exchanged between an Ingress Tunnel Router (ITR) and >> an Egress Tunnel Router (ETR). To cope with such an attacker, >> cryptographic techniques such as those used by IPSec ([RFC4301]) are >> required. As with IP, LISP relies on higher layer cryptography to >> secure packet payloads from on path attacks, so this document does >> not consider on-path attackers. >>=20 >> To me an on-path attacker is one which is on the data path. Such an atta= cker might attack the contents of the data packet. In this case the paragra= ph seems mostly correct to me: You encrypt the contents if you don't want s= omeone on the path to the destination to look at the contents. However, as = is discussed later in the document, LISP allows systems which are not in th= e normal physical path, through a gleaning attack, to inject themselves int= o the data path. This could be applied to allow attacker's systems to injec= t themselves into the path of the key management protocol. This implies tha= t a legitimate user could get keys supplied by an attacker, just as easily = as it could get keys supplied by a legitimate Internet site. If you are pro= posing that end to end encryption is the solution to on path attackers then= you need to understand the implications of LISP on the operation of the pr= otocol needed for key management to support end to end encryption. >=20 > The paragraph you are citing end with this document does _not_ > consider on-path attackers.. While you remarks are generally valuable > they do not apply here, the document is not proposing anything, it i > just stating what is _not_ considered. >=20 >=20 >=20 >=20 >>=20 >> Also, you should mention in this section that a gleaning attack would al= low at least in the short term for an attacker to become temporarily on-pat= h even if they are not on what should be the normal path to the destination= . > The definition we give about on-path attacker includes your > sub-category. It does not matter where you attacker physically is. > If it is able to capture and modify packets then it is on-path (does > not matter if physical shorter or not). >=20 >=20 >> An on-path attacker might choose to only change something about the LISP= handling details, such as exploding the map cache or redirecting a user to= a different site. Some of this is mentioned later in the document. One thi= ng that is not mentioned: Suppose that the encapsulated packet is encrypted= . The on-path attacker could however see the LISP header, and thus could ch= ange the nonce, or add a nonce, or reply to the nonce, change versioning in= formation,... Are you proposing that the LISP header be encrypted also? If= so, where is this specified and what does it do to forwarding performance = in the xTR? >=20 > The document is just an analysis, hence your question, while valid, is > outside the scope of this document. >>=20 >> Section 4.3.1, second paragraph, third sentence:=20 >>=20 >> This is not different from today's >> Internet where a spoofing off-path attacker may inject data packets >> in any flow. >>=20 >> In terms of injecting traffic that the end system receives and acts upon= , I believe that this sentence is entirely true. However, in terms of the e= ffect on the router's control plane, and particularly the operation of xTR'= s, this sentence is not true. Today there is very little that a spoofing at= tacker that is outside of a particular service provider can do to exercise = the control plane of that provider's routers. This is important and intenti= onal (see DOS discussion below). > The section actually does not enter in any discussion about > quantifying the damages. So the second part of your comment is > correct if it does apply to section 4.3.1. >=20 > The first half of your comment is, however, unfounded. Section 4.3.1 > is about attacks _not_ leveraging on LISP header, so from this side it > is exactly the same case like any other IP spoofed packet. In > particular since LISP header is not used, xTR functions are not > actually attacked. >=20 >> Minor nit, next sentence: >>=20 >> A non-spoofing off-path attacker (NSA)... >>=20 >> Given recent events, I think that "NSA" is an unfortunate acronym to use= here. How about NSOA? >=20 > This can be fixed before pushing the document to the IESG. >=20 >=20 >> Section 4.3.1.1 (Gleaning Attacks), last paragraph: >>=20 >> By itself, an attack made solely using gleaning cannot last long, >> however it should be noted that with current network capacities, a >> large amount of packets might be exchanged during even a small >> fraction of time. >>=20 >> The amount of damage that might be caused by this may depend upon what h= appens to be exchanged in that "short amount of time". For example, the ini= tial handshake between sites (at the application layer) could include sign = in information (account names and passwords), on the basis that this is the= sort of information that needs to be exchanged at the beginning of, for ex= ample, financial transactions. My understanding is that for Internet commer= ce, it is normal for users to be redirected to a different site to enter cr= edit card information. This appears to constitute a "new session" (or at le= ast may be to an entirely different location) and therefore the entire cred= it card exchange could occur in a small period of time. I think it would be= worth mentioning here that the sensitivity of the information that could b= e exchanged during this "short amount of time" is not known, and could pote= ntially be serious. >=20 > Exchanging critical information (e.g. password) in clear means that > you have a serious problem, but not at the network layer. Also, the > situation with LISP would not be worse than without LISP. >=20 >>=20 >> Also, depending upon how long xTR's are willing to store gleaned informa= tion (before the map request comes back), the time that a user is misdirect= ed due to a gleaning attack might be extended by coordinating a DDOS attack= with the gleaning attack. For example, an attacker may send packets to a v= ery large number of sites, with a source EID which is from a major stock br= oker or bank and an RLOC from the attacker's captive servers. The many site= s glean the EID to RLOC mapping from the arriving packets. Each pretty much= simultaneously initiates an EID lookup (to verify the EID to RLOC mapping)= . This creates a DOS attack on the control plane of the mapping function su= pporting that stock broker or bank. This implies that the responses are goi= ng to be delayed (and could be greatly delayed), which allows the incorrect= mappings to last longer than they otherwise would. This allows any systems= that actually happen to be trying to connect to that stock or banking site= to be redirected to the a >> ttacker's site. The attacker then becomes a man in the middle and can fo= r example can obtain the password and account information for users. =20 >=20 > Such a scenario would require a lot of synchronisation. Anyway, our > opinion is that the current text is stating exactly the same thing you > describe just in a succinct way. >=20 > As a reminder, the present document studies LISP in a public network > deployment. >=20 >=20 >=20 >> Last paragraph of section 4.3.2.2:=20 >>=20 >> If the size of the Map-Request >> message is larger than the size of the smallest LISP-encapsulated >> packet that could trigger such a message, this could lead to >> amplification attacks (see Section 4.4.1) so that more bandwidth is >> consumed on the target than the bandwidth necessary at the attacker >> side. >>=20 >> The size of the packet is not the only issue. If the amount of processin= g required to send a map-request and deal with the reply is greater than th= e amount of processing that is required to send a packet that triggers such= a request, then this could also result in an amplification attack. In prin= ciple it would seem that sending out a large number of packets to trigger s= uch a request would be relatively straightforward (for example the attacker= might be sending out many packets only incrementing the EID in order to at= tack the ITR that will need to generate many map requests). We may note tha= t for many systems, particularly very high speed routers (which might exist= for example as PE routers connecting very large enterprise customers), the= control plane may be several orders of magnitude slower than the data plan= e, so that an attack that requires response from the router's control plane= would be much more serious than an attack of the same size that can be han= dled in the data plane. I=20 >> will say more about this in my comments below regarding DOS attacks. >=20 > Your first point can be easily fixed by substituting the word > bandwidth with bandwidth and/or processing or "resource" >=20 > Your statement on the speed difference between control and data plane > is true and is a general observation not limited to LISP. Note that > one of the advantages of having the Map-Server/Map-Resolver elements > in the LISPa architecture is exactly to avoid situations you are > describing. >=20 >> Section 4.3.2.3, third paragraph (right after the bullets):=20 >>=20 >> The first type of packet should not cause any major problem to ITRs. >> As the reachability test uses a 24 bits nonce, it is unlikely that an >> off-path attacker could send a single packet that causes an ITR to >> believe that the ETR it is testing is reachable while in reality it >> is not reachable. To increase the success likelihood of such attack, >> the attacker should create a massive amount of packets carrying all >> possible nonce values. >>=20 >> However, this could be a problem if there are on-path attackers, since t= hey will see the nonce. They could insert nonce's where none are present, r= equiring a response from the ETR. Given that the control plane of very high= speed PE routers may be much slower than the data plane, this could cause = a relatively moderate data stream that the data plane or the PE could easil= y handle to turn into a control plane attack that the control plane of a PE= router could not handle. Also, the on-path attacker could see the nonce's = and respond "correctly" (or in a way that the ITR that sent the nonce *thin= ks* is correct), thereby "verifying" connectivity when none is present. You= dismissed on-path attacks earlier in the document on the basis that the us= er data could be encrypted, but these are examples of on-path attacks that = would be on the LISP header and operation, and not on the user data. >=20 > It is clearly stated at the beginning of the document that on-path > attacks are out of the scope of the document. Also, Sec. 2 does not > limit cryptography technique to the payload, actually section 2 makes > the distinction saying: >=20 > 1) > "To cope with such an attacker, cryptographic techniques such as > those used by IPSec ([RFC4301 ]) are required." >=20 > which is reported to any form of packet manipulation >=20 > and 2) > "As with IP, LISP relies on higher layer cryptography to secure packet > payloads from on path attacks, so this document does not consider > on-path attackers." >=20 > which is related to attacks targeting the payload. >=20 >=20 >>=20 >>=20 >> Section 5.2 (Denial of Service): >>=20 >> You need to mention here the relative difference in speed between the da= ta plane and the control plane of high speed routers. For example, there ar= e plenty of examples currently widely deployed of routers which can handle = a few terabits of data in the data plane. These routers might typically hav= e gigabit Ethernet links to the control processor, but I doubt that any of = them could handle Map-Requests coming in at line rate at a gigabit. Thus th= e ratio between the speed of the control plane the speed of the data plane = is significantly greater than 1000. I understand that many PE routers have = slower data planes (and the CE "wireless router" that sits in each of our h= omes is of course a lot slower than this), but large data centers or large = enterprise sites could very well be connected to their service provider via= a few very high speed PE routers. Therefore an attack that would be trivia= l to handle in the data plane (say, a few gigabits) could overwhelm the con= trol plane. >=20 > You are absolutely right, but why this is specific to LISP? It is not > specific to LISP, so there is no reason to discuss such an issue in > this document. >=20 >> Gleaning allows incoming packets to create map requests, which allows a = data plane attack to turn into a control plane attack. Given the difference= in speeds between the data plane and the control plane, this makes it much= easier to create an effective DOS attack. >=20 > RFC6830 already considered rate limiting fo this very reason. >=20 >>=20 >> Section 8 (Security Considerations).=20 >>=20 >> I am pleased that you removed the sentence from section 1 of the previou= s (-08) draft that read: "As a result of the performed analysis, the docum= ent discusses the severity of the threats and proposes recommendations to r= each the same level of security in LISP than in Internet today (e.g., witho= ut LISP)". This sentence was not actually correct. However, in looking thro= ugh the document and in thinking about the implications (see the rest of th= is email) it is quite clear that the security of an Internet using LISP wou= ld be significantly less than the current Internet (at least if you assume = that there is *any* security at all in the current Internet). I am thinking= that there should be a sentence at the end of section 8 to the effect that= "At the current time it appears that LISP would have significant security = implications if deployed on an Internet-wide scale". >=20 >=20 > Such sentence would not represent the discussions that took place in > the LISP WG in the last four years. >=20 > The arguments that you raised in the previous part of this mail are > mainly not LISP-specific, while the experience gathered in the last > years show that LISP is not worst that what we have today (and > actually research work out there shows that it can even be helpful to > use LISP) >=20 >=20 >> Finally, two items left out: >>=20 >> I don't see any discussion on the effect of LISP on firewalls. I am assu= ming that pretty much all currently deployed firewalls are not able to look= past a LISP header to inspect the contents of packets. At a minimum, this = would seem to imply that LISP will need to be deployed toward the Internet = core from the current firewalls, so that the firewalls can be looking at no= rmal (unchanged) IP packets. >=20 > Deployment model is out of the scope of this document and the problem > is not specific to LISP. >=20 >=20 >> There is another issue which might belong in the section on privacy: In = the Internet today if you want to attack a network with prefix aa.bb/16, an= d you see this advertisement in the BGP routes, you can pick a random addre= ss and send a packet and see if anything happens. You get little feedback. = With LISP you can send a map request to a random address in the block and g= et back a map reply. This gives you an RLOC which is in general the actual = IP address of a real PE or CE router. Of course you can repeat this across = the entire /16, or even the Internet (given sufficient time and traffic), a= nd get something close to a complete list of LISP xTRs. This implies that i= f service providers implement LISP on PE routers, then they will be exposin= g the identity of their PE routers to worldwide inspection. Given the numbe= r of PE routers in the world (obviously much larger than the number of serv= ice providers, and given PA address aggregation probably larger than the nu= mber of routes that show u >> p in the BGP routing table) we should expect that there are lots of PE r= outers that have not been carefully secured, and exposing their existence t= o open worldwide easy discovery would likely open the door to a number of a= ttacks that involve compromise of PE routers. Of course if LISP is deployed= on CE routers then their RLOC would similarly be exposed. >=20 > If routers are not correctly secured, there is no problem linked to > LISP as today it is already possible to discover the IP address of > theses routers thanks to various techniques. Moreover, section 6 > already clearly states that privacy is not discussed in the document > but that the attacks presented in the document can potentially play a > role in privacy threats. >=20 > Regards, >=20 > The authors of the threats document. >=20 >=20 >> Thanks, Ross >>=20 >> -----Original Message----- >> From: lisp [mailto:lisp-bounces@ietf.org] On Behalf Of Joel M. Halpern >> Sent: Friday, May 09, 2014 11:54 AM >> To: lisp@ietf.org >> Subject: [lisp] Restarting last call on LISP threats >>=20 >> Sorry for the delay getting this out. >> This email starts a new (and hopefully final) last call on=20 >> draft-ietf-lisp-threats, version 9: >> http://datatracker.ietf.org/doc/draft-ietf-lisp-threats/ >>=20 >> The last call will end in two weeks, close of business 23-May-2014. >>=20 >> Thank you, >> Joel >>=20 >> _______________________________________________ >> lisp mailing list >> lisp@ietf.org >> https://www.ietf.org/mailman/listinfo/lisp >>=20 >> _______________________________________________ >> lisp mailing list >> lisp@ietf.org >> https://www.ietf.org/mailman/listinfo/lisp >=20 From nobody Wed May 21 10:25:24 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 077211A089B for ; Wed, 21 May 2014 10:25:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, MIME_QP_LONG_LINE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zWCW--3g3Mkc for ; Wed, 21 May 2014 10:25:16 -0700 (PDT) Received: from mail-ee0-x236.google.com (mail-ee0-x236.google.com [IPv6:2a00:1450:4013:c00::236]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CFF681A0895 for ; Wed, 21 May 2014 10:25:15 -0700 (PDT) Received: by mail-ee0-f54.google.com with SMTP id b57so1865068eek.27 for ; Wed, 21 May 2014 10:25:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=references:mime-version:in-reply-to:content-type :content-transfer-encoding:message-id:cc:from:subject:date:to; bh=FKcsydKejmd740VHXXt/dymxIj7ZcvNP9V6215KawSs=; b=Ez6rhjXpB7OPDEKYmfas6l+syvNpNg1mKegLJj6KQlZhYuZEhSbikxoKATxo+4saKu cv4xTqCS3NIwZD7mxEkMhdR1vgngpzJmXfb0dqo6RwzkVnsAtrD4t7+qKc07pKEXqX6P MX49T1mA+KLXipiIrBNYj6HTXxZPLEaeUNF7ig4bjI64wtzTywNw5jHrl5M4BdvWSL0M AeOQtXka5EmLxLe4cxSb9yF82n4oMS0dn2HHgYyWG4yoSon1xMO4b7D+AFHyN3NerrbW 6AbBRoMqZSwF1Kk1pYbMHm32QtIiGx3uPxBKZIWkq3qXPy/srasn76aVJi2jhRvQpyk5 3EGQ== X-Received: by 10.14.101.70 with SMTP id a46mr5506940eeg.113.1400693113767; Wed, 21 May 2014 10:25:13 -0700 (PDT) Received: from [10.226.144.78] (80-254-69-14.dynamic.monzoon.net. [80.254.69.14]) by mx.google.com with ESMTPSA id b12sm13359207eeh.45.2014.05.21.10.25.12 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 21 May 2014 10:25:12 -0700 (PDT) References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <082ae04715e5432c9bf5b2d9fd00d568@CO2PR05MB636.namprd05.prod.outlook.com> <975D55AB-0489-4CA7-B690-0A7A45EF5588@gmail.com> Mime-Version: 1.0 (1.0) In-Reply-To: Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Message-Id: <006D3CFC-E8D9-4592-B753-C0456A4E18A9@gmail.com> X-Mailer: iPod touch Mail (11D201) From: Damien Saucez Date: Wed, 21 May 2014 19:25:09 +0200 To: Ross Callon Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/9-aDioXootgbqsDVxMHARF8NND4 Cc: LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 May 2014 17:25:24 -0000 For me the wg is working on "LISP for improving Internet routing=20 scalability. " not lisp to improve security.=20 There are threats of course and they are listed in the document. Actually ex= cept the on path attacks all the points you discuss are variations of the ge= neral categories and vectors listed in the document. So that unless you can g= ive one case not covered by the document, I don't see the need to argue. =20= Regarding on-path attacks the risk is at least as high on today's Internet a= nd is for me out of the scope of the draft. Nevertheless, the draft does not= say that the problem does not exist it just says that it is not a problem s= pecific to lisp. Nothing precludes to fix the problem and we can even use th= e draft to justify the necessity to solve the problem! Also it is worth to n= otice that what you consider as off path attack is already covered in the do= cument as it is a particular instance of subversion attack (see sec 5.3) whe= re the sensitive information the attacker gains access is the packet itself a= nd that can be achieved with vectors listed in 5.3.2.=20 I would like to have the feedback from the list to know if really there is a= problem with section 2.=20 Thank you,=20 Damien Saucez Ps: happy holidays :) > On 21 May 2014, at 18:45, Ross Callon wrote: >=20 > To get the charter to say "fix these security holes" we need to know what t= he security holes are. The point of the threats document is to understand wh= at threats are there, not to limit ourselves to only discuss threats that we= are already chartered to fix. I am pretty sure that a thorough and complete= threats document is in the charter. >=20 > There were multiple items in my original comments that point to places whe= re LISP makes security worse than what we have today in the current Internet= . I could point these out again in my detailed reply to your email (which mi= ght take me a couple of work days to complete, and I am off on Friday and fo= r the long weekend).=20 >=20 > Thanks, Ross >=20 > -----Original Message----- > From: Damien Saucez [mailto:damien.saucez@gmail.com]=20 > Sent: Wednesday, May 21, 2014 11:41 AM > To: Ross Callon > Cc: Joel M. Halpern; LISP mailing list list; Luigi Iannone > Subject: Re: [lisp] Restarting last call on LISP threats >=20 > Hello, >=20 > I fully agree with your argument that security breach could have impact at= large scale.=20 >=20 > However we have to consider this document at the light of what is in the c= harter. As a matter of fact the charter states lisp as a mean to make the in= ternet more scalable. =46rom that point if view I think lisp is very well de= signed. =46rom this angle, the document only aim to show if the proposition m= akes security worst, same, or better than the system lisp is supposed to rep= lace: the legacy internet. For that I think the document is complete as it f= ocuses on what are the risks introduced by the new architecture, ignoring pr= oblems that are not lisp specific.=20 >=20 > Despite this, we see many activities around high security features leverag= ing lisp. Unfortunately these propositions are still out if the scope if the= charter as security improvement is not part if current charter. For these p= roposition to become part of lisp we first have to finish what the charter i= s asking us. Then we will be able to discuss whether or not we want lisp to b= e also a solution for security issues currently in the internet. >=20 > Thank you, >=20 > Damien Saucez=20 >> On 21 May 2014, at 17:16, Ross Callon wrote: >>=20 >> I will respond to your email in detail (in a separate email), but I also=20= >> have one higher level meta-comment which is important which I think that=20= >> we should discuss first.=20 >>=20 >> Specifically, we need to remember what LISP is proposed to do. LISP=20 >> has been proposed as a new routing and addressing architecture for the=20= >> Internet. If we believe this goal is realistic, and if we believe that=20= >> LISP could actually end up being deployed as the routing and addressing=20= >> architecture for the Internet, then the Internet could someday be entirel= y=20 >> dependent upon LISP actually working and actually being secure when=20 >> deployed at scale.=20 >>=20 >> The Internet has been described as the control plane for the world. The=20= >> Internet is of enormous importance for the world's economy (and all of=20= >> our jobs, and millions of others). IT HAS TO WORK. >>=20 >> As such, any attack that might have the potential of disrupting the=20 >> operation of LISP, or that can be made worse by LISP, MUST be taken=20 >> seriously. If you declare some attacks as "outside of the scope of=20 >> LISP threats document" then either you are saying that the LISP WG is=20 >> not serious about widespread deployment of LISP, or you are putting the=20= >> world's economy at risk.=20 >>=20 >> If there are any threats which is likely to be waged against the operatio= n=20 >> of LISP, then it is not acceptable to declare these threats as out of sco= pe, >> unless we are also going to agree that LISP must not be deployed on a wid= e >> scale. As such, as currently written the threats document is not ready fo= r >> publication.=20 >>=20 >> Sincerely,=20 >> Ross >>=20 >> -----Original Message----- >> From: Damien Saucez [mailto:damien.saucez@gmail.com]=20 >> Sent: Monday, May 19, 2014 6:26 PM >> To: Ross Callon >> Cc: Joel M. Halpern; LISP mailing list list; Luigi Iannone >> Subject: Re: [lisp] Restarting last call on LISP threats >>=20 >> Dear Ross, >>=20 >> Thank you for your time. >>=20 >> Before detailed comments below, we have to remind that the objective >> of this document is to identify global threats potentially introduced >> by LISP w.r.t. what exists today in the legacy Internet. The problem >> space is out of the scope of the document. >>=20 >> comments inline. >>=20 >>> On 12 May 2014, at 19:11, Ross Callon wrote: >>>=20 >>> Thanks Joel; >>>=20 >>> I think that draft-ietf-lisp-threats-09.txt is a start towards a threats= document, but that it has serious omissions and needs more work before bein= g progressed. Here are some specific comments:=20 >>>=20 >>>=20 >>> Section 2 (On-path Attackers), first paragraph:=20 >>>=20 >>> On-path attackers are attackers that are able to capture and modify >>> all the packets exchanged between an Ingress Tunnel Router (ITR) and >>> an Egress Tunnel Router (ETR). To cope with such an attacker, >>> cryptographic techniques such as those used by IPSec ([RFC4301]) are >>> required. As with IP, LISP relies on higher layer cryptography to >>> secure packet payloads from on path attacks, so this document does >>> not consider on-path attackers. >>>=20 >>> To me an on-path attacker is one which is on the data path. Such an atta= cker might attack the contents of the data packet. In this case the paragrap= h seems mostly correct to me: You encrypt the contents if you don't want som= eone on the path to the destination to look at the contents. However, as is d= iscussed later in the document, LISP allows systems which are not in the nor= mal physical path, through a gleaning attack, to inject themselves into the d= ata path. This could be applied to allow attacker's systems to inject themse= lves into the path of the key management protocol. This implies that a legit= imate user could get keys supplied by an attacker, just as easily as it coul= d get keys supplied by a legitimate Internet site. If you are proposing that= end to end encryption is the solution to on path attackers then you need to= understand the implications of LISP on the operation of the protocol needed= for key management to support end to end encryption. >>=20 >> The paragraph you are citing end with this document does _not_ >> consider on-path attackers.. While you remarks are generally valuable >> they do not apply here, the document is not proposing anything, it i >> just stating what is _not_ considered. >>=20 >>=20 >>=20 >>=20 >>>=20 >>> Also, you should mention in this section that a gleaning attack would al= low at least in the short term for an attacker to become temporarily on-path= even if they are not on what should be the normal path to the destination. >> The definition we give about on-path attacker includes your >> sub-category. It does not matter where you attacker physically is. >> If it is able to capture and modify packets then it is on-path (does >> not matter if physical shorter or not). >>=20 >>=20 >>> An on-path attacker might choose to only change something about the LISP= handling details, such as exploding the map cache or redirecting a user to a= different site. Some of this is mentioned later in the document. One thing t= hat is not mentioned: Suppose that the encapsulated packet is encrypted. The= on-path attacker could however see the LISP header, and thus could change t= he nonce, or add a nonce, or reply to the nonce, change versioning informati= on,... Are you proposing that the LISP header be encrypted also? If so, whe= re is this specified and what does it do to forwarding performance in the xT= R? >>=20 >> The document is just an analysis, hence your question, while valid, is >> outside the scope of this document. >>>=20 >>> Section 4.3.1, second paragraph, third sentence:=20 >>>=20 >>> This is not different from today's >>> Internet where a spoofing off-path attacker may inject data packets >>> in any flow. >>>=20 >>> In terms of injecting traffic that the end system receives and acts upon= , I believe that this sentence is entirely true. However, in terms of the ef= fect on the router's control plane, and particularly the operation of xTR's,= this sentence is not true. Today there is very little that a spoofing attac= ker that is outside of a particular service provider can do to exercise the c= ontrol plane of that provider's routers. This is important and intentional (= see DOS discussion below). >> The section actually does not enter in any discussion about >> quantifying the damages. So the second part of your comment is >> correct if it does apply to section 4.3.1. >>=20 >> The first half of your comment is, however, unfounded. Section 4.3.1 >> is about attacks _not_ leveraging on LISP header, so from this side it >> is exactly the same case like any other IP spoofed packet. In >> particular since LISP header is not used, xTR functions are not >> actually attacked. >>=20 >>> Minor nit, next sentence: >>>=20 >>> A non-spoofing off-path attacker (NSA)... >>>=20 >>> Given recent events, I think that "NSA" is an unfortunate acronym to use= here. How about NSOA? >>=20 >> This can be fixed before pushing the document to the IESG. >>=20 >>=20 >>> Section 4.3.1.1 (Gleaning Attacks), last paragraph: >>>=20 >>> By itself, an attack made solely using gleaning cannot last long, >>> however it should be noted that with current network capacities, a >>> large amount of packets might be exchanged during even a small >>> fraction of time. >>>=20 >>> The amount of damage that might be caused by this may depend upon what h= appens to be exchanged in that "short amount of time". For example, the init= ial handshake between sites (at the application layer) could include sign in= information (account names and passwords), on the basis that this is the so= rt of information that needs to be exchanged at the beginning of, for exampl= e, financial transactions. My understanding is that for Internet commerce, i= t is normal for users to be redirected to a different site to enter credit c= ard information. This appears to constitute a "new session" (or at least may= be to an entirely different location) and therefore the entire credit card e= xchange could occur in a small period of time. I think it would be worth men= tioning here that the sensitivity of the information that could be exchanged= during this "short amount of time" is not known, and could potentially be s= erious. >>=20 >> Exchanging critical information (e.g. password) in clear means that >> you have a serious problem, but not at the network layer. Also, the >> situation with LISP would not be worse than without LISP. >>=20 >>>=20 >>> Also, depending upon how long xTR's are willing to store gleaned informa= tion (before the map request comes back), the time that a user is misdirecte= d due to a gleaning attack might be extended by coordinating a DDOS attack w= ith the gleaning attack. For example, an attacker may send packets to a very= large number of sites, with a source EID which is from a major stock broker= or bank and an RLOC from the attacker's captive servers. The many sites gle= an the EID to RLOC mapping from the arriving packets. Each pretty much simul= taneously initiates an EID lookup (to verify the EID to RLOC mapping). This c= reates a DOS attack on the control plane of the mapping function supporting t= hat stock broker or bank. This implies that the responses are going to be de= layed (and could be greatly delayed), which allows the incorrect mappings to= last longer than they otherwise would. This allows any systems that actuall= y happen to be trying to connect to that stock or banking site to be redirec= ted to the a >>> ttacker's site. The attacker then becomes a man in the middle and can fo= r example can obtain the password and account information for users. =20 >>=20 >> Such a scenario would require a lot of synchronisation. Anyway, our >> opinion is that the current text is stating exactly the same thing you >> describe just in a succinct way. >>=20 >> As a reminder, the present document studies LISP in a public network >> deployment. >>=20 >>=20 >>=20 >>> Last paragraph of section 4.3.2.2:=20 >>>=20 >>> If the size of the Map-Request >>> message is larger than the size of the smallest LISP-encapsulated >>> packet that could trigger such a message, this could lead to >>> amplification attacks (see Section 4.4.1) so that more bandwidth is >>> consumed on the target than the bandwidth necessary at the attacker >>> side. >>>=20 >>> The size of the packet is not the only issue. If the amount of processin= g required to send a map-request and deal with the reply is greater than the= amount of processing that is required to send a packet that triggers such a= request, then this could also result in an amplification attack. In princip= le it would seem that sending out a large number of packets to trigger such a= request would be relatively straightforward (for example the attacker might= be sending out many packets only incrementing the EID in order to attack th= e ITR that will need to generate many map requests). We may note that for ma= ny systems, particularly very high speed routers (which might exist for exam= ple as PE routers connecting very large enterprise customers), the control p= lane may be several orders of magnitude slower than the data plane, so that a= n attack that requires response from the router's control plane would be muc= h more serious than an attack of the same size that can be handled in the da= ta plane. I=20 >>> will say more about this in my comments below regarding DOS attacks. >>=20 >> Your first point can be easily fixed by substituting the word >> bandwidth with bandwidth and/or processing or "resource" >>=20 >> Your statement on the speed difference between control and data plane >> is true and is a general observation not limited to LISP. Note that >> one of the advantages of having the Map-Server/Map-Resolver elements >> in the LISPa architecture is exactly to avoid situations you are >> describing. >>=20 >>> Section 4.3.2.3, third paragraph (right after the bullets):=20 >>>=20 >>> The first type of packet should not cause any major problem to ITRs. >>> As the reachability test uses a 24 bits nonce, it is unlikely that an >>> off-path attacker could send a single packet that causes an ITR to >>> believe that the ETR it is testing is reachable while in reality it >>> is not reachable. To increase the success likelihood of such attack, >>> the attacker should create a massive amount of packets carrying all >>> possible nonce values. >>>=20 >>> However, this could be a problem if there are on-path attackers, since t= hey will see the nonce. They could insert nonce's where none are present, re= quiring a response from the ETR. Given that the control plane of very high s= peed PE routers may be much slower than the data plane, this could cause a r= elatively moderate data stream that the data plane or the PE could easily ha= ndle to turn into a control plane attack that the control plane of a PE rout= er could not handle. Also, the on-path attacker could see the nonce's and re= spond "correctly" (or in a way that the ITR that sent the nonce *thinks* is c= orrect), thereby "verifying" connectivity when none is present. You dismisse= d on-path attacks earlier in the document on the basis that the user data co= uld be encrypted, but these are examples of on-path attacks that would be on= the LISP header and operation, and not on the user data. >>=20 >> It is clearly stated at the beginning of the document that on-path >> attacks are out of the scope of the document. Also, Sec. 2 does not >> limit cryptography technique to the payload, actually section 2 makes >> the distinction saying: >>=20 >> 1) >> "To cope with such an attacker, cryptographic techniques such as >> those used by IPSec ([RFC4301 ]) are required." >>=20 >> which is reported to any form of packet manipulation >>=20 >> and 2) >> "As with IP, LISP relies on higher layer cryptography to secure packet >> payloads from on path attacks, so this document does not consider >> on-path attackers." >>=20 >> which is related to attacks targeting the payload. >>=20 >>=20 >>>=20 >>>=20 >>> Section 5.2 (Denial of Service): >>>=20 >>> You need to mention here the relative difference in speed between the da= ta plane and the control plane of high speed routers. For example, there are= plenty of examples currently widely deployed of routers which can handle a f= ew terabits of data in the data plane. These routers might typically have gi= gabit Ethernet links to the control processor, but I doubt that any of them c= ould handle Map-Requests coming in at line rate at a gigabit. Thus the ratio= between the speed of the control plane the speed of the data plane is signi= ficantly greater than 1000. I understand that many PE routers have slower da= ta planes (and the CE "wireless router" that sits in each of our homes is of= course a lot slower than this), but large data centers or large enterprise s= ites could very well be connected to their service provider via a few very h= igh speed PE routers. Therefore an attack that would be trivial to handle in= the data plane (say, a few gigabits) could overwhelm the control plane. >>=20 >> You are absolutely right, but why this is specific to LISP? It is not >> specific to LISP, so there is no reason to discuss such an issue in >> this document. >>=20 >>> Gleaning allows incoming packets to create map requests, which allows a d= ata plane attack to turn into a control plane attack. Given the difference i= n speeds between the data plane and the control plane, this makes it much ea= sier to create an effective DOS attack. >>=20 >> RFC6830 already considered rate limiting fo this very reason. >>=20 >>>=20 >>> Section 8 (Security Considerations).=20 >>>=20 >>> I am pleased that you removed the sentence from section 1 of the previou= s (-08) draft that read: "As a result of the performed analysis, the docume= nt discusses the severity of the threats and proposes recommendations to rea= ch the same level of security in LISP than in Internet today (e.g., without L= ISP)". This sentence was not actually correct. However, in looking through t= he document and in thinking about the implications (see the rest of this ema= il) it is quite clear that the security of an Internet using LISP would be s= ignificantly less than the current Internet (at least if you assume that the= re is *any* security at all in the current Internet). I am thinking that the= re should be a sentence at the end of section 8 to the effect that "At the c= urrent time it appears that LISP would have significant security implication= s if deployed on an Internet-wide scale". >>=20 >>=20 >> Such sentence would not represent the discussions that took place in >> the LISP WG in the last four years. >>=20 >> The arguments that you raised in the previous part of this mail are >> mainly not LISP-specific, while the experience gathered in the last >> years show that LISP is not worst that what we have today (and >> actually research work out there shows that it can even be helpful to >> use LISP) >>=20 >>=20 >>> Finally, two items left out: >>>=20 >>> I don't see any discussion on the effect of LISP on firewalls. I am assu= ming that pretty much all currently deployed firewalls are not able to look p= ast a LISP header to inspect the contents of packets. At a minimum, this wou= ld seem to imply that LISP will need to be deployed toward the Internet core= from the current firewalls, so that the firewalls can be looking at normal (= unchanged) IP packets. >>=20 >> Deployment model is out of the scope of this document and the problem >> is not specific to LISP. >>=20 >>=20 >>> There is another issue which might belong in the section on privacy: In t= he Internet today if you want to attack a network with prefix aa.bb/16, and y= ou see this advertisement in the BGP routes, you can pick a random address a= nd send a packet and see if anything happens. You get little feedback. With L= ISP you can send a map request to a random address in the block and get back= a map reply. This gives you an RLOC which is in general the actual IP addre= ss of a real PE or CE router. Of course you can repeat this across the entir= e /16, or even the Internet (given sufficient time and traffic), and get som= ething close to a complete list of LISP xTRs. This implies that if service p= roviders implement LISP on PE routers, then they will be exposing the identi= ty of their PE routers to worldwide inspection. Given the number of PE route= rs in the world (obviously much larger than the number of service providers,= and given PA address aggregation probably larger than the number of routes t= hat show u >>> p in the BGP routing table) we should expect that there are lots of PE r= outers that have not been carefully secured, and exposing their existence to= open worldwide easy discovery would likely open the door to a number of att= acks that involve compromise of PE routers. Of course if LISP is deployed on= CE routers then their RLOC would similarly be exposed. >>=20 >> If routers are not correctly secured, there is no problem linked to >> LISP as today it is already possible to discover the IP address of >> theses routers thanks to various techniques. Moreover, section 6 >> already clearly states that privacy is not discussed in the document >> but that the attacks presented in the document can potentially play a >> role in privacy threats. >>=20 >> Regards, >>=20 >> The authors of the threats document. >>=20 >>=20 >>> Thanks, Ross >>>=20 >>> -----Original Message----- >>> From: lisp [mailto:lisp-bounces@ietf.org] On Behalf Of Joel M. Halpern >>> Sent: Friday, May 09, 2014 11:54 AM >>> To: lisp@ietf.org >>> Subject: [lisp] Restarting last call on LISP threats >>>=20 >>> Sorry for the delay getting this out. >>> This email starts a new (and hopefully final) last call on=20 >>> draft-ietf-lisp-threats, version 9: >>> http://datatracker.ietf.org/doc/draft-ietf-lisp-threats/ >>>=20 >>> The last call will end in two weeks, close of business 23-May-2014. >>>=20 >>> Thank you, >>> Joel >>>=20 >>> _______________________________________________ >>> lisp mailing list >>> lisp@ietf.org >>> https://www.ietf.org/mailman/listinfo/lisp >>>=20 >>> _______________________________________________ >>> lisp mailing list >>> lisp@ietf.org >>> https://www.ietf.org/mailman/listinfo/lisp >>=20 From nobody Wed May 21 10:41:44 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A83B01A00E9 for ; Wed, 21 May 2014 10:41:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.902 X-Spam-Level: X-Spam-Status: No, score=-101.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id df-Aw-egJUNk for ; Wed, 21 May 2014 10:41:39 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1blp0185.outbound.protection.outlook.com [207.46.163.185]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A11C11A0379 for ; Wed, 21 May 2014 10:41:38 -0700 (PDT) Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB443.namprd05.prod.outlook.com (10.141.73.152) with Microsoft SMTP Server (TLS) id 15.0.944.11; Wed, 21 May 2014 17:41:35 +0000 Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) with mapi id 15.00.0944.000; Wed, 21 May 2014 17:41:35 +0000 From: Ronald Bonica To: Dino Farinacci Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEIABfmkAgAAJsgCAAEpiAIAEFPjggABC9oCAAx/20A== Date: Wed, 21 May 2014 17:41:34 +0000 Message-ID: <7053cf2c81534f84975013346c618ca8@CO1PR05MB442.namprd05.prod.outlook.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <8891A030-B462-48D9-83B4-4E42525F38CE@steffann.nl> <2D126379-BFF8-45FE-B6E1-B7E5E7FA5A6A@gmail.com> In-Reply-To: <2D126379-BFF8-45FE-B6E1-B7E5E7FA5A6A@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.12] x-forefront-prvs: 0218A015FA x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(13464003)(199002)(189002)(24454002)(377454003)(51704005)(51444003)(46102001)(99396002)(99286001)(85852003)(83072002)(1411001)(15975445006)(33646001)(86362001)(76482001)(92566001)(54356999)(50986999)(76176999)(101416001)(66066001)(74316001)(64706001)(79102001)(74662001)(80022001)(19580405001)(19580395003)(2656002)(15202345003)(76576001)(15188155005)(87936001)(77982001)(74502001)(20776003)(81542001)(81342001)(31966008)(21056001)(4396001)(16799955002)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO1PR05MB443; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/9Bznd_KEfg5g-t2_jN7O5Vk1YSU Cc: Roger Jorgensen , "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 May 2014 17:41:43 -0000 Dino, Aren't we talking about a scenario where the victim XTR has no information = regarding the EID or LOC in its map-cache? Ron > -----Original Message----- > From: Dino Farinacci [mailto:farinacci@gmail.com] > Sent: Monday, May 19, 2014 1:57 PM > To: Ronald Bonica > Cc: Sander Steffann; Roger Jorgensen; lisp@ietf.org > Subject: Re: [lisp] Restarting last call on LISP threats >=20 > In those cases we do mapping database RPF lookups. >=20 > Dino >=20 >=20 >=20 > > On May 19, 2014, at 10:14 AM, Ronald Bonica > wrote: > > > > Dino, > > > > The Spoofer Project (http://spoofer.cmand.org/summary.php) offers a > longitudinal view of BCP 38 deployment. I think that the results that the= y > report validate Sander's objection. Furthermore, they may suggest that > Sander's objection will remain valid for years to come. > > > > > > Ron > > > > > >> -----Original Message----- > >> From: Dino Farinacci [mailto:farinacci@gmail.com] > >> Sent: Friday, May 16, 2014 7:37 PM > >> To: Sander Steffann > >> Cc: Ronald Bonica; Roger Jorgensen; lisp@ietf.org > >> Subject: Re: [lisp] Restarting last call on LISP threats > >> > >>> Unfortunately this is not unlikely :( I certainly wouldn't consider > >>> it an > >> amazing feat... BCP38 is not implemented as much as it should be. > >> > >> I know there are many cases where BCP38 is not practice but more and > >> more access providers due uRPF. > >> > >> You only need one in the path. And the ones that don't do it are > >> using resources to transit packets to possible black holes. > >> > >> Dino From nobody Wed May 21 15:57:47 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 270F61A00B1 for ; Wed, 21 May 2014 15:57:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id paYqjWCT94w9 for ; Wed, 21 May 2014 15:57:44 -0700 (PDT) Received: from mail-qg0-x22e.google.com (mail-qg0-x22e.google.com [IPv6:2607:f8b0:400d:c04::22e]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 610821A03C7 for ; Wed, 21 May 2014 15:57:44 -0700 (PDT) Received: by mail-qg0-f46.google.com with SMTP id q108so4228289qgd.19 for ; Wed, 21 May 2014 15:57:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=7Y+M/WmdWJH+Uewl9JIhtT4J4va2kOSI5DrDWLA10OY=; b=e85p5tMY05/jBrIfip7A99AxDe6rPd22D90IoSN5NMZLyB6Q7swLWsKcRTFGlsCQzp PBHj1FrjBJl6ZyWpNAWcQ1GhMfV9JEBOSyc47F+Tq0nHaiqWzxzyFQnfV2RK/e7aNiJM Cax1Ue5NdfQLfkCkoZPMOy1oHhcRKotfEIlqLDN4m3P4UdfanbCWwVUU6SmNbCYg8Zb1 UrSjnHQHdRCw5uFi/n1SqSZFddWWmtS+ygTj3waLn9jFgzgaro7CHzA8cY+QfwKD5B2V EaVdj7l/iEZBAQJXuKhH/zVuL6pnFrlkvGezc/p9LFXpgd34fO1BdShStMJ0DKZwJEx2 KDLg== X-Received: by 10.140.97.55 with SMTP id l52mr71106883qge.19.1400713062946; Wed, 21 May 2014 15:57:42 -0700 (PDT) Received: from [10.77.0.78] (mobile-198-228-204-213.mycingular.net. [198.228.204.213]) by mx.google.com with ESMTPSA id r14sm1564074qga.4.2014.05.21.15.57.41 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 21 May 2014 15:57:41 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Dino Farinacci X-Mailer: iPhone Mail (11D167) In-Reply-To: Date: Wed, 21 May 2014 18:57:41 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> To: Ronald Bonica Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/HJubi05yrCogC98o3_96e8KspOw Cc: Roger Jorgensen , "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 May 2014 22:57:46 -0000 > The attacker sends a flow of crafted packets to the victim XTR. Each packe= t is a well-formed LISP data packet. It contains: >=20 > - an outer IP header (LOC->LOC) > - a UDP header > - a LISP Header > - an IP header (EID->EID) > - payload Just like a regular packet I can send to your home router today. So yes okay= . So let's continue. See comments below.=20 > Each packet contains control plane information that is new to the victim Be more specific about what control information are in these encapsulated pa= ckets.=20 > XTR. For example, the victim XTR has no mapping information regarding eith= er the source LOC or source EID prefix. Rather than gleaning this mapping in= formation from the crafted packet, the victim XTR sends a verifying MAP-REQU= EST to the mapping system. >=20 > Assume that the attack flow is large (N packets per second). Assume also t= hat the XTRs rate limit for MAP-REQUEST messages is less than N packets per s= econd. Has the attack not effectively DoS'd the victim XTR? It caches the rate the rate the packets are coming in and eventually stops s= ending Map-Requests completely.=20 It cannot stop the incoming rate of packets today just like a roque BGP atta= cker can send millions of packets per second to a peer regardless if it does= or does not have the peer authentication key.=20 > To make this attack work, every packet in the attack flow may need to have= a unique, spoofed, source LOC. An implementation can detect that after rate limiting 1000s of such requests= are happening that it just stops operation.=20 What if I sent a Juniper 20 million routes today? The Internet is very fragile and LISP IS NOT making it worse. And in some ca= ses it is making it better with integrated techniques.=20 Dino= From nobody Thu May 22 13:57:24 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B6D491A0305 for ; Thu, 22 May 2014 13:57:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.902 X-Spam-Level: X-Spam-Status: No, score=-101.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r4cF_mHFgMAj for ; Thu, 22 May 2014 13:57:20 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0141.outbound.protection.outlook.com [207.46.163.141]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 385CE1A02A9 for ; Thu, 22 May 2014 13:57:20 -0700 (PDT) Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB443.namprd05.prod.outlook.com (10.141.73.152) with Microsoft SMTP Server (TLS) id 15.0.944.11; Thu, 22 May 2014 20:57:16 +0000 Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) with mapi id 15.00.0944.000; Thu, 22 May 2014 20:57:15 +0000 From: Ronald Bonica To: Dino Farinacci Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEIABfmkAgAefyVCAAITngIABbBJg Date: Thu, 22 May 2014 20:57:15 +0000 Message-ID: <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> In-Reply-To: <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.16] x-forefront-prvs: 021975AE46 x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(51704005)(13464003)(199002)(189002)(377454003)(76576001)(87936001)(74502001)(77982001)(21056001)(19580395003)(19580405001)(83322001)(2656002)(4396001)(31966008)(81342001)(20776003)(81542001)(74662001)(80022001)(86362001)(92566001)(76482001)(85852003)(1411001)(83072002)(46102001)(33646001)(99396002)(101416001)(79102001)(64706001)(66066001)(74316001)(54356999)(50986999)(76176999)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO1PR05MB443; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/iFvMDZ_qtzNeAmyzxLwOrD5MJIQ Cc: Roger Jorgensen , "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 May 2014 20:57:22 -0000 Dino, Today's Internet is not as fragile as you think. This mail traversed many r= outers between my house and yours. If those routers are well-managed, there= is nothing that I can do from my house that will cause any of those router= s to consume control plane resources. Therefore, there is nothing that I ca= n do from my house that will cause a DoS attack against those routers' cont= rol planes. In LISP, separation between the forwarding and control plane is lost. As a = matter of course, forwarding plane activity causes control plane activity. = Since forwarding plane bandwidth exceeds control plane bandwidth, DoS attac= ks against the control plane are possible. In order to be complete, the threats document must describe the DoS threat.= It should also describe mitigations, if any exist. = Ron > -----Original Message----- > From: Dino Farinacci [mailto:farinacci@gmail.com] > Sent: Wednesday, May 21, 2014 6:58 PM > To: Ronald Bonica > Cc: Roger Jorgensen; lisp@ietf.org > Subject: Re: [lisp] Restarting last call on LISP threats >=20 > > The attacker sends a flow of crafted packets to the victim XTR. Each pa= cket > is a well-formed LISP data packet. It contains: > > > > - an outer IP header (LOC->LOC) > > - a UDP header > > - a LISP Header > > - an IP header (EID->EID) > > - payload >=20 > Just like a regular packet I can send to your home router today. So yes o= kay. > So let's continue. See comments below. >=20 > > Each packet contains control plane information that is new to the victi= m >=20 > Be more specific about what control information are in these encapsulated > packets. >=20 > > XTR. For example, the victim XTR has no mapping information regarding > either the source LOC or source EID prefix. Rather than gleaning this map= ping > information from the crafted packet, the victim XTR sends a verifying MAP= - > REQUEST to the mapping system. > > > > Assume that the attack flow is large (N packets per second). Assume als= o > that the XTRs rate limit for MAP-REQUEST messages is less than N packets > per second. Has the attack not effectively DoS'd the victim XTR? >=20 > It caches the rate the rate the packets are coming in and eventually stop= s > sending Map-Requests completely. >=20 > It cannot stop the incoming rate of packets today just like a roque BGP > attacker can send millions of packets per second to a peer regardless if = it > does or does not have the peer authentication key. >=20 > > To make this attack work, every packet in the attack flow may need to h= ave > a unique, spoofed, source LOC. >=20 > An implementation can detect that after rate limiting 1000s of such reque= sts > are happening that it just stops operation. >=20 > What if I sent a Juniper 20 million routes today? >=20 > The Internet is very fragile and LISP IS NOT making it worse. And in some > cases it is making it better with integrated techniques. >=20 > Dino From nobody Thu May 22 15:50:18 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D1BC1A0270 for ; Thu, 22 May 2014 15:50:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JdcEK0nZobLR for ; Thu, 22 May 2014 15:50:11 -0700 (PDT) Received: from mailc2.tigertech.net (mailc2.tigertech.net [208.80.4.156]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5E9561A029C for ; Thu, 22 May 2014 15:50:11 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mailc2.tigertech.net (Postfix) with ESMTP id 0965B4374C for ; Thu, 22 May 2014 15:50:10 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at c2.tigertech.net Received: from Joels-MacBook-Pro.local (unknown [129.192.170.160]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mailc2.tigertech.net (Postfix) with ESMTPSA id DFF9B4373C for ; Thu, 22 May 2014 15:50:09 -0700 (PDT) Message-ID: <537E7F21.6070206@joelhalpern.com> Date: Thu, 22 May 2014 18:50:09 -0400 From: "Joel M. Halpern" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.5.0 MIME-Version: 1.0 To: "lisp@ietf.org" Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/gBwJj67FPirgXZCrBOCdWGVs9_A Subject: Re: [lisp] https://datatracker.ietf.org/doc/draft-ietf-lisp-eid-block/ X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 May 2014 22:50:13 -0000 Having been reminded by my co-chair that the WG LC ended many weeks ago... The chairs determination is that this document received sufficient WG support, and seeing no objections the shepherd will begin the writeup process for delivery to the AD. Authors, please confirm to the list (and thus the shepherd) that all relevant IPR you know of has been disclosed (or conversely that you do not know of any relevant IPR that has not been disclosed.) Thank you, Joel From nobody Fri May 23 06:06:53 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8AFD01A01CD for ; Fri, 23 May 2014 06:06:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.649 X-Spam-Level: X-Spam-Status: No, score=-1.649 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HELO_EQ_FR=0.35, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PCHwzTlXU2ak for ; Fri, 23 May 2014 06:06:40 -0700 (PDT) Received: from mail-wi0-x22d.google.com (mail-wi0-x22d.google.com [IPv6:2a00:1450:400c:c05::22d]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 868DD1A0484 for ; Fri, 23 May 2014 06:06:39 -0700 (PDT) Received: by mail-wi0-f173.google.com with SMTP id bs8so804996wib.12 for ; Fri, 23 May 2014 06:06:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=4YdRuRKN6Drg1ZwWtnUwSGfYfUEf91aFpHNkOY4UXok=; b=ST1u918IMWo/jNH9czdYP01OkyHtPfMklup3NZnARr1wxK8g0cPqfEX9rpGNtaaMNk xjLd5X95wvwUV3WCgDM4pXEG405UKwMwarSqe07W2vTInhdZ9aODysfHNxVoAc21sall VESxomU6QlMeUdWEF8F+l7hWP0yqjN7Pbe7ty8PqOE3or8yKlVImuLySEOr/Ff1+dBjp eMwKf0SZgxGTIxwfCp9aRcq7EPtKMrATBWz+jc0L4+ZOPVgA4XD0XBh3rrfdIhyxDRDn Xa5Q9MB5N+xqVjAZU9PZ8ph3IzFinGEHErg9dib3rxmb19+IfvxaLpm55Tf8vECxb+bo DUfQ== X-Received: by 10.194.5.5 with SMTP id o5mr4236320wjo.16.1400850396761; Fri, 23 May 2014 06:06:36 -0700 (PDT) Received: from faucon.inria.fr (faucon.inria.fr. [138.96.201.73]) by mx.google.com with ESMTPSA id ln3sm3859894wjc.8.2014.05.23.06.06.35 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 23 May 2014 06:06:35 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_DE9C606C-A0FF-4BD8-9BBD-9983ACDA443C" Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.2\)) From: Damien Saucez In-Reply-To: <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> Date: Fri, 23 May 2014 15:06:34 +0200 Message-Id: <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> To: Ronald Bonica X-Mailer: Apple Mail (2.1878.2) Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/q719iS5HLIl6gIT1dIKzwHWMqUI Cc: Roger Jorgensen , LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 May 2014 13:06:42 -0000 --Apple-Mail=_DE9C606C-A0FF-4BD8-9BBD-9983ACDA443C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hello Ronald, On 22 May 2014, at 22:57, Ronald Bonica wrote: > Dino, >=20 > Today's Internet is not as fragile as you think. This mail traversed = many routers between my house and yours. If those routers are = well-managed, there is nothing that I can do from my house that will = cause any of those routers to consume control plane resources. = Therefore, there is nothing that I can do from my house that will cause = a DoS attack against those routers' control planes. >=20 We tend to disagree with that, for example you have ICMP today... > In LISP, separation between the forwarding and control plane is lost. = As a matter of course, forwarding plane activity causes control plane = activity. Since forwarding plane bandwidth exceeds control plane = bandwidth, DoS attacks against the control plane are possible. >=20 > In order to be complete, the threats document must describe the DoS = threat. It should also describe mitigations, if any exist. >=20 DoS is already explained and the definition given: " A Denial of Service (DoS) attack aims at disrupting a specific targeted service either by exhausting the resources of the victim up to the point that it is not able to provide a reliable service to legit traffic and/or systems or by exploiting vulnerabilities to make the targeted service unable to operate properly. " is covering the case you mention. Damien Saucez=20 > = Ron >=20 >=20 >> -----Original Message----- >> From: Dino Farinacci [mailto:farinacci@gmail.com] >> Sent: Wednesday, May 21, 2014 6:58 PM >> To: Ronald Bonica >> Cc: Roger Jorgensen; lisp@ietf.org >> Subject: Re: [lisp] Restarting last call on LISP threats >>=20 >>> The attacker sends a flow of crafted packets to the victim XTR. Each = packet >> is a well-formed LISP data packet. It contains: >>>=20 >>> - an outer IP header (LOC->LOC) >>> - a UDP header >>> - a LISP Header >>> - an IP header (EID->EID) >>> - payload >>=20 >> Just like a regular packet I can send to your home router today. So = yes okay. >> So let's continue. See comments below. >>=20 >>> Each packet contains control plane information that is new to the = victim >>=20 >> Be more specific about what control information are in these = encapsulated >> packets. >>=20 >>> XTR. For example, the victim XTR has no mapping information = regarding >> either the source LOC or source EID prefix. Rather than gleaning this = mapping >> information from the crafted packet, the victim XTR sends a verifying = MAP- >> REQUEST to the mapping system. >>>=20 >>> Assume that the attack flow is large (N packets per second). Assume = also >> that the XTRs rate limit for MAP-REQUEST messages is less than N = packets >> per second. Has the attack not effectively DoS'd the victim XTR? >>=20 >> It caches the rate the rate the packets are coming in and eventually = stops >> sending Map-Requests completely. >>=20 >> It cannot stop the incoming rate of packets today just like a roque = BGP >> attacker can send millions of packets per second to a peer regardless = if it >> does or does not have the peer authentication key. >>=20 >>> To make this attack work, every packet in the attack flow may need = to have >> a unique, spoofed, source LOC. >>=20 >> An implementation can detect that after rate limiting 1000s of such = requests >> are happening that it just stops operation. >>=20 >> What if I sent a Juniper 20 million routes today? >>=20 >> The Internet is very fragile and LISP IS NOT making it worse. And in = some >> cases it is making it better with integrated techniques. >>=20 >> Dino >=20 > _______________________________________________ > lisp mailing list > lisp@ietf.org > https://www.ietf.org/mailman/listinfo/lisp --Apple-Mail=_DE9C606C-A0FF-4BD8-9BBD-9983ACDA443C Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Hello = Ronald,


On 22 May 2014, at 22:57, = Ronald Bonica <rbonica@juniper.net> = wrote:

Dino,

Today's Internet is not as fragile as you = think. This mail traversed many routers between my house and yours. If = those routers are well-managed, there is nothing that I can do from my = house that will cause any of those routers to consume control plane = resources. Therefore, there is nothing that I can do from my house that = will cause a DoS attack against those routers' control = planes.

We tend to disagree with that, for = example you have ICMP today...

In = LISP, separation between the forwarding and control plane is lost. As a = matter of course, forwarding plane activity causes control plane = activity. Since forwarding plane bandwidth exceeds control plane = bandwidth, DoS attacks against the control plane are possible.

In = order to be complete, the threats document must describe the DoS threat. = It should also describe mitigations, if any = exist.


DoS is already explained = and the definition given:

" A Denial of Service (DoS) attack aims at = disrupting a specific
   targeted service either by exhausting the =
resources of the victim up
   to the point that it is not able to provide a reliable service to
   legit traffic and/or systems or by exploiting vulnerabilities to make
   the targeted service unable to operate =
properly.
"

is covering the case you = mention.

Damien = Saucez 

=             &n= bsp;           &nbs= p;            =             &n= bsp;           &nbs= p;            =             &n= bsp;       Ron


-----Original Message-----
From: Dino Farinacci [mailto:farinacci@gmail.com]
Sen= t: Wednesday, May 21, 2014 6:58 PM
To: Ronald Bonica
Cc: Roger = Jorgensen; lisp@ietf.org
Subject: = Re: [lisp] Restarting last call on LISP threats

The attacker sends a flow of crafted packets to the victim = XTR. Each packet
is a well-formed LISP data packet. It = contains:

- an outer IP header = (LOC->LOC)
- a UDP header
- a LISP Header
- an IP header = (EID->EID)
- payload

Just like a regular = packet I can send to your home router today. So yes okay.
So let's = continue. See comments below.

Each = packet contains control plane information that is new to the = victim

Be more specific about what control = information are in these encapsulated
packets.

XTR. For example, the victim XTR has no mapping = information regarding
either the source LOC or source = EID prefix. Rather than gleaning this mapping
information from the = crafted packet, the victim XTR sends a verifying MAP-
REQUEST to the = mapping system.

Assume that the attack = flow is large (N packets per second). Assume also
that = the XTRs rate limit for MAP-REQUEST messages is less than N = packets
per second. Has the attack not effectively DoS'd the victim = XTR?

It caches the rate the rate the packets are coming in and = eventually stops
sending Map-Requests completely.

It cannot = stop the incoming rate of packets today just like a roque = BGP
attacker can send millions of packets per second to a peer = regardless if it
does or does not have the peer authentication = key.

To make this attack work, every = packet in the attack flow may need to have
a unique, = spoofed, source LOC.

An implementation can detect that after rate = limiting 1000s of such requests
are happening that it just stops = operation.

What if I sent a Juniper 20 million routes = today?

The Internet is very fragile and LISP IS NOT making it = worse. And in some
cases it is making it better with integrated = techniques.

Dino

______________________________= _________________
lisp mailing list
lisp@ietf.org
https://www.ietf.org/ma= ilman/listinfo/lisp

= --Apple-Mail=_DE9C606C-A0FF-4BD8-9BBD-9983ACDA443C-- From nobody Fri May 23 06:30:11 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A54D81A01C0 for ; Fri, 23 May 2014 06:30:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o4PCLUGOC3yO for ; Fri, 23 May 2014 06:30:03 -0700 (PDT) Received: from mail-qc0-x235.google.com (mail-qc0-x235.google.com [IPv6:2607:f8b0:400d:c01::235]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BC69E1A01AF for ; Fri, 23 May 2014 06:30:02 -0700 (PDT) Received: by mail-qc0-f181.google.com with SMTP id m20so8044266qcx.40 for ; Fri, 23 May 2014 06:30:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=1G5JfrVGe+MwszB/ZQqDfZS/njaVxIeBqn3Dn5leqTM=; b=RVBzcA97zttPu4EKbe2X+kRmE03K55S8lu+f8mDLfZhcvg1kJb31M6SCN13KN1iLeu WuNuwYqeW2BjJpadoK3X5rKcqX5AbSe9Ytq21BpNf27k8yNIZDjDkWZDZ66FarBOpiNT tyZg8cIvqJu78HPu7DHKhY0Blu1h+6Pk/VJ3N/xOqi6lgjXFac+UNJuhFoH+XKC0mB2A YcTHlMFk3hMeac9vF1xxhsdObD0aAprBo8See1PnWghQEfmRbPYUxHB0zyyJiVwPWcG/ wnXFZA1RxZ4o7R3sfnRFwzBFj+wFiaC0kYiEPYIJTkuCkzMg3ht6H8r2UWvV6nYdcfer tntw== X-Received: by 10.229.234.67 with SMTP id kb3mr6816508qcb.6.1400851800691; Fri, 23 May 2014 06:30:00 -0700 (PDT) Received: from [10.5.50.34] (pool-96-224-2-33.nycmny.east.verizon.net. [96.224.2.33]) by mx.google.com with ESMTPSA id j88sm1937628qgf.39.2014.05.23.06.29.58 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 23 May 2014 06:29:59 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\)) From: Dino Farinacci In-Reply-To: <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> Date: Fri, 23 May 2014 06:29:57 -0700 Content-Transfer-Encoding: quoted-printable Message-Id: References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> To: Ronald Bonica X-Mailer: Apple Mail (2.1874) Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/gUkC38J5dehwdcBAD7sNhFkbFAM Cc: Roger Jorgensen , "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 May 2014 13:30:09 -0000 > Dino, >=20 > Today's Internet is not as fragile as you think. This mail traversed = many routers between my house and yours.=20 Ron, I know for a fact, it is fragile. I know most of the code that runs = the Internet. And you said yourself that uRPF is not used in many = places, so that, in and of itself, makes it fragile for spoofing. > If those routers are well-managed, there is nothing that I can do from = my house that will cause any of those routers to consume control plane = resources. Therefore, there is nothing that I can do from my house that = will cause a DoS attack against those routers' control planes. My example, I wanted to take you out, not the PE router at AT&T that = could take out all customers attached to that PE. Which has happned = before by bad vendor code. LOL. So I don't have to play there.=20 But I can use up all your resources at your house so your kids can get = their homework assignments done on time. It happens to me all the time at Starbucks when 15 people are watching = videos and all I want is some decent response in my emacs window. ;-) = That is not a DoS, in this case but normal usage. So DoSing something is = as simple as bringing up an innocent applicaiton and lauching UDP = streams to your home router. > In LISP, separation between the forwarding and control plane is lost. = As a matter of course, forwarding plane=20 That is not true. And in most cases, when xTRs are behind NATs, there is = NEVER a map-cache miss. I assume you are referring to that when you = claim there is lost separation. If not, please clarify. > activity causes control plane activity. Since forwarding plane = bandwidth exceeds control plane bandwidth, DoS attacks against the = control plane are possible. Yes, for every protocol we have invented. But like I said, there are = better ways to solve this with LISP. If you look at all the drafts in = totality, you will see we have a decent toolbox of solutions that COULD = fight this traditional problem. You are merely (and continually) looking ONLY at the map-cache miss = problem. > In order to be complete, the threats document must describe the DoS = threat. It should also describe mitigations, if any exist. I agree with that. No one is arguing your point or Ross point. But = rather than just documenting what they are, we want to fix them. So that = is were we should put our attention. So let's have all of us work = together and identify the problems and brainstorm about fixes.=20 Rather than just saying what is wrong. Dino From nobody Fri May 23 07:37:15 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AA6421A017A for ; Fri, 23 May 2014 07:37:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WRp1xAFD8UgA for ; Fri, 23 May 2014 07:37:08 -0700 (PDT) Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2lp0208.outbound.protection.outlook.com [207.46.163.208]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C77331A0168 for ; Fri, 23 May 2014 07:37:07 -0700 (PDT) Received: from CO2PR05MB636.namprd05.prod.outlook.com (10.141.199.24) by CO2PR05MB635.namprd05.prod.outlook.com (10.141.199.22) with Microsoft SMTP Server (TLS) id 15.0.944.11; Fri, 23 May 2014 14:36:57 +0000 Received: from CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) by CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) with mapi id 15.00.0944.000; Fri, 23 May 2014 14:36:57 +0000 From: Ross Callon To: Damien Saucez Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58M9eFhkxJvMEaw1MEc+Ryfdps9FMJAgAt2hwCABcOvgA== Date: Fri, 23 May 2014 14:36:56 +0000 Message-ID: <16a14e1029954a9cb74c6115dd3c1a71@CO2PR05MB636.namprd05.prod.outlook.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.13] x-forefront-prvs: 0220D4B98D x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(51704005)(13464003)(37854004)(199002)(189002)(377454003)(51444003)(164054003)(52314003)(76482001)(33646001)(77982001)(83322001)(19580405001)(19580395003)(81542001)(81342001)(4396001)(99396002)(99286001)(46102001)(551544002)(92566001)(21056001)(86362001)(74662001)(31966008)(101416001)(80022001)(74316001)(74502001)(15975445006)(66066001)(87936001)(76576001)(20776003)(85852003)(64706001)(50986999)(54356999)(15202345003)(76176999)(77096999)(83072002)(79102001)(2656002)(24736002)(559001)(579004); DIR:OUT; SFP:; SCL:1; SRVR:CO2PR05MB635; H:CO2PR05MB636.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rcallon@juniper.net; Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/Rnous0PB9D09q12mF0SL0vinFUk Cc: LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 May 2014 14:37:13 -0000 Detailed comments below. To summarize, these details include three threats = which are new to LISP and which are not adequately explained in the current= threats document: (1) The Control Plane Threat: LISP allows a dataplane DOS attack (lots of = packets sent to overwhelm a site) to turn into a control plane attack (the = router is forced to respond to the attack in the control plane, which is of= course frequently multiple orders of magnitude slower than the data plane,= particularly for very high speed routers).=20 (2) The Privacy Threat: LISP provides an attacker with a relatively easy w= ay to determine the identity of large numbers of PE and/or CE routers (glob= ally, if LISP is deployed on that level) . (3) the Traffic Gleaning Threat: If an xTR gleans EID -> RLOC mappings fro= m incoming packets, this provides an easy way for hackers to intercept traf= fic. I put this threat third because gleaning can be turned off, and thus t= his threat can be defeated simply by not gleaning EID -> RLOC mappings.=20 WRT the first of these, Dino has pointed out that the control plane of rout= ers already receive BGP packets from sources outside their domain. Thus a D= OS attack on the control plane of routers can be launched through BGP. Howe= ver, the number of BGP peers that a router has is limited, and can be known= a priori. Thus it is possible, and relatively common, for a router to be c= onfigured to only accept BGP updates from a very limited number of identifi= ed other routers (in many cases a moderate number of external peers plus a = few internal route reflectors). Each of these known BGP sessions can be ind= ividually rate limited, and no other source can be allowed to send BGP upda= tes to the router. Also, other control traffic to the router can be limited= to internal peers (eg, OSPF, IS-IS, LDP, and/or RSVP from other internal r= outers, plus network management traffic from internal sources only). Thus t= oday every source of control plane traffic to the router can be controlled = and rate limited. For CE routers the number of BGP peers can be even more l= imited, possibly to one (the PE) or even none (for stub domains use manuall= y configured static routes).=20 If LISP were ubiquitously and globally deployed across the Internet, then m= apping requests could come from pretty much anywhere. Similarly incoming da= ta plane traffic which contains EID's that are not currently listed in your= EID -> RLOC mapping would cause a mapping request to be generated in the c= ontrol plane. I understand that mapping requests (both incoming and outgoin= g) can be rate limited, but this simply turns a "shut down the router's con= trol plane" attack to turn into a "shut down the router's mapping function"= attack. If correct operation relies on the mapping function, then you have= still broken the router.=20 The second of these is a big deal which has not been talked about much. We = don't want hackers to know the identity of all PE and/or CE routers. It is = difficult to fully anticipate what attacks will occur, but there certainly = have already been intrusions of various kinds against routers and making it= fundamentally easier for hackers to know the identity of a large number of= routers is something that it at least important enough to mention.=20 Regarding the third of these, there have already been attacks which mis-rou= te traffic. Eg: http://www.wired.com/2013/12/bgp-hijacking-belarus-iceland/ =20 However, we don't want to make it easier to launch attacks of this kind, an= d there is other work currently underway to make BGP more difficult to hija= ck (but of course, gleaning can be turned off).=20 More details in-line below, marked with "RWC>" in the left margin... -----Original Message----- From: Damien Saucez [mailto:damien.saucez@gmail.com]=20 Sent: Monday, May 19, 2014 6:26 PM To: Ross Callon Cc: Joel M. Halpern; LISP mailing list list; Luigi Iannone Subject: Re: [lisp] Restarting last call on LISP threats Dear Ross, Thank you for your time. Before detailed comments below, we have to remind that the objective of this document is to identify global threats potentially introduced by LISP w.r.t. what exists today in the legacy Internet. The problem space is out of the scope of the document. comments inline. On 12 May 2014, at 19:11, Ross Callon wrote: > Thanks Joel; >=20 > I think that draft-ietf-lisp-threats-09.txt is a start towards a threats = document, but that it has serious omissions and needs more work before bein= g progressed. Here are some specific comments:=20 >=20 >=20 > Section 2 (On-path Attackers), first paragraph:=20 >=20 > On-path attackers are attackers that are able to capture and modify > all the packets exchanged between an Ingress Tunnel Router (ITR) and > an Egress Tunnel Router (ETR). To cope with such an attacker, > cryptographic techniques such as those used by IPSec ([RFC4301]) are > required. As with IP, LISP relies on higher layer cryptography to > secure packet payloads from on path attacks, so this document does > not consider on-path attackers. >=20 > To me an on-path attacker is one which is on the data path. Such an attac= ker might attack the contents of the data packet. In this case the paragrap= h seems mostly correct to me: You encrypt the contents if you don't want so= meone on the path to the destination to look at the contents. However, as i= s discussed later in the document, LISP allows systems which are not in the= normal physical path, through a gleaning attack, to inject themselves into= the data path. This could be applied to allow attacker's systems to inject= themselves into the path of the key management protocol. This implies that= a legitimate user could get keys supplied by an attacker, just as easily a= s it could get keys supplied by a legitimate Internet site. If you are prop= osing that end to end encryption is the solution to on path attackers then = you need to understand the implications of LISP on the operation of the pro= tocol needed for key management to support end to end encryption.=20 The paragraph you are citing end with this document does _not_ consider on-path attackers.. While you remarks are generally valuable they do not apply here, the document is not proposing anything, it i just stating what is _not_ considered. RWC> The existing paragraph clearly states "LISP relies on higher layer RWC> cryptography to secure packet payloads from on path attacks". RWC> However, higher layer cryptography does not protect the LISP header. RWC> Thus LISP cannot rely on higher layer cryptography to protect the=20 RWC> LISP header. There is an real attack here that you have just ruled=20 RWC> out of scope without justification. More on this below... >=20 > Also, you should mention in this section that a gleaning attack would all= ow at least in the short term for an attacker to become temporarily on-path= even if they are not on what should be the normal path to the destination.= =20 >=20 The definition we give about on-path attacker includes your sub-category. It does not matter where you attacker physically is. If it is able to capture and modify packets then it is on-path (does not matter if physical shorter or not). RWC> Okay, we are agreed that if a gleaning attack allows an attacker to RWC> put themselves on-path, then they are considered to be an on-path RWC> attacker. LISP therefore makes it easier to launch on-path attacks. RWC> This is not a justification to refuse to consider such attacks and=20 RWC> simply rule them "out of scope".=20 > An on-path attacker might choose to only change something about the LISP = handling details, such as exploding the map cache or redirecting a user to = a different site. Some of this is mentioned later in the document. One thin= g that is not mentioned: Suppose that the encapsulated packet is encrypted.= The on-path attacker could however see the LISP header, and thus could cha= nge the nonce, or add a nonce, or reply to the nonce, change versioning inf= ormation,... Are you proposing that the LISP header be encrypted also? If = so, where is this specified and what does it do to forwarding performance i= n the xTR?=20 >=20 The document is just an analysis, hence your question, while valid, is outside the scope of this document. RWC> If I understand your reasoning: You don't know how to handle such=20 RWC> attacks. Therefore you don't discuss them and you rule these attacks RWC> as "out of scope". Since you don't discuss them, therefore LISP is RWC> secure. I must not have understood your reasoning.=20 > > Section 4.3.1, second paragraph, third sentence:=20 >=20 > This is not different from today's > Internet where a spoofing off-path attacker may inject data packets > in any flow. >=20 > In terms of injecting traffic that the end system receives and acts upon,= I believe that this sentence is entirely true. However, in terms of the ef= fect on the router's control plane, and particularly the operation of xTR's= , this sentence is not true. Today there is very little that a spoofing att= acker that is outside of a particular service provider can do to exercise t= he control plane of that provider's routers. This is important and intentio= nal (see DOS discussion below).=20 >=20 >=20 The section actually does not enter in any discussion about quantifying the damages. So the second part of your comment is correct if it does apply to section 4.3.1. The first half of your comment is, however, unfounded. Section 4.3.1 is about attacks _not_ leveraging on LISP header, so from this side it is exactly the same case like any other IP spoofed packet. In particular since LISP header is not used, xTR functions are not actually attacked. RWC> This gets back to my meta-comment that I sent earlier in an separate RWC> email. We need to understand the attacks that might actually occur. RWC> It is not acceptable to just rule an attack out of scope without=20 RWC> considering it, and then decide that LISP is secure because the=20 RWC> attacks that you did consider can be handled.=20 > (deleted nit about abbreviation for A non-spoofing off-path attacker) > Section 4.3.1.1 (Gleaning Attacks), last paragraph: >=20 > By itself, an attack made solely using gleaning cannot last long, > however it should be noted that with current network capacities, a > large amount of packets might be exchanged during even a small > fraction of time. >=20 > The amount of damage that might be caused by this may depend upon what ha= ppens to be exchanged in that "short amount of time". For example, the init= ial handshake between sites (at the application layer) could include sign i= n information (account names and passwords), on the basis that this is the = sort of information that needs to be exchanged at the beginning of, for exa= mple, financial transactions. My understanding is that for Internet commerc= e, it is normal for users to be redirected to a different site to enter cre= dit card information. This appears to constitute a "new session" (or at lea= st may be to an entirely different location) and therefore the entire credi= t card exchange could occur in a small period of time. I think it would be = worth mentioning here that the sensitivity of the information that could be= exchanged during this "short amount of time" is not known, and could poten= tially be serious.=20 Exchanging critical information (e.g. password) in clear means that you have a serious problem, but not at the network layer. Also, the situation with LISP would not be worse than without LISP. RWC> You are correct that exchanging passwords or other login credentials = in =20 RWC> the clear is a bad idea, and not LISP's problem. I had a rather long= =20 RWC> discussion with a security expert over this, and the bottom line seem= s RWC> to be a bit muddled: The primary security for critical sensitive data RWC> (such as passwords) is at the application layer, but this is not perf= ect RWC> -- attacks on the certificates are conceivable -- and thus it is not= =20 RWC> ideal to remove another imperfect layer of security. My conclusion fr= om RWC> this is that I am not comfortable with the risks of gleaning, but at= =20 RWC> worse it just needs to be turned off for operation over non-trusted=20 RWC> environments (such as the Internet).=20 >=20 > Also, depending upon how long xTR's are willing to store gleaned informat= ion (before the map request comes back), the time that a user is misdirecte= d due to a gleaning attack might be extended by coordinating a DDOS attack = with the gleaning attack. For example, an attacker may send packets to a ve= ry large number of sites, with a source EID which is from a major stock bro= ker or bank and an RLOC from the attacker's captive servers. The many sites= glean the EID to RLOC mapping from the arriving packets. Each pretty much = simultaneously initiates an EID lookup (to verify the EID to RLOC mapping).= This creates a DOS attack on the control plane of the mapping function sup= porting that stock broker or bank. This implies that the responses are goin= g to be delayed (and could be greatly delayed), which allows the incorrect = mappings to last longer than they otherwise would. This allows any systems = that actually happen to be trying to connect to that stock or banking site = to be redirected to the a > ttacker's site. The attacker then becomes a man in the middle and can for= example can obtain the password and account information for users. =20 >=20 >=20 Such a scenario would require a lot of synchronisation. Anyway, our opinion is that the current text is stating exactly the same thing you describe just in a succinct way. RWC> No. Synchronization is trivial because the attack that inserts wrong= =20 RWC> information into the EID -> RLOC mappings **is the same attack** that= =20 RWC> creates a DDOS attack against the mapping system. I believe that the RWC> current text understates the risk (which appears to be the purpose=20 RWC> of the entire document).=20 As a reminder, the present document studies LISP in a public network deployment. RWC> As it should.=20 > Last paragraph of section 4.3.2.2:=20 >=20 > If the size of the Map-Request > message is larger than the size of the smallest LISP-encapsulated > packet that could trigger such a message, this could lead to > amplification attacks (see Section 4.4.1) so that more bandwidth is > consumed on the target than the bandwidth necessary at the attacker > side. >=20 > The size of the packet is not the only issue. If the amount of processing= required to send a map-request and deal with the reply is greater than the= amount of processing that is required to send a packet that triggers such = a request, then this could also result in an amplification attack. In princ= iple it would seem that sending out a large number of packets to trigger su= ch a request would be relatively straightforward (for example the attacker = might be sending out many packets only incrementing the EID in order to att= ack the ITR that will need to generate many map requests). We may note that= for many systems, particularly very high speed routers (which might exist = for example as PE routers connecting very large enterprise customers), the = control plane may be several orders of magnitude slower than the data plane= , so that an attack that requires response from the router's control plane = would be much more serious than an attack of the same size that can be hand= led in the data plane. I=20 > will say more about this in my comments below regarding DOS attacks.=20 >=20 Your first point can be easily fixed by substituting the word bandwidth with bandwidth and/or processing or "resource" Your statement on the speed difference between control and data plane is true and is a general observation not limited to LISP. =20 RWC> of course. But other aspects of router operations are carefully set u= p RWC> to avoid overloading the control plane.=20 Note that one of the advantages of having the Map-Server/Map-Resolver elements in the LISPa architecture is exactly to avoid situations you are describing. RWC> I don't think that this has succeeded.=20 > Section 4.3.2.3, third paragraph (right after the bullets):=20 >=20 > The first type of packet should not cause any major problem to ITRs. > As the reachability test uses a 24 bits nonce, it is unlikely that an > off-path attacker could send a single packet that causes an ITR to > believe that the ETR it is testing is reachable while in reality it > is not reachable. To increase the success likelihood of such attack, > the attacker should create a massive amount of packets carrying all > possible nonce values. >=20 > However, this could be a problem if there are on-path attackers, since th= ey will see the nonce. They could insert nonce's where none are present, re= quiring a response from the ETR. Given that the control plane of very high = speed PE routers may be much slower than the data plane, this could cause a= relatively moderate data stream that the data plane or the PE could easily= handle to turn into a control plane attack that the control plane of a PE = router could not handle. Also, the on-path attacker could see the nonce's a= nd respond "correctly" (or in a way that the ITR that sent the nonce *think= s* is correct), thereby "verifying" connectivity when none is present. You = dismissed on-path attacks earlier in the document on the basis that the use= r data could be encrypted, but these are examples of on-path attacks that w= ould be on the LISP header and operation, and not on the user data.=20 It is clearly stated at the beginning of the document that on-path attacks are out of the scope of the document.=20 RWC> True. But since you have agreed that gleaning attacks that cause=20 RWC> traffic to be mis-routed cause additional systems to be on-path=20 RWC> and that this constitutes an on-path attack, and since you have=20 RWC> ruled out on-path attacks against the LISP headers, therefore you RWC> have failed to adequately consider LISP security. You can't just=20 RWC> rule important attacks out of scope and then claim that you have=20 RWC> any valid conclusion regarding the overall security of LISP.=20 Also, Sec. 2 does not limit cryptography technique to the payload, actually section 2 makes the distinction saying: 1) "To cope with such an attacker, cryptographic techniques such as those used by IPSec ([RFC4301 ]) are required." which is reported to any form of packet manipulation and 2) "As with IP, LISP relies on higher layer cryptography to secure packet payloads from on path attacks, so this document does not consider on-path attackers." which is related to attacks targeting the payload. RWC> But doesn't address the issue of on-path attacks on the LISP header.=20 >=20 >=20 > Section 5.2 (Denial of Service): >=20 > You need to mention here the relative difference in speed between the dat= a plane and the control plane of high speed routers. For example, there are= plenty of examples currently widely deployed of routers which can handle a= few terabits of data in the data plane. These routers might typically have= gigabit Ethernet links to the control processor, but I doubt that any of t= hem could handle Map-Requests coming in at line rate at a gigabit. Thus the= ratio between the speed of the control plane the speed of the data plane i= s significantly greater than 1000. I understand that many PE routers have s= lower data planes (and the CE "wireless router" that sits in each of our ho= mes is of course a lot slower than this), but large data centers or large e= nterprise sites could very well be connected to their service provider via = a few very high speed PE routers. Therefore an attack that would be trivial= to handle in the data plane (say, a few gigabits) could overwhelm the cont= rol plane.=20 >=20 You are absolutely right, but why this is specific to LISP? It is not specific to LISP, so there is no reason to discuss such an issue in this document. RWC> Discussed elsewhere, but this is specific to LISP because with=20 RWC> LISP data-plane traffic can trigger control-plane map requests.=20 > Gleaning allows incoming packets to create map requests, which allows a d= ata plane attack to turn into a control plane attack. Given the difference = in speeds between the data plane and the control plane, this makes it much = easier to create an effective DOS attack.=20 >=20 RFC6830 already considered rate limiting fo this very reason. RWC> Of course you can rate limit map requests and responses and thus=20 RWC> turn a "shut the control-plane" attack into a "shut the mapping=20 RWC> system" attack, but this still can take out the mapping system (or a RWC> part thereof). >=20 > Section 8 (Security Considerations).=20 >=20 > I am pleased that you removed the sentence from section 1 of the previous= (-08) draft that read: "As a result of the performed analysis, the docume= nt discusses the severity of the threats and proposes recommendations to re= ach the same level of security in LISP than in Internet today (e.g., withou= t LISP)". This sentence was not actually correct. However, in looking throu= gh the document and in thinking about the implications (see the rest of thi= s email) it is quite clear that the security of an Internet using LISP woul= d be significantly less than the current Internet (at least if you assume t= hat there is *any* security at all in the current Internet). I am thinking = that there should be a sentence at the end of section 8 to the effect that = "At the current time it appears that LISP would have significant security i= mplications if deployed on an Internet-wide scale". >=20 >=20 Such sentence would not represent the discussions that took place in the LISP WG in the last four years. The arguments that you raised in the previous part of this mail are mainly not LISP-specific, while the experience gathered in the last years show that LISP is not worst that what we have today (and actually research work out there shows that it can even be helpful to use LISP) RWC> LISP has not been sufficiently widely deployed to be of interest to=20 RWC> serious professional attackers. My concerns are LISP-specific and I RWC> would hope that you would make an honest attempt to adequately=20 RWC> understand the security aspects of it, rather than just trying to=20 RWC> whitewash the approach.=20 > Finally, two items left out: >=20 > I don't see any discussion on the effect of LISP on firewalls. I am assum= ing that pretty much all currently deployed firewalls are not able to look = past a LISP header to inspect the contents of packets. At a minimum, this w= ould seem to imply that LISP will need to be deployed toward the Internet c= ore from the current firewalls, so that the firewalls can be looking at nor= mal (unchanged) IP packets. >=20 >=20 Deployment model is out of the scope of this document and the problem is not specific to LISP. RWC> This would be a trivial update to the document that would make it=20 RWC> more complete, but is not a major point.=20 > There is another issue which might belong in the section on privacy: In t= he Internet today if you want to attack a network with prefix aa.bb/16, and= you see this advertisement in the BGP routes, you can pick a random addres= s and send a packet and see if anything happens. You get little feedback. W= ith LISP you can send a map request to a random address in the block and ge= t back a map reply. This gives you an RLOC which is in general the actual I= P address of a real PE or CE router. Of course you can repeat this across t= he entire /16, or even the Internet (given sufficient time and traffic), an= d get something close to a complete list of LISP xTRs. This implies that if= service providers implement LISP on PE routers, then they will be exposing= the identity of their PE routers to worldwide inspection. Given the number= of PE routers in the world (obviously much larger than the number of servi= ce providers, and given PA address aggregation probably larger than the num= ber of routes that show u > p in the BGP routing table) we should expect that there are lots of PE ro= uters that have not been carefully secured, and exposing their existence to= open worldwide easy discovery would likely open the door to a number of at= tacks that involve compromise of PE routers. Of course if LISP is deployed = on CE routers then their RLOC would similarly be exposed.=20 >=20 If routers are not correctly secured, there is no problem linked to LISP as today it is already possible to discover the IP address of theses routers thanks to various techniques. Moreover, section 6 already clearly states that privacy is not discussed in the document but that the attacks presented in the document can potentially play a role in privacy threats. RWC> Again, saying in the document that some important security aspects RWC> are not considered is not a valid way to produce a sound analysis RWC> of the security implications of LISP. Privacy is a valid issue that=20 RWC> needs to be considered.=20 Thanks, Ross > -----Original Message----- > From: lisp [mailto:lisp-bounces@ietf.org] On Behalf Of Joel M. Halpern > Sent: Friday, May 09, 2014 11:54 AM > To: lisp@ietf.org > Subject: [lisp] Restarting last call on LISP threats >=20 > Sorry for the delay getting this out. > This email starts a new (and hopefully final) last call on=20 > draft-ietf-lisp-threats, version 9: > http://datatracker.ietf.org/doc/draft-ietf-lisp-threats/ >=20 > The last call will end in two weeks, close of business 23-May-2014. >=20 > Thank you, > Joel >=20 > _______________________________________________ > lisp mailing list > lisp@ietf.org > https://www.ietf.org/mailman/listinfo/lisp From nobody Sat May 24 00:56:23 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D74271A01DF for ; Sat, 24 May 2014 00:56:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.551 X-Spam-Level: X-Spam-Status: No, score=-1.551 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8wJ70W18NU9a for ; Sat, 24 May 2014 00:56:19 -0700 (PDT) Received: from triangulum.uberspace.de (triangulum.uberspace.de [95.143.172.227]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 89E171A00F2 for ; Sat, 24 May 2014 00:56:19 -0700 (PDT) Received: (qmail 15508 invoked from network); 24 May 2014 07:56:15 -0000 Received: from localhost (HELO webmail.triangulum.uberspace.de) (127.0.0.1) by localhost with SMTP; 24 May 2014 07:56:15 -0000 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Date: Sat, 24 May 2014 09:56:14 +0200 From: Rene Bartsch To: lisp@ietf.org Message-ID: <46de27bbedcf27377ee534a942874d6d@triangulum.uberspace.de> X-Sender: ietf@bartschnet.de User-Agent: Roundcube Webmail/0.9.5 Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/d-ALq-HLNDPdrhTjWwEnNsC6xnk Subject: [lisp] NAT status of beta network and LISPmob X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 24 May 2014 07:56:21 -0000 Hi, last year there were intentions to upgrade all proxy tunnel routers to NAT capability at the beginning of this year. There's also a version 0.4 of LISPmob, meanwhile. Ist it possible to use router mode with multiple EIDs/EID-prefixes (e.g. IPv4 and IPv6 at the same time) with LISPmob and beta network, now? -- Best regards, Rene Bartsch, B. Sc. Informatics From nobody Sat May 24 03:22:08 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D7B3C1A0157 for ; Sat, 24 May 2014 03:22:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0TzzMkwB_h3P for ; Sat, 24 May 2014 03:22:05 -0700 (PDT) Received: from roura.ac.upc.es (roura.ac.upc.edu [147.83.33.10]) by ietfa.amsl.com (Postfix) with ESMTP id 174791A0154 for ; Sat, 24 May 2014 03:22:03 -0700 (PDT) Received: from gw-2.ac.upc.es (gw-2.ac.upc.es [147.83.30.8]) by roura.ac.upc.es (8.13.8/8.13.8) with ESMTP id s4OALwFe010621; Sat, 24 May 2014 12:21:58 +0200 Received: from dhcp-10-61-108-106.cisco.com (173-38-208-169.cisco.com [173.38.208.169]) by gw-2.ac.upc.es (Postfix) with ESMTPSA id 79E367E7; Sat, 24 May 2014 12:21:56 +0200 (CEST) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.2\)) From: Lori Jakab In-Reply-To: <46de27bbedcf27377ee534a942874d6d@triangulum.uberspace.de> Date: Sat, 24 May 2014 13:21:53 +0300 Content-Transfer-Encoding: quoted-printable Message-Id: References: <46de27bbedcf27377ee534a942874d6d@triangulum.uberspace.de> To: Rene Bartsch X-Mailer: Apple Mail (2.1878.2) Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/3GT_Q7f24D7_grGgPTE6ajDhCjg Cc: lisp@ietf.org Subject: Re: [lisp] NAT status of beta network and LISPmob X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 24 May 2014 10:22:07 -0000 On May 24, 2014, at 10:56 AM, Rene Bartsch wrote: > Hi, >=20 > last year there were intentions to upgrade all proxy tunnel routers to = NAT capability at the beginning of this year. Actually, it=92s the Map-Servers that need to be upgraded, and RTRs = added. However, the IOS NAT implementation hasn=92t received enough = testing and validation yet to be considered ready for wide deployment. = We do have some NAT infrastructure in place on the Beta network, so if = you=92re ok with receiving best effort support if you run into issues, = please contact lisp-support@cisco.com to get you hooked up. > There's also a version 0.4 of LISPmob, meanwhile. Yes, that version does support NAT traversal, and some users are running = it successfully on the Beta network. >=20 > Ist it possible to use router mode with multiple EIDs/EID-prefixes = (e.g. IPv4 and IPv6 at the same time) with LISPmob and beta network, = now? I=92m not sure about that, please ask on the users@lispmob.org mailing = list. Best regards, -Lori= From nobody Sun May 25 21:51:33 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 90E021A046C for ; Sun, 25 May 2014 21:51:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.902 X-Spam-Level: X-Spam-Status: No, score=-101.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l3GQlJwZXc91 for ; Sun, 25 May 2014 21:51:29 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0145.outbound.protection.outlook.com [207.46.163.145]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 503091A0454 for ; Sun, 25 May 2014 21:51:29 -0700 (PDT) Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB443.namprd05.prod.outlook.com (10.141.73.152) with Microsoft SMTP Server (TLS) id 15.0.944.11; Mon, 26 May 2014 04:51:24 +0000 Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) with mapi id 15.00.0949.001; Mon, 26 May 2014 04:51:24 +0000 From: Ronald Bonica To: Dino Farinacci Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEIABfmkAgAefyVCAAITngIABbBJggAEZ+ICABCHVsA== Date: Mon, 26 May 2014 04:51:22 +0000 Message-ID: <1ed6bc991bb04281936d66c9bba4aa9c@CO1PR05MB442.namprd05.prod.outlook.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.14] x-forefront-prvs: 02234DBFF6 x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(51704005)(189002)(199002)(87936001)(81542001)(20776003)(92566001)(80022001)(21056001)(74502001)(74662001)(76576001)(77982001)(4396001)(86362001)(99286001)(31966008)(1411001)(81342001)(46102001)(83072002)(33646001)(64706001)(66066001)(101416001)(99396002)(54356999)(2656002)(76176999)(74316001)(85852003)(50986999)(83322001)(76482001)(79102001)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO1PR05MB443; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/aV-w5WQdyQT0-kJh4P2FIiZKoHA Cc: Roger Jorgensen , "lisp@ietf.org" Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 May 2014 04:51:31 -0000 Dino, You have a very good point! Rather than arguing about whether DoS attacks a= gainst the control plane are possible, a more constructive course of action= might be: a) to document the attacks b) to brainstorm for mitgations IMHO, a) should definitely happen in the threats document. It should includ= e DoS attacks initiated by attackers: a1) who are outside of LISP sites a2) who are inside of LISP sites Mitigations could be documented in the threats document or somewhere else. = The AD's and chairs will probably want to make that call. Do you see an obvious mitigation to A1 and A2? Ron >=20 > > activity causes control plane activity. Since forwarding plane bandwidt= h > exceeds control plane bandwidth, DoS attacks against the control plane ar= e > possible. >=20 > Yes, for every protocol we have invented. But like I said, there are bett= er > ways to solve this with LISP. If you look at all the drafts in totality, = you will see > we have a decent toolbox of solutions that COULD fight this traditional > problem. >=20 > You are merely (and continually) looking ONLY at the map-cache miss > problem. >=20 > > In order to be complete, the threats document must describe the DoS > threat. It should also describe mitigations, if any exist. >=20 > I agree with that. No one is arguing your point or Ross point. But rather= than > just documenting what they are, we want to fix them. So that is were we > should put our attention. So let's have all of us work together and ident= ify > the problems and brainstorm about fixes. >=20 > Rather than just saying what is wrong. >=20 > Dino >=20 From nobody Sun May 25 22:06:26 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2FB3A1A047B for ; Sun, 25 May 2014 22:06:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oy6v_x9Kzu7N for ; Sun, 25 May 2014 22:06:22 -0700 (PDT) Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2lp0203.outbound.protection.outlook.com [207.46.163.203]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EFEA31A047A for ; Sun, 25 May 2014 22:06:21 -0700 (PDT) Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) with Microsoft SMTP Server (TLS) id 15.0.949.11; Mon, 26 May 2014 05:06:16 +0000 Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) with mapi id 15.00.0949.001; Mon, 26 May 2014 05:06:16 +0000 From: Ronald Bonica To: Damien Saucez Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEIABfmkAgAefyVCAAITngIABbBJggAETbwCABC0O0A== Date: Mon, 26 May 2014 05:06:16 +0000 Message-ID: References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> In-Reply-To: <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.14] x-forefront-prvs: 02234DBFF6 x-forefront-antispam-report: SFV:NSPM; SFS:(428001)(377454003)(13464003)(24454002)(199002)(189002)(33646001)(76576001)(21056001)(4396001)(15975445006)(77982001)(31966008)(74662001)(74502001)(81542001)(81342001)(76482001)(74316001)(46102001)(54356999)(76176999)(87936001)(83072002)(92566001)(16236675002)(79102001)(19580395003)(19625215002)(83322001)(85852003)(50986999)(19580405001)(20776003)(64706001)(99396002)(2656002)(99286001)(101416001)(86362001)(19300405004)(66066001)(15202345003)(80022001)(24736002)(19607625008); DIR:OUT; SFP:; SCL:1; SRVR:CO1PR05MB442; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; Content-Type: multipart/alternative; boundary="_000_dd849ce0cca749c885c5b8a1e989f758CO1PR05MB442namprd05pro_" MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/ENS30OExksRJyYvurHpi5xcTmd8 Cc: Roger Jorgensen , LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 May 2014 05:06:25 -0000 --_000_dd849ce0cca749c885c5b8a1e989f758CO1PR05MB442namprd05pro_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable From: Damien Saucez [mailto:damien.saucez@gmail.com] Sent: Friday, May 23, 2014 9:07 AM To: Ronald Bonica Cc: Dino Farinacci; Roger Jorgensen; LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats Hello Ronald, On 22 May 2014, at 22:57, Ronald Bonica > wrote: Dino, Today's Internet is not as fragile as you think. This mail traversed many r= outers between my house and yours. If those routers are well-managed, there= is nothing that I can do from my house that will cause any of those router= s to consume control plane resources. Therefore, there is nothing that I ca= n do from my house that will cause a DoS attack against those routers' cont= rol planes. We tend to disagree with that, for example you have ICMP today... [RPB] Because ICMP is susceptible to DoS attacks, it wouldn't make a very g= ood routing protocol. That's why we don't use it for routing. By contrast, = LISP map-request messages are susceptible to DoS attacks and they do carry = routing information. In LISP, separation between the forwarding and control plane is lost. As a = matter of course, forwarding plane activity causes control plane activity. = Since forwarding plane bandwidth exceeds control plane bandwidth, DoS attac= ks against the control plane are possible. In order to be complete, the threats document must describe the DoS threat.= It should also describe mitigations, if any exist. DoS is already explained and the definition given: " A Denial of Service (DoS) attack aims at disrupting a specific targeted service either by exhausting the resources of the victim up to the point that it is not able to provide a reliable service to legit traffic and/or systems or by exploiting vulnerabilities to make the targeted service unable to operate properly. " is covering the case you mention. [RPB] You might want to add the following details to section 5.2: - A DoS attack can be launched by anybody who can send a packet to= the XTR's LOC - DoS attacks can render an XTR inoperable - DDoS attacks can render the mapping system inoperable. This is what differentiates LISP from today's routing system. Ron Damien Saucez = Ron -----Original Message----- From: Dino Farinacci [mailto:farinacci@gmail.com] Sent: Wednesday, May 21, 2014 6:58 PM To: Ronald Bonica Cc: Roger Jorgensen; lisp@ietf.org Subject: Re: [lisp] Restarting last call on LISP threats The attacker sends a flow of crafted packets to the victim XTR. Each packet is a well-formed LISP data packet. It contains: - an outer IP header (LOC->LOC) - a UDP header - a LISP Header - an IP header (EID->EID) - payload Just like a regular packet I can send to your home router today. So yes oka= y. So let's continue. See comments below. Each packet contains control plane information that is new to the victim Be more specific about what control information are in these encapsulated packets. XTR. For example, the victim XTR has no mapping information regarding either the source LOC or source EID prefix. Rather than gleaning this mappi= ng information from the crafted packet, the victim XTR sends a verifying MAP- REQUEST to the mapping system. Assume that the attack flow is large (N packets per second). Assume also that the XTRs rate limit for MAP-REQUEST messages is less than N packets per second. Has the attack not effectively DoS'd the victim XTR? It caches the rate the rate the packets are coming in and eventually stops sending Map-Requests completely. It cannot stop the incoming rate of packets today just like a roque BGP attacker can send millions of packets per second to a peer regardless if it does or does not have the peer authentication key. To make this attack work, every packet in the attack flow may need to have a unique, spoofed, source LOC. An implementation can detect that after rate limiting 1000s of such request= s are happening that it just stops operation. What if I sent a Juniper 20 million routes today? The Internet is very fragile and LISP IS NOT making it worse. And in some cases it is making it better with integrated techniques. Dino _______________________________________________ lisp mailing list lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp --_000_dd849ce0cca749c885c5b8a1e989f758CO1PR05MB442namprd05pro_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

 <= /p>

 <= /p>

From: Damien= Saucez [mailto:damien.saucez@gmail.com]
Sent: Friday, May 23, 2014 9:07 AM
To: Ronald Bonica
Cc: Dino Farinacci; Roger Jorgensen; LISP mailing list list
Subject: Re: [lisp] Restarting last call on LISP threats<= /span>

 

Hello Ronald,

 

 

On 22 May 2014, at 22:57, Ronald Bonica <rbonica@juniper.net> wrote:



Dino,

Today's Internet is not as fragile as you think. This mail traversed many r= outers between my house and yours. If those routers are well-managed, there= is nothing that I can do from my house that will cause any of those router= s to consume control plane resources. Therefore, there is nothing that I can do from my house that will cause a = DoS attack against those routers' control planes.

We tend to disagree with that, for example you have = ICMP today...

[RPB] Because ICMP = is susceptible to DoS attacks, it wouldn’t make a very good routing p= rotocol. That’s why we don’t use it for routing. By contrast, LISP map-request messages are susceptible to DoS attacks and they do carry= routing information.

 <= /p>



In LISP, separation b= etween the forwarding and control plane is lost. As a matter of course, for= warding plane activity causes control plane activity. Since forwarding plan= e bandwidth exceeds control plane bandwidth, DoS attacks against the control plane are possible.

In order to be complete, the threats document must describe the DoS threat.= It should also describe mitigations, if any exist.

 

DoS is already explained and the definition given:

 

" A Denial of Service (DoS) attack aims at disr= upting a specific

&n=
bsp;  targeted service either by exhausting the resources of the victi=
m up
&n=
bsp;  to the point that it is not able to provide a reliable service t=
o
&n=
bsp;  legit traffic and/or systems or by exploiting vulnerabilities to=
 make
&n=
bsp;  the targeted service unable to operate properly.

"

 

is covering the case you mention.

[RPB]

You might want to a= dd the following details to section 5.2:

 

- =          A DoS attack can = be launched by anybody who can send a packet to the XTR’s LOC

- =          DoS attacks can r= ender an XTR inoperable

- =          DDoS attacks can = render the mapping system inoperable.

 <= /p>

This is what differentiat= es LISP from today’s routing system.

 <= /p>

    &= nbsp;           &nbs= p;            &= nbsp;        Ron

 <= /p>

 

Damien Saucez 



        &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;          Ron



-----Original Message-----
From: Dino Farinacci [mailto:farinac= ci@gmail.com]
Sent: Wednesday, May 21, 2014 6:58 PM
To: Ronald Bonica
Cc: Roger Jorgensen; lisp@ietf.org
Subject: Re: [lisp] Restarting last call on LISP threats


The attacker sends a flow of crafted packets to the = victim XTR. Each packet

is a well-formed LISP data packet. It contains:


- an outer IP header (LOC->LOC)
- a UDP header
- a LISP Header
- an IP header (EID->EID)
- payload


Just like a regular packet I can send to your home router today. So yes oka= y.
So let's continue. See comments below.


Each packet contains control plane information that = is new to the victim


Be more specific about what control information are in these encapsulated packets.


XTR. For example, the victim XTR has no mapping info= rmation regarding

either the source LOC or source EID prefix. Rather t= han gleaning this mapping
information from the crafted packet, the victim XTR sends a verifying MAP-<= br> REQUEST to the mapping system.


Assume that the attack flow is large (N packets per second). Assume also

that the XTRs rate limit for MAP-REQUEST messages is= less than N packets
per second. Has the attack not effectively DoS'd the victim XTR?

It caches the rate the rate the packets are coming in and eventually stops<= br> sending Map-Requests completely.

It cannot stop the incoming rate of packets today just like a roque BGP
attacker can send millions of packets per second to a peer regardless if it=
does or does not have the peer authentication key.


To make this attack work, every packet in the attack= flow may need to have

a unique, spoofed, source LOC.

An implementation can detect that after rate limiting 1000s of such request= s
are happening that it just stops operation.

What if I sent a Juniper 20 million routes today?

The Internet is very fragile and LISP IS NOT making it worse. And in some cases it is making it better with integrated techniques.

Dino


_______________________________________________
lisp mailing list
lisp@ietf.org
https://www.ietf.org= /mailman/listinfo/lisp

 

--_000_dd849ce0cca749c885c5b8a1e989f758CO1PR05MB442namprd05pro_-- From nobody Mon May 26 04:03:51 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 570111A00F4 for ; Mon, 26 May 2014 04:03:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.7 X-Spam-Level: X-Spam-Status: No, score=-1.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, MIME_8BIT_HEADER=0.3, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0iK6TJA2WgQC for ; Mon, 26 May 2014 04:03:48 -0700 (PDT) Received: from mail-wg0-x22a.google.com (mail-wg0-x22a.google.com [IPv6:2a00:1450:400c:c00::22a]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 083C91A00DE for ; Mon, 26 May 2014 04:03:47 -0700 (PDT) Received: by mail-wg0-f42.google.com with SMTP id y10so7642865wgg.1 for ; Mon, 26 May 2014 04:03:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=tf8+MFoHKc9YT0Xb2zWwk7aMf2LruCraX/XwU0qtWf4=; b=i4BiAeeJPwqx0rgEJnpn2oo1a00Kqkymb0VaCeRTt1BpoZiUrY8lAnzuT+OzFBPnaa 0K1C0WZKVC1F1vUVnZXqzSReeMwrGQ7JahYhwJ6vkpBjwgQI1F3ye1VWLA8G/+pqJolT R6YwfpLaKD87cwA49plDJirInpFNz9g71qJSJ3Uv3+t5A7W48EMBhVV672tKhwBdpOdN z0N0tHrX8nExtYicly64z2eNcJjAhYZVNHTv73v/T70yH7XSEnuf3NpNgLfFYhqXwuSW ChIKmg7E7jIO0gUXDESsf0dU1pwU1B+odFDaIy8kdGvtjtE1xhnpLyhxqlwL4E3ccVdM kpGg== MIME-Version: 1.0 X-Received: by 10.180.19.37 with SMTP id b5mr1975610wie.16.1401102224177; Mon, 26 May 2014 04:03:44 -0700 (PDT) Received: by 10.216.210.6 with HTTP; Mon, 26 May 2014 04:03:44 -0700 (PDT) In-Reply-To: <16a14e1029954a9cb74c6115dd3c1a71@CO2PR05MB636.namprd05.prod.outlook.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <16a14e1029954a9cb74c6115dd3c1a71@CO2PR05MB636.namprd05.prod.outlook.com> Date: Mon, 26 May 2014 13:03:44 +0200 Message-ID: From: =?UTF-8?Q?Roger_J=C3=B8rgensen?= To: Ross Callon Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/j_5YnBM-cjfZ3COl1Lni_N1-uzA Cc: LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 May 2014 11:03:49 -0000 A general reply, we were on the way to getting into a head-to-head discussion instead of being constructive. The last few email I read moved away from that path. I think we should discuss all threat, not just define them to be out of sco= pe. some comments: On Fri, May 23, 2014 at 4:36 PM, Ross Callon wrote: > Detailed comments below. To summarize, these details include three threat= s which are new to LISP and which are not adequately explained in the curre= nt threats document: > > (1) The Control Plane Threat: LISP allows a dataplane DOS attack (lots o= f packets sent to overwhelm a site) to turn into a control plane attack (th= e router is forced to respond to the attack in the control plane, which is = of course frequently multiple orders of magnitude slower than the data plan= e, particularly for very high speed routers). Seems like we all disagree on how serious this is, how much harm it can do. But it should be mention. I think I remember an earlier discussion on a very similar topic that just ended with people disagreeing and stopped discussing it. This is probably a new topic, but where is the weakness really, Mapping-System or on the xTR side? ...? Could be that our ongoing discussion here might be because it's not good enough explained? > (2) The Privacy Threat: LISP provides an attacker with a relatively easy= way to determine the identity of large numbers of PE and/or CE routers (gl= obally, if LISP is deployed on that level) . I agree there are privacy threats. LISP is no better or worse compared to current internet on privacy for end-user, it's reveled one way or another somehow unless you encrypt your data (HTTPs etc). What LISP add to the pool is the possibility to collect the IP for many end-sites with ease, xTR sides. Is that the same thing as what you're describing? > (3) the Traffic Gleaning Threat: If an xTR gleans EID -> RLOC mappings f= rom incoming packets, this provides an easy way for hackers to intercept tr= affic. I put this threat third because gleaning can be turned off, and thus= this threat can be defeated simply by not gleaning EID -> RLOC mappings. Isn't this the same as on-path and Man-in-the-middle attack? Or do you describe something else? --=20 Roger Jorgensen | ROJO9-RIPE rogerj@gmail.com | - IPv6 is The Key! http://www.jorgensen.no | roger@jorgensen.no From nobody Mon May 26 08:46:43 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A93031A01AF for ; Mon, 26 May 2014 08:46:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aZxlQIlT5USq for ; Mon, 26 May 2014 08:46:40 -0700 (PDT) Received: from mailc1.tigertech.net (mailc1.tigertech.net [208.80.4.155]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EE9F11A01A0 for ; Mon, 26 May 2014 08:46:39 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mailc1.tigertech.net (Postfix) with ESMTP id CDEAE1C9B252; Mon, 26 May 2014 08:46:36 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at c1.tigertech.net Received: from Joels-MacBook-Pro.local (pool-70-106-135-10.clppva.east.verizon.net [70.106.135.10]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mailc1.tigertech.net (Postfix) with ESMTPSA id 7F1201C9B24C; Mon, 26 May 2014 08:46:35 -0700 (PDT) Message-ID: <538361DA.10808@joelhalpern.com> Date: Mon, 26 May 2014 11:46:34 -0400 From: "Joel M. Halpern" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.5.0 MIME-Version: 1.0 To: Ronald Bonica , Damien Saucez References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/Lh5ywkvrAjPzvfEaN4FeZMFQ-gA Cc: Roger Jorgensen , LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 May 2014 15:46:41 -0000 Top posting to make sure I am understanding: You asssert that any xTR is subject to a DoS attack. And that such a DoS attack can render the mapping system unusable. It targeting an ITR, this would need to be from within ths cope the ITR serves. I believe that is discussed. If I have connected the dots correctly, the attack you are contemplating is sending a large stream of packets with different inner source addresses to an ETR. This would prompt the ETR to check with the mapping system about each and every address. If I have understood this properly, while there are several very effective mitigations, that does not change the basic message that this is an attack, and as such ought to be described in the threats document. There are clealry a number of variations on this attack. For example, using the same outer source address makes mitigation easier, while using different outer source addresses either requires a bot-net or a large unchecked BCP38 hole (and those can be used for MANY attacks on many systems.) Both presumably should be described. Have I captured your request accurately? Yours, Joel On 5/26/14, 1:06 AM, Ronald Bonica wrote: > *From:*Damien Saucez [mailto:damien.saucez@gmail.com] > *Sent:* Friday, May 23, 2014 9:07 AM > *To:* Ronald Bonica > *Cc:* Dino Farinacci; Roger Jorgensen; LISP mailing list list > *Subject:* Re: [lisp] Restarting last call on LISP threats > > Hello Ronald, > > On 22 May 2014, at 22:57, Ronald Bonica > wrote: > > > > Dino, > > Today's Internet is not as fragile as you think. This mail traversed > many routers between my house and yours. If those routers are > well-managed, there is nothing that I can do from my house that will > cause any of those routers to consume control plane resources. > Therefore, there is nothing that I can do from my house that will > cause a DoS attack against those routers' control planes. > > We tend to disagree with that, for example you have ICMP today... > > */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn’t make a > very good routing protocol. That’s why we don’t use it for routing. By > contrast, LISP map-request messages are susceptible to DoS attacks and > they do carry routing information./* > > > > In LISP, separation between the forwarding and control plane is > lost. As a matter of course, forwarding plane activity causes > control plane activity. Since forwarding plane bandwidth exceeds > control plane bandwidth, DoS attacks against the control plane are > possible. > > In order to be complete, the threats document must describe the DoS > threat. It should also describe mitigations, if any exist. > > DoS is already explained and the definition given: > > " A Denial of Service (DoS) attack aims at disrupting a specific > > targeted service either by exhausting the resources of the victim up > > to the point that it is not able to provide a reliable service to > > legit traffic and/or systems or by exploiting vulnerabilities to make > > the targeted service unable to operate properly. > > " > > is covering the case you mention. > > */[RPB] /* > > */You might want to add the following details to section 5.2:/* > > *//* > > -A DoS attack can be launched by anybody who can send a packet to the > XTR’s LOC > > -DoS attacks can render an XTR inoperable > > -DDoS attacks can render the mapping system inoperable. > > This is what differentiates LISP from today’s routing system. > > Ron > > Damien Saucez > > > > Ron > > > > -----Original Message----- > From: Dino Farinacci [mailto:farinacci@gmail.com] > Sent: Wednesday, May 21, 2014 6:58 PM > To: Ronald Bonica > Cc: Roger Jorgensen; lisp@ietf.org > Subject: Re: [lisp] Restarting last call on LISP threats > > > The attacker sends a flow of crafted packets to the victim > XTR. Each packet > > is a well-formed LISP data packet. It contains: > > > - an outer IP header (LOC->LOC) > - a UDP header > - a LISP Header > - an IP header (EID->EID) > - payload > > > Just like a regular packet I can send to your home router today. > So yes okay. > So let's continue. See comments below. > > > Each packet contains control plane information that is new > to the victim > > > Be more specific about what control information are in these > encapsulated > packets. > > > XTR. For example, the victim XTR has no mapping information > regarding > > either the source LOC or source EID prefix. Rather than gleaning > this mapping > information from the crafted packet, the victim XTR sends a > verifying MAP- > REQUEST to the mapping system. > > > Assume that the attack flow is large (N packets per second). > Assume also > > that the XTRs rate limit for MAP-REQUEST messages is less than N > packets > per second. Has the attack not effectively DoS'd the victim XTR? > > It caches the rate the rate the packets are coming in and > eventually stops > sending Map-Requests completely. > > It cannot stop the incoming rate of packets today just like a > roque BGP > attacker can send millions of packets per second to a peer > regardless if it > does or does not have the peer authentication key. > > > To make this attack work, every packet in the attack flow > may need to have > > a unique, spoofed, source LOC. > > An implementation can detect that after rate limiting 1000s of > such requests > are happening that it just stops operation. > > What if I sent a Juniper 20 million routes today? > > The Internet is very fragile and LISP IS NOT making it worse. > And in some > cases it is making it better with integrated techniques. > > Dino > > > _______________________________________________ > lisp mailing list > lisp@ietf.org > https://www.ietf.org/mailman/listinfo/lisp > > > > _______________________________________________ > lisp mailing list > lisp@ietf.org > https://www.ietf.org/mailman/listinfo/lisp > From nobody Mon May 26 08:57:50 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF8AA1A01A9 for ; Mon, 26 May 2014 08:57:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.601 X-Spam-Level: X-Spam-Status: No, score=-102.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jP7aqjJ3J4Ut for ; Mon, 26 May 2014 08:57:44 -0700 (PDT) Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2lp0208.outbound.protection.outlook.com [207.46.163.208]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D0C691A01A0 for ; Mon, 26 May 2014 08:57:43 -0700 (PDT) Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB441.namprd05.prod.outlook.com (10.141.73.147) with Microsoft SMTP Server (TLS) id 15.0.949.11; Mon, 26 May 2014 15:57:38 +0000 Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) with mapi id 15.00.0949.001; Mon, 26 May 2014 15:57:37 +0000 From: Ronald Bonica To: "Joel M. Halpern" , Damien Saucez Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEIABfmkAgAefyVCAAITngIABbBJggAETbwCABC0O0IAAtqUAgAABTnA= Date: Mon, 26 May 2014 15:57:37 +0000 Message-ID: <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <538361DA.10808@joelhalpern.com> In-Reply-To: <538361DA.10808@joelhalpern.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.14] x-forefront-prvs: 02234DBFF6 x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(199002)(189002)(24454002)(479174003)(377454003)(51704005)(13464003)(54356999)(87936001)(50986999)(76176999)(83072002)(2656002)(85852003)(74502001)(99396002)(99286001)(74662001)(31966008)(4396001)(19580395003)(83322001)(19580405001)(15975445006)(21056001)(101416001)(92566001)(77982001)(46102001)(76482001)(86362001)(66066001)(64706001)(80022001)(20776003)(81342001)(33646001)(76576001)(81542001)(74316001)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO1PR05MB441; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/KIYmUW5Il0RorgUSx1MNocOQY6I Cc: Roger Jorgensen , LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 May 2014 15:57:47 -0000 Inline..... > -----Original Message----- > From: Joel M. Halpern [mailto:jmh@joelhalpern.com] > Sent: Monday, May 26, 2014 11:47 AM > To: Ronald Bonica; Damien Saucez > Cc: Roger Jorgensen; LISP mailing list list > Subject: Re: [lisp] Restarting last call on LISP threats >=20 > Top posting to make sure I am understanding: >=20 > You asssert that any xTR is subject to a DoS attack. And that such a DoS > attack can render the mapping system unusable. [RPB]=20 Exactly! >=20 > It targeting an ITR, this would need to be from within ths cope the ITR s= erves. [RPB]=20 I don't understand this sentence. Please try again. > I believe that is discussed. [RPB]=20 Given that I don't understand the sentence above, I have no idea if this se= ntence is true. >=20 > If I have connected the dots correctly, the attack you are contemplating = is > sending a large stream of packets with different inner source addresses t= o an > ETR. This would prompt the ETR to check with the mapping system about > each and every address. [RPB]=20 Exactly! >=20 > If I have understood this properly, while there are several very effectiv= e > mitigations, that does not change the basic message that this is an attac= k, and > as such ought to be described in the threats document. [RPB]=20 Even if there are effective mitigations, the attack should be described. However, I am not convinced that an effective mitigation exists. > There are clealry a number of variations on this attack. [RPB]=20 True! For example, using > the same outer source address makes mitigation easier, while using differ= ent > outer source addresses either requires a bot-net or a large unchecked BCP= 38 > hole (and those can be used for MANY attacks on many > systems.) Both presumably should be described. [RPB]=20 Yes, both should be described. Also, recall that large BCP38 holes exist in today's internet. >=20 > Have I captured your request accurately? [RPB]=20 Pretty much. Thanks for taking the effort. Ron >=20 > Yours, > Joel >=20 > On 5/26/14, 1:06 AM, Ronald Bonica wrote: > > *From:*Damien Saucez [mailto:damien.saucez@gmail.com] > > *Sent:* Friday, May 23, 2014 9:07 AM > > *To:* Ronald Bonica > > *Cc:* Dino Farinacci; Roger Jorgensen; LISP mailing list list > > *Subject:* Re: [lisp] Restarting last call on LISP threats > > > > Hello Ronald, > > > > On 22 May 2014, at 22:57, Ronald Bonica > > wrote: > > > > > > > > Dino, > > > > Today's Internet is not as fragile as you think. This mail traverse= d > > many routers between my house and yours. If those routers are > > well-managed, there is nothing that I can do from my house that wil= l > > cause any of those routers to consume control plane resources. > > Therefore, there is nothing that I can do from my house that will > > cause a DoS attack against those routers' control planes. > > > > We tend to disagree with that, for example you have ICMP today... > > > > */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn't make a > > very good routing protocol. That's why we don't use it for routing. By > > contrast, LISP map-request messages are susceptible to DoS attacks and > > they do carry routing information./* > > > > > > > > In LISP, separation between the forwarding and control plane is > > lost. As a matter of course, forwarding plane activity causes > > control plane activity. Since forwarding plane bandwidth exceeds > > control plane bandwidth, DoS attacks against the control plane are > > possible. > > > > In order to be complete, the threats document must describe the DoS > > threat. It should also describe mitigations, if any exist. > > > > DoS is already explained and the definition given: > > > > " A Denial of Service (DoS) attack aims at disrupting a specific > > > > targeted service either by exhausting the resources of the victim > > up > > > > to the point that it is not able to provide a reliable service to > > > > legit traffic and/or systems or by exploiting vulnerabilities to > > make > > > > the targeted service unable to operate properly. > > > > " > > > > is covering the case you mention. > > > > */[RPB] /* > > > > */You might want to add the following details to section 5.2:/* > > > > *//* > > > > -A DoS attack can be launched by anybody who can send a packet to the > > XTR's LOC > > > > -DoS attacks can render an XTR inoperable > > > > -DDoS attacks can render the mapping system inoperable. > > > > This is what differentiates LISP from today's routing system. > > > > Ron > > > > Damien Saucez > > > > > > > > > > Ron > > > > > > > > -----Original Message----- > > From: Dino Farinacci [mailto:farinacci@gmail.com] > > Sent: Wednesday, May 21, 2014 6:58 PM > > To: Ronald Bonica > > Cc: Roger Jorgensen; lisp@ietf.org > > Subject: Re: [lisp] Restarting last call on LISP threats > > > > > > The attacker sends a flow of crafted packets to the victim > > XTR. Each packet > > > > is a well-formed LISP data packet. It contains: > > > > > > - an outer IP header (LOC->LOC) > > - a UDP header > > - a LISP Header > > - an IP header (EID->EID) > > - payload > > > > > > Just like a regular packet I can send to your home router today= . > > So yes okay. > > So let's continue. See comments below. > > > > > > Each packet contains control plane information that is new > > to the victim > > > > > > Be more specific about what control information are in these > > encapsulated > > packets. > > > > > > XTR. For example, the victim XTR has no mapping information > > regarding > > > > either the source LOC or source EID prefix. Rather than gleanin= g > > this mapping > > information from the crafted packet, the victim XTR sends a > > verifying MAP- > > REQUEST to the mapping system. > > > > > > Assume that the attack flow is large (N packets per second)= . > > Assume also > > > > that the XTRs rate limit for MAP-REQUEST messages is less than = N > > packets > > per second. Has the attack not effectively DoS'd the victim XTR= ? > > > > It caches the rate the rate the packets are coming in and > > eventually stops > > sending Map-Requests completely. > > > > It cannot stop the incoming rate of packets today just like a > > roque BGP > > attacker can send millions of packets per second to a peer > > regardless if it > > does or does not have the peer authentication key. > > > > > > To make this attack work, every packet in the attack flow > > may need to have > > > > a unique, spoofed, source LOC. > > > > An implementation can detect that after rate limiting 1000s of > > such requests > > are happening that it just stops operation. > > > > What if I sent a Juniper 20 million routes today? > > > > The Internet is very fragile and LISP IS NOT making it worse. > > And in some > > cases it is making it better with integrated techniques. > > > > Dino > > > > > > _______________________________________________ > > lisp mailing list > > lisp@ietf.org > > https://www.ietf.org/mailman/listinfo/lisp > > > > > > > > _______________________________________________ > > lisp mailing list > > lisp@ietf.org > > https://www.ietf.org/mailman/listinfo/lisp > > From nobody Mon May 26 09:06:33 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 36FE71A019B for ; Mon, 26 May 2014 09:06:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fy9KKBb29Qv9 for ; Mon, 26 May 2014 09:06:27 -0700 (PDT) Received: from mail-yh0-x236.google.com (mail-yh0-x236.google.com [IPv6:2607:f8b0:4002:c01::236]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E49B21A01A5 for ; Mon, 26 May 2014 09:06:26 -0700 (PDT) Received: by mail-yh0-f54.google.com with SMTP id i57so6623529yha.27 for ; Mon, 26 May 2014 09:06:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=eDqAZJieCZ+CXwgHLWgeqhU19ZjiaNspnTwfN+IFgi4=; b=Zm1kFbx+Q5U6N2oYM/2tuP5qj7kwevaCDhg7cdWU+KrFHQ/uvYHzhcoLB3GYEaQ1nQ 0Ft60Iq1UPb7LOD9H/Xl5Xiw5ZaezMcMj0YHoI6Q5WwyC/nrQe6Nd6vtfSLKlLwZGnJS F1P1t4kulCU1nw7zIcioqO6a1sBOguP/HG9oZjgzw6lLvm34q3r57aEIHBBGoGB2RGF8 raGp5Sj6lX7eG3DKBgWZklajAa70UPzldBz5FiBzSHrMq0bYypBmpTpXF/FhHYmu5bOt d2JNZmnNtOmjYz62mvWIRHfSJy48uedZxv4S1FXyuko87t8HWe4gQ9QlLqnVM+kOp2Af 6k0w== X-Received: by 10.236.129.43 with SMTP id g31mr36266111yhi.86.1401120383828; Mon, 26 May 2014 09:06:23 -0700 (PDT) Received: from [192.168.1.102] (108-214-96-27.lightspeed.sntcca.sbcglobal.net. [108.214.96.27]) by mx.google.com with ESMTPSA id 37sm8084063yhu.26.2014.05.26.09.06.22 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 26 May 2014 09:06:23 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Sharon X-Mailer: iPhone Mail (11D201) In-Reply-To: <538361DA.10808@joelhalpern.com> Date: Mon, 26 May 2014 09:06:21 -0700 Content-Transfer-Encoding: quoted-printable Message-Id: References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <538361DA.10808@joelhalpern.com> To: "Joel M. Halpern" Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/TdsY8DkP6mf_fLp2I2pZiMlaDm0 Cc: Roger Jorgensen , LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 May 2014 16:06:29 -0000 Joel, thanks for clearing. It was hard to follow. If the challenge is for a distributed mapping system to keep track and prote= ct itself from a "sick" xTR, sick because of a bug or an attack.. Then perhaps we could maintain mapping lookup per sec counters per xTR in th= e mapping. It adds some overhead to the mapping, but doesn't slow down forwa= rding. Can be aggregated by map servers for efficiency. --szb On May 26, 2014, at 8:46 AM, "Joel M. Halpern" wrote: Top posting to make sure I am understanding: You asssert that any xTR is subject to a DoS attack. And that such a DoS at= tack can render the mapping system unusable. It targeting an ITR, this would need to be from within ths cope the ITR serv= es. I believe that is discussed. If I have connected the dots correctly, the attack you are contemplating is s= ending a large stream of packets with different inner source addresses to an= ETR. This would prompt the ETR to check with the mapping system about each= and every address. If I have understood this properly, while there are several very effective m= itigations, that does not change the basic message that this is an attack, a= nd as such ought to be described in the threats document. There are clealry= a number of variations on this attack. For example, using the same outer s= ource address makes mitigation easier, while using different outer source ad= dresses either requires a bot-net or a large unchecked BCP38 hole (and those= can be used for MANY attacks on many systems.) Both presumably should be d= escribed. Have I captured your request accurately? Yours, Joel > On 5/26/14, 1:06 AM, Ronald Bonica wrote: > *From:*Damien Saucez [mailto:damien.saucez@gmail.com] > *Sent:* Friday, May 23, 2014 9:07 AM > *To:* Ronald Bonica > *Cc:* Dino Farinacci; Roger Jorgensen; LISP mailing list list > *Subject:* Re: [lisp] Restarting last call on LISP threats >=20 > Hello Ronald, >=20 > On 22 May 2014, at 22:57, Ronald Bonica > wrote: >=20 >=20 >=20 > Dino, >=20 > Today's Internet is not as fragile as you think. This mail traversed > many routers between my house and yours. If those routers are > well-managed, there is nothing that I can do from my house that will > cause any of those routers to consume control plane resources. > Therefore, there is nothing that I can do from my house that will > cause a DoS attack against those routers' control planes. >=20 > We tend to disagree with that, for example you have ICMP today... >=20 > */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn=E2=80=99t ma= ke a > very good routing protocol. That=E2=80=99s why we don=E2=80=99t use it for= routing. By > contrast, LISP map-request messages are susceptible to DoS attacks and > they do carry routing information./* >=20 >=20 >=20 > In LISP, separation between the forwarding and control plane is > lost. As a matter of course, forwarding plane activity causes > control plane activity. Since forwarding plane bandwidth exceeds > control plane bandwidth, DoS attacks against the control plane are > possible. >=20 > In order to be complete, the threats document must describe the DoS > threat. It should also describe mitigations, if any exist. >=20 > DoS is already explained and the definition given: >=20 > " A Denial of Service (DoS) attack aims at disrupting a specific >=20 > targeted service either by exhausting the resources of the victim up >=20 > to the point that it is not able to provide a reliable service to >=20 > legit traffic and/or systems or by exploiting vulnerabilities to make >=20 > the targeted service unable to operate properly. >=20 > " >=20 > is covering the case you mention. >=20 > */[RPB] /* >=20 > */You might want to add the following details to section 5.2:/* >=20 > *//* >=20 > -A DoS attack can be launched by anybody who can send a packet to the > XTR=E2=80=99s LOC >=20 > -DoS attacks can render an XTR inoperable >=20 > -DDoS attacks can render the mapping system inoperable. >=20 > This is what differentiates LISP from today=E2=80=99s routing system. >=20 > Ron >=20 > Damien Saucez >=20 >=20 >=20 > = Ron >=20 >=20 >=20 > -----Original Message----- > From: Dino Farinacci [mailto:farinacci@gmail.com] > Sent: Wednesday, May 21, 2014 6:58 PM > To: Ronald Bonica > Cc: Roger Jorgensen; lisp@ietf.org > Subject: Re: [lisp] Restarting last call on LISP threats >=20 >=20 > The attacker sends a flow of crafted packets to the victim > XTR. Each packet >=20 > is a well-formed LISP data packet. It contains: >=20 >=20 > - an outer IP header (LOC->LOC) > - a UDP header > - a LISP Header > - an IP header (EID->EID) > - payload >=20 >=20 > Just like a regular packet I can send to your home router today. > So yes okay. > So let's continue. See comments below. >=20 >=20 > Each packet contains control plane information that is new > to the victim >=20 >=20 > Be more specific about what control information are in these > encapsulated > packets. >=20 >=20 > XTR. For example, the victim XTR has no mapping information > regarding >=20 > either the source LOC or source EID prefix. Rather than gleaning > this mapping > information from the crafted packet, the victim XTR sends a > verifying MAP- > REQUEST to the mapping system. >=20 >=20 > Assume that the attack flow is large (N packets per second). > Assume also >=20 > that the XTRs rate limit for MAP-REQUEST messages is less than N > packets > per second. Has the attack not effectively DoS'd the victim XTR? >=20 > It caches the rate the rate the packets are coming in and > eventually stops > sending Map-Requests completely. >=20 > It cannot stop the incoming rate of packets today just like a > roque BGP > attacker can send millions of packets per second to a peer > regardless if it > does or does not have the peer authentication key. >=20 >=20 > To make this attack work, every packet in the attack flow > may need to have >=20 > a unique, spoofed, source LOC. >=20 > An implementation can detect that after rate limiting 1000s of > such requests > are happening that it just stops operation. >=20 > What if I sent a Juniper 20 million routes today? >=20 > The Internet is very fragile and LISP IS NOT making it worse. > And in some > cases it is making it better with integrated techniques. >=20 > Dino >=20 >=20 > _______________________________________________ > lisp mailing list > lisp@ietf.org > https://www.ietf.org/mailman/listinfo/lisp >=20 >=20 >=20 > _______________________________________________ > lisp mailing list > lisp@ietf.org > https://www.ietf.org/mailman/listinfo/lisp >=20 _______________________________________________ lisp mailing list lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp From nobody Mon May 26 12:28:24 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 579F11A0230 for ; Mon, 26 May 2014 12:28:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TFKngmTVcVZE for ; Mon, 26 May 2014 12:28:22 -0700 (PDT) Received: from exchange.vinci-consulting-corp.com (exchange.vinci-consulting-corp.com [38.125.5.16]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 730BD1A0226 for ; Mon, 26 May 2014 12:28:22 -0700 (PDT) Received: from NYDC-EXCH01.vinci-consulting-corp.local ([::1]) by NYDC-EXCH01.vinci-consulting-corp.local ([::1]) with mapi id 14.02.0387.000; Mon, 26 May 2014 15:28:18 -0400 From: Paul Vinciguerra To: Ronald Bonica , "Joel M. Halpern" , Damien Saucez Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa57mKa1BYIPtIUu5uyhXkNgDA5s9MyiAgAD04oCAAJ/u8IAAAtXQgAE1s4CAAm1DAIABaYAAgAeql4CAAHoZgIABcK+AgAEO0wCABDDMAIAAsuYAgAADF4D//88GbA== Date: Mon, 26 May 2014 19:28:17 +0000 Message-ID: <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <538361DA.10808@joelhalpern.com>, <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> In-Reply-To: <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [199.119.75.37] x-kse-antivirus-interceptor-info: scan successful x-kse-antivirus-info: Clean Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/J1TU4TGP5tCTFVqmTBUJCO2GBPQ Cc: Roger Jorgensen , LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 May 2014 19:28:24 -0000 Every host on the Internet is subject to a DoS attack. An xTR is no more s= o. I am also not clear on how a DoS attack on an xTR would create any more= risk than an attack directly against the mapping system. =0A= =0A= Joel describes Ronald's scenario of an attack where a large stream of packe= ts with different inner source addresses to an ETR. I don't call this an a= ttack. I call this our steady-state. These would be the PxTR's we operate= across the US. The PxTR's on the beta-network are no different. We take = in packets from anywhere. This is a "Free" attacker if you will. All that= really means is that you do not have to incur the computational cost of en= capsulating the packet.=0A= =0A= I would defer to Dino and others on the list, but I do not believe that the= ETR does a reverse lookup on every packet. At least that is not the behav= ior we observe. What we see happen is that the packet is decapsulated and = sent to the destination. If a valid destination host responds, then the IT= R does a map-request for the reply packet. There is not a 1:1 relationship= between the number of packets and the number of map-requests.=0A= =0A= Map-replies for IP addresses return prefixes. These prefixes can cover larg= er address spaces than the map-request and limit the number of future map-r= equests needed.=0A= =0A= Can you provide more specific details on how you see the xTR rendering the = mapping system unusable? =0A= =0A= For what its worth, I still support the decision for last call and not to p= lace mitigations within the document. Without knowing the specifics of a c= onfiguration and implementation, that just leads to a false sense of securi= ty. =0A= =0A= =0A= ________________________________________=0A= From: lisp [lisp-bounces@ietf.org] on behalf of Ronald Bonica [rbonica@juni= per.net]=0A= Sent: Monday, May 26, 2014 11:57 AM=0A= To: Joel M. Halpern; Damien Saucez=0A= Cc: Roger Jorgensen; LISP mailing list list=0A= Subject: Re: [lisp] Restarting last call on LISP threats=0A= =0A= Inline.....=0A= =0A= > -----Original Message-----=0A= > From: Joel M. Halpern [mailto:jmh@joelhalpern.com]=0A= > Sent: Monday, May 26, 2014 11:47 AM=0A= > To: Ronald Bonica; Damien Saucez=0A= > Cc: Roger Jorgensen; LISP mailing list list=0A= > Subject: Re: [lisp] Restarting last call on LISP threats=0A= >=0A= > Top posting to make sure I am understanding:=0A= >=0A= > You asssert that any xTR is subject to a DoS attack. And that such a DoS= =0A= > attack can render the mapping system unusable.=0A= [RPB]=0A= Exactly!=0A= =0A= >=0A= > It targeting an ITR, this would need to be from within ths cope the ITR s= erves.=0A= [RPB]=0A= I don't understand this sentence. Please try again.=0A= =0A= > I believe that is discussed.=0A= [RPB]=0A= Given that I don't understand the sentence above, I have no idea if this se= ntence is true.=0A= =0A= >=0A= > If I have connected the dots correctly, the attack you are contemplating = is=0A= > sending a large stream of packets with different inner source addresses t= o an=0A= > ETR. This would prompt the ETR to check with the mapping system about=0A= > each and every address.=0A= [RPB]=0A= Exactly!=0A= =0A= >=0A= > If I have understood this properly, while there are several very effectiv= e=0A= > mitigations, that does not change the basic message that this is an attac= k, and=0A= > as such ought to be described in the threats document.=0A= [RPB]=0A= Even if there are effective mitigations, the attack should be described.=0A= =0A= However, I am not convinced that an effective mitigation exists.=0A= =0A= > There are clealry a number of variations on this attack.=0A= [RPB]=0A= True!=0A= =0A= For example, using=0A= > the same outer source address makes mitigation easier, while using differ= ent=0A= > outer source addresses either requires a bot-net or a large unchecked BCP= 38=0A= > hole (and those can be used for MANY attacks on many=0A= > systems.) Both presumably should be described.=0A= [RPB]=0A= Yes, both should be described.=0A= =0A= Also, recall that large BCP38 holes exist in today's internet.=0A= =0A= >=0A= > Have I captured your request accurately?=0A= [RPB]=0A= Pretty much.=0A= =0A= Thanks for taking the effort.=0A= =0A= Ron=0A= =0A= >=0A= > Yours,=0A= > Joel=0A= >=0A= > On 5/26/14, 1:06 AM, Ronald Bonica wrote:=0A= > > *From:*Damien Saucez [mailto:damien.saucez@gmail.com]=0A= > > *Sent:* Friday, May 23, 2014 9:07 AM=0A= > > *To:* Ronald Bonica=0A= > > *Cc:* Dino Farinacci; Roger Jorgensen; LISP mailing list list=0A= > > *Subject:* Re: [lisp] Restarting last call on LISP threats=0A= > >=0A= > > Hello Ronald,=0A= > >=0A= > > On 22 May 2014, at 22:57, Ronald Bonica > > wrote:=0A= > >=0A= > >=0A= > >=0A= > > Dino,=0A= > >=0A= > > Today's Internet is not as fragile as you think. This mail traverse= d=0A= > > many routers between my house and yours. If those routers are=0A= > > well-managed, there is nothing that I can do from my house that wil= l=0A= > > cause any of those routers to consume control plane resources.=0A= > > Therefore, there is nothing that I can do from my house that will= =0A= > > cause a DoS attack against those routers' control planes.=0A= > >=0A= > > We tend to disagree with that, for example you have ICMP today...=0A= > >=0A= > > */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn't make a= =0A= > > very good routing protocol. That's why we don't use it for routing. By= =0A= > > contrast, LISP map-request messages are susceptible to DoS attacks and= =0A= > > they do carry routing information./*=0A= > >=0A= > >=0A= > >=0A= > > In LISP, separation between the forwarding and control plane is=0A= > > lost. As a matter of course, forwarding plane activity causes=0A= > > control plane activity. Since forwarding plane bandwidth exceeds=0A= > > control plane bandwidth, DoS attacks against the control plane are= =0A= > > possible.=0A= > >=0A= > > In order to be complete, the threats document must describe the DoS= =0A= > > threat. It should also describe mitigations, if any exist.=0A= > >=0A= > > DoS is already explained and the definition given:=0A= > >=0A= > > " A Denial of Service (DoS) attack aims at disrupting a specific=0A= > >=0A= > > targeted service either by exhausting the resources of the victim= =0A= > > up=0A= > >=0A= > > to the point that it is not able to provide a reliable service to= =0A= > >=0A= > > legit traffic and/or systems or by exploiting vulnerabilities to=0A= > > make=0A= > >=0A= > > the targeted service unable to operate properly.=0A= > >=0A= > > "=0A= > >=0A= > > is covering the case you mention.=0A= > >=0A= > > */[RPB] /*=0A= > >=0A= > > */You might want to add the following details to section 5.2:/*=0A= > >=0A= > > *//*=0A= > >=0A= > > -A DoS attack can be launched by anybody who can send a packet to the= =0A= > > XTR's LOC=0A= > >=0A= > > -DoS attacks can render an XTR inoperable=0A= > >=0A= > > -DDoS attacks can render the mapping system inoperable.=0A= > >=0A= > > This is what differentiates LISP from today's routing system.=0A= > >=0A= > > Ron=0A= > >=0A= > > Damien Saucez=0A= > >=0A= > >=0A= > >=0A= > >=0A= > > Ron=0A= > >=0A= > >=0A= > >=0A= > > -----Original Message-----=0A= > > From: Dino Farinacci [mailto:farinacci@gmail.com]=0A= > > Sent: Wednesday, May 21, 2014 6:58 PM=0A= > > To: Ronald Bonica=0A= > > Cc: Roger Jorgensen; lisp@ietf.org =0A= > > Subject: Re: [lisp] Restarting last call on LISP threats=0A= > >=0A= > >=0A= > > The attacker sends a flow of crafted packets to the victim= =0A= > > XTR. Each packet=0A= > >=0A= > > is a well-formed LISP data packet. It contains:=0A= > >=0A= > >=0A= > > - an outer IP header (LOC->LOC)=0A= > > - a UDP header=0A= > > - a LISP Header=0A= > > - an IP header (EID->EID)=0A= > > - payload=0A= > >=0A= > >=0A= > > Just like a regular packet I can send to your home router today= .=0A= > > So yes okay.=0A= > > So let's continue. See comments below.=0A= > >=0A= > >=0A= > > Each packet contains control plane information that is new= =0A= > > to the victim=0A= > >=0A= > >=0A= > > Be more specific about what control information are in these=0A= > > encapsulated=0A= > > packets.=0A= > >=0A= > >=0A= > > XTR. For example, the victim XTR has no mapping information= =0A= > > regarding=0A= > >=0A= > > either the source LOC or source EID prefix. Rather than gleanin= g=0A= > > this mapping=0A= > > information from the crafted packet, the victim XTR sends a=0A= > > verifying MAP-=0A= > > REQUEST to the mapping system.=0A= > >=0A= > >=0A= > > Assume that the attack flow is large (N packets per second)= .=0A= > > Assume also=0A= > >=0A= > > that the XTRs rate limit for MAP-REQUEST messages is less than = N=0A= > > packets=0A= > > per second. Has the attack not effectively DoS'd the victim XTR= ?=0A= > >=0A= > > It caches the rate the rate the packets are coming in and=0A= > > eventually stops=0A= > > sending Map-Requests completely.=0A= > >=0A= > > It cannot stop the incoming rate of packets today just like a= =0A= > > roque BGP=0A= > > attacker can send millions of packets per second to a peer=0A= > > regardless if it=0A= > > does or does not have the peer authentication key.=0A= > >=0A= > >=0A= > > To make this attack work, every packet in the attack flow= =0A= > > may need to have=0A= > >=0A= > > a unique, spoofed, source LOC.=0A= > >=0A= > > An implementation can detect that after rate limiting 1000s of= =0A= > > such requests=0A= > > are happening that it just stops operation.=0A= > >=0A= > > What if I sent a Juniper 20 million routes today?=0A= > >=0A= > > The Internet is very fragile and LISP IS NOT making it worse.= =0A= > > And in some=0A= > > cases it is making it better with integrated techniques.=0A= > >=0A= > > Dino=0A= > >=0A= > >=0A= > > _______________________________________________=0A= > > lisp mailing list=0A= > > lisp@ietf.org =0A= > > https://www.ietf.org/mailman/listinfo/lisp=0A= > >=0A= > >=0A= > >=0A= > > _______________________________________________=0A= > > lisp mailing list=0A= > > lisp@ietf.org=0A= > > https://www.ietf.org/mailman/listinfo/lisp=0A= > >=0A= =0A= _______________________________________________=0A= lisp mailing list=0A= lisp@ietf.org=0A= https://www.ietf.org/mailman/listinfo/lisp=0A= From nobody Mon May 26 12:34:46 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2A5321A0240 for ; Mon, 26 May 2014 12:34:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BmU6w6h0gla1 for ; Mon, 26 May 2014 12:34:43 -0700 (PDT) Received: from mailc1.tigertech.net (mailc1.tigertech.net [208.80.4.155]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4FF7B1A023D for ; Mon, 26 May 2014 12:34:43 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mailc1.tigertech.net (Postfix) with ESMTP id 798531C9CE15; Mon, 26 May 2014 12:34:40 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at c1.tigertech.net Received: from Joels-MacBook-Pro.local (pool-70-106-135-10.clppva.east.verizon.net [70.106.135.10]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mailc1.tigertech.net (Postfix) with ESMTPSA id 379901C9CE13; Mon, 26 May 2014 12:34:35 -0700 (PDT) Message-ID: <53839747.1080806@joelhalpern.com> Date: Mon, 26 May 2014 15:34:31 -0400 From: "Joel M. Halpern" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.5.0 MIME-Version: 1.0 To: Paul Vinciguerra , Ronald Bonica , "Joel M. Halpern" , Damien Saucez References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <538361DA.10808@joelhalpern.com>, <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> In-Reply-To: <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/9ea7UfVSPSKYnvRw4pY3YhdfRp0 Cc: Roger Jorgensen , LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 May 2014 19:34:45 -0000 It sounds like the PxTRs you are using are already implementing sensible mitigations. But the base document does not actually call this out. On the base document, the ETR can do gleaning (and by some readings mgiht be being encouraged to do so). Because of the security threat from gleaning, and because the Etr wants to avoid the delay on returning traffic, nor use a false glean to direct returning traffic, there is text suggesting that the ETR would, immediately upon gleaning, check the information with the mapping system. That would mean that a packet flow to an ETR (which all nodes are, as you say, subject to) could become a significant load on the mapping system. Making different choices about when to learn or verify entries changes that dramatically. But since the document does currently include the problematic behavior as legitimate, we need to document that it can cause problems. I am glad to hear that sensible implementations are already dealing with this well. Yours, Joel On 5/26/14, 3:28 PM, Paul Vinciguerra wrote: > Every host on the Internet is subject to a DoS attack. An xTR is no > more so. I am also not clear on how a DoS attack on an xTR would > create any more risk than an attack directly against the mapping > system. > > Joel describes Ronald's scenario of an attack where a large stream of > packets with different inner source addresses to an ETR. I don't > call this an attack. I call this our steady-state. These would be > the PxTR's we operate across the US. The PxTR's on the beta-network > are no different. We take in packets from anywhere. This is a > "Free" attacker if you will. All that really means is that you do > not have to incur the computational cost of encapsulating the > packet. > > I would defer to Dino and others on the list, but I do not believe > that the ETR does a reverse lookup on every packet. At least that is > not the behavior we observe. What we see happen is that the packet > is decapsulated and sent to the destination. If a valid destination > host responds, then the ITR does a map-request for the reply packet. > There is not a 1:1 relationship between the number of packets and the > number of map-requests. > > Map-replies for IP addresses return prefixes. These prefixes can > cover larger address spaces than the map-request and limit the number > of future map-requests needed. > > Can you provide more specific details on how you see the xTR > rendering the mapping system unusable? > > For what its worth, I still support the decision for last call and > not to place mitigations within the document. Without knowing the > specifics of a configuration and implementation, that just leads to a > false sense of security. > > > ________________________________________ From: lisp > [lisp-bounces@ietf.org] on behalf of Ronald Bonica > [rbonica@juniper.net] Sent: Monday, May 26, 2014 11:57 AM To: Joel M. > Halpern; Damien Saucez Cc: Roger Jorgensen; LISP mailing list list > Subject: Re: [lisp] Restarting last call on LISP threats > > Inline..... > >> -----Original Message----- From: Joel M. Halpern >> [mailto:jmh@joelhalpern.com] Sent: Monday, May 26, 2014 11:47 AM >> To: Ronald Bonica; Damien Saucez Cc: Roger Jorgensen; LISP mailing >> list list Subject: Re: [lisp] Restarting last call on LISP threats >> >> Top posting to make sure I am understanding: >> >> You asssert that any xTR is subject to a DoS attack. And that such >> a DoS attack can render the mapping system unusable. > [RPB] Exactly! > >> >> It targeting an ITR, this would need to be from within ths cope the >> ITR serves. > [RPB] I don't understand this sentence. Please try again. > >> I believe that is discussed. > [RPB] Given that I don't understand the sentence above, I have no > idea if this sentence is true. > >> >> If I have connected the dots correctly, the attack you are >> contemplating is sending a large stream of packets with different >> inner source addresses to an ETR. This would prompt the ETR to >> check with the mapping system about each and every address. > [RPB] Exactly! > >> >> If I have understood this properly, while there are several very >> effective mitigations, that does not change the basic message that >> this is an attack, and as such ought to be described in the threats >> document. > [RPB] Even if there are effective mitigations, the attack should be > described. > > However, I am not convinced that an effective mitigation exists. > >> There are clealry a number of variations on this attack. > [RPB] True! > > For example, using >> the same outer source address makes mitigation easier, while using >> different outer source addresses either requires a bot-net or a >> large unchecked BCP38 hole (and those can be used for MANY attacks >> on many systems.) Both presumably should be described. > [RPB] Yes, both should be described. > > Also, recall that large BCP38 holes exist in today's internet. > >> >> Have I captured your request accurately? > [RPB] Pretty much. > > Thanks for taking the effort. > > Ron > >> >> Yours, Joel >> >> On 5/26/14, 1:06 AM, Ronald Bonica wrote: >>> *From:*Damien Saucez [mailto:damien.saucez@gmail.com] *Sent:* >>> Friday, May 23, 2014 9:07 AM *To:* Ronald Bonica *Cc:* Dino >>> Farinacci; Roger Jorgensen; LISP mailing list list *Subject:* Re: >>> [lisp] Restarting last call on LISP threats >>> >>> Hello Ronald, >>> >>> On 22 May 2014, at 22:57, Ronald Bonica >> > wrote: >>> >>> >>> >>> Dino, >>> >>> Today's Internet is not as fragile as you think. This mail >>> traversed many routers between my house and yours. If those >>> routers are well-managed, there is nothing that I can do from my >>> house that will cause any of those routers to consume control >>> plane resources. Therefore, there is nothing that I can do from >>> my house that will cause a DoS attack against those routers' >>> control planes. >>> >>> We tend to disagree with that, for example you have ICMP >>> today... >>> >>> */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn't >>> make a very good routing protocol. That's why we don't use it for >>> routing. By contrast, LISP map-request messages are susceptible >>> to DoS attacks and they do carry routing information./* >>> >>> >>> >>> In LISP, separation between the forwarding and control plane is >>> lost. As a matter of course, forwarding plane activity causes >>> control plane activity. Since forwarding plane bandwidth exceeds >>> control plane bandwidth, DoS attacks against the control plane >>> are possible. >>> >>> In order to be complete, the threats document must describe the >>> DoS threat. It should also describe mitigations, if any exist. >>> >>> DoS is already explained and the definition given: >>> >>> " A Denial of Service (DoS) attack aims at disrupting a specific >>> >>> targeted service either by exhausting the resources of the >>> victim up >>> >>> to the point that it is not able to provide a reliable service >>> to >>> >>> legit traffic and/or systems or by exploiting vulnerabilities to >>> make >>> >>> the targeted service unable to operate properly. >>> >>> " >>> >>> is covering the case you mention. >>> >>> */[RPB] /* >>> >>> */You might want to add the following details to section 5.2:/* >>> >>> *//* >>> >>> -A DoS attack can be launched by anybody who can send a packet to >>> the XTR's LOC >>> >>> -DoS attacks can render an XTR inoperable >>> >>> -DDoS attacks can render the mapping system inoperable. >>> >>> This is what differentiates LISP from today's routing system. >>> >>> Ron >>> >>> Damien Saucez >>> >>> >>> >>> >>> Ron >>> >>> >>> >>> -----Original Message----- From: Dino Farinacci >>> [mailto:farinacci@gmail.com] Sent: Wednesday, May 21, 2014 6:58 >>> PM To: Ronald Bonica Cc: Roger Jorgensen; lisp@ietf.org >>> Subject: Re: [lisp] Restarting last call >>> on LISP threats >>> >>> >>> The attacker sends a flow of crafted packets to the victim XTR. >>> Each packet >>> >>> is a well-formed LISP data packet. It contains: >>> >>> >>> - an outer IP header (LOC->LOC) - a UDP header - a LISP Header - >>> an IP header (EID->EID) - payload >>> >>> >>> Just like a regular packet I can send to your home router today. >>> So yes okay. So let's continue. See comments below. >>> >>> >>> Each packet contains control plane information that is new to the >>> victim >>> >>> >>> Be more specific about what control information are in these >>> encapsulated packets. >>> >>> >>> XTR. For example, the victim XTR has no mapping information >>> regarding >>> >>> either the source LOC or source EID prefix. Rather than gleaning >>> this mapping information from the crafted packet, the victim XTR >>> sends a verifying MAP- REQUEST to the mapping system. >>> >>> >>> Assume that the attack flow is large (N packets per second). >>> Assume also >>> >>> that the XTRs rate limit for MAP-REQUEST messages is less than N >>> packets per second. Has the attack not effectively DoS'd the >>> victim XTR? >>> >>> It caches the rate the rate the packets are coming in and >>> eventually stops sending Map-Requests completely. >>> >>> It cannot stop the incoming rate of packets today just like a >>> roque BGP attacker can send millions of packets per second to a >>> peer regardless if it does or does not have the peer >>> authentication key. >>> >>> >>> To make this attack work, every packet in the attack flow may >>> need to have >>> >>> a unique, spoofed, source LOC. >>> >>> An implementation can detect that after rate limiting 1000s of >>> such requests are happening that it just stops operation. >>> >>> What if I sent a Juniper 20 million routes today? >>> >>> The Internet is very fragile and LISP IS NOT making it worse. And >>> in some cases it is making it better with integrated techniques. >>> >>> Dino >>> >>> >>> _______________________________________________ lisp mailing >>> list lisp@ietf.org >>> https://www.ietf.org/mailman/listinfo/lisp >>> >>> >>> >>> _______________________________________________ lisp mailing >>> list lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp >>> > > _______________________________________________ lisp mailing list > lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp > From nobody Tue May 27 00:58:52 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CA77D1A0028 for ; Tue, 27 May 2014 00:58:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.201 X-Spam-Level: X-Spam-Status: No, score=-2.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, RP_MATCHES_RCVD=-0.651] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6KE3zmewdfoM for ; Tue, 27 May 2014 00:58:48 -0700 (PDT) Received: from door.sniff.de (door.sniff.de [IPv6:2001:6f8:94f:1::1]) by ietfa.amsl.com (Postfix) with ESMTP id 456A91A001E for ; Tue, 27 May 2014 00:58:47 -0700 (PDT) Received: from [IPv6:::1] (localhost.sniff.de [127.0.0.1]) by door.sniff.de (Postfix) with ESMTP id 52EF72AA0F; Tue, 27 May 2014 07:58:40 +0000 (GMT) Date: Tue, 27 May 2014 00:58:43 -0700 From: Marc Binderberger To: "Joel M. Halpern" Message-ID: <20140527005843634679.23839638@sniff.de> In-Reply-To: <53839747.1080806@joelhalpern.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <538361DA.10808@joelhalpern.com> <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> <53839747.1080806@joelhalpern.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Mailer: GyazMail version 1.5.15 Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/P_Ly_xcvOVL0so5p4AKTBLDe8XY Cc: Roger Jorgensen , LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 May 2014 07:58:51 -0000 Hello Joel et al. interesting discussion. I wonder if other Internet protocols would have ever "made it" if they would have started with such an intense threat discussion as LISP does now :-) Nevertheless, my understanding of what Ross and Ronald bring up is indeed a potential risk with any data-driven "pull" protocols like LISP: your data plane may overwhelm the data channel to the control plane. One could argue this is an implementation aspect but as we go already into great detail in the draft maybe it's worthwhile to mention? The discussion was IMHO too much focused on gleaning. LISP is made for a large number of EID networks. If e.g. someone scans the address ranges of an ISP and the PiTR(s) of the ISP have no forwarding entry then they need to send a map-request - a task typically done in control plane. Punting packets from data to control plane may saturate the punt channel for a time T, during which a legitimate request may not be processed. To be fair, even for a large number of EID networks (e.g. lots of /29) the period T should not be more than several minutes (my guess, assuming 1k lookup per second) and it would not affect already established flows, only the establishment of new flows during the time T, assuming the (P)iTR can hold all the map-cache entries. Regards, Marc On Mon, 26 May 2014 15:34:31 -0400, Joel M. Halpern wrote: > It sounds like the PxTRs you are using are already implementing sensible > mitigations. But the base document does not actually call this out. > > On the base document, the ETR can do gleaning (and by some readings mgiht > be being encouraged to do so). Because of the security threat from > gleaning, and because the Etr wants to avoid the delay on returning > traffic, nor use a false glean to direct returning traffic, there is text > suggesting that the ETR would, immediately upon gleaning, check the > information with the mapping system. > > That would mean that a packet flow to an ETR (which all nodes are, as you > say, subject to) could become a significant load on the mapping system. > > Making different choices about when to learn or verify entries changes that > dramatically. But since the document does currently include the > problematic behavior as legitimate, we need to document that it can cause > problems. > > I am glad to hear that sensible implementations are already dealing with > this well. > > Yours, > Joel > > On 5/26/14, 3:28 PM, Paul Vinciguerra wrote: >> Every host on the Internet is subject to a DoS attack. An xTR is no >> more so. I am also not clear on how a DoS attack on an xTR would >> create any more risk than an attack directly against the mapping >> system. >> >> Joel describes Ronald's scenario of an attack where a large stream of >> packets with different inner source addresses to an ETR. I don't >> call this an attack. I call this our steady-state. These would be >> the PxTR's we operate across the US. The PxTR's on the beta-network >> are no different. We take in packets from anywhere. This is a >> "Free" attacker if you will. All that really means is that you do >> not have to incur the computational cost of encapsulating the >> packet. >> >> I would defer to Dino and others on the list, but I do not believe >> that the ETR does a reverse lookup on every packet. At least that is >> not the behavior we observe. What we see happen is that the packet >> is decapsulated and sent to the destination. If a valid destination >> host responds, then the ITR does a map-request for the reply packet. >> There is not a 1:1 relationship between the number of packets and the >> number of map-requests. >> >> Map-replies for IP addresses return prefixes. These prefixes can >> cover larger address spaces than the map-request and limit the number >> of future map-requests needed. >> >> Can you provide more specific details on how you see the xTR >> rendering the mapping system unusable? >> >> For what its worth, I still support the decision for last call and >> not to place mitigations within the document. Without knowing the >> specifics of a configuration and implementation, that just leads to a >> false sense of security. >> >> >> ________________________________________ From: lisp >> [lisp-bounces@ietf.org] on behalf of Ronald Bonica >> [rbonica@juniper.net] Sent: Monday, May 26, 2014 11:57 AM To: Joel M. >> Halpern; Damien Saucez Cc: Roger Jorgensen; LISP mailing list list >> Subject: Re: [lisp] Restarting last call on LISP threats >> >> Inline..... >> >>> -----Original Message----- From: Joel M. Halpern >>> [mailto:jmh@joelhalpern.com] Sent: Monday, May 26, 2014 11:47 AM >>> To: Ronald Bonica; Damien Saucez Cc: Roger Jorgensen; LISP mailing >>> list list Subject: Re: [lisp] Restarting last call on LISP threats >>> >>> Top posting to make sure I am understanding: >>> >>> You asssert that any xTR is subject to a DoS attack. And that such >>> a DoS attack can render the mapping system unusable. >> [RPB] Exactly! >> >>> >>> It targeting an ITR, this would need to be from within ths cope the >>> ITR serves. >> [RPB] I don't understand this sentence. Please try again. >> >>> I believe that is discussed. >> [RPB] Given that I don't understand the sentence above, I have no >> idea if this sentence is true. >> >>> >>> If I have connected the dots correctly, the attack you are >>> contemplating is sending a large stream of packets with different >>> inner source addresses to an ETR. This would prompt the ETR to >>> check with the mapping system about each and every address. >> [RPB] Exactly! >> >>> >>> If I have understood this properly, while there are several very >>> effective mitigations, that does not change the basic message that >>> this is an attack, and as such ought to be described in the threats >>> document. >> [RPB] Even if there are effective mitigations, the attack should be >> described. >> >> However, I am not convinced that an effective mitigation exists. >> >>> There are clealry a number of variations on this attack. >> [RPB] True! >> >> For example, using >>> the same outer source address makes mitigation easier, while using >>> different outer source addresses either requires a bot-net or a >>> large unchecked BCP38 hole (and those can be used for MANY attacks >>> on many systems.) Both presumably should be described. >> [RPB] Yes, both should be described. >> >> Also, recall that large BCP38 holes exist in today's internet. >> >>> >>> Have I captured your request accurately? >> [RPB] Pretty much. >> >> Thanks for taking the effort. >> >> Ron >> >>> >>> Yours, Joel >>> >>> On 5/26/14, 1:06 AM, Ronald Bonica wrote: >>>> *From:*Damien Saucez [mailto:damien.saucez@gmail.com] *Sent:* >>>> Friday, May 23, 2014 9:07 AM *To:* Ronald Bonica *Cc:* Dino >>>> Farinacci; Roger Jorgensen; LISP mailing list list *Subject:* Re: >>>> [lisp] Restarting last call on LISP threats >>>> >>>> Hello Ronald, >>>> >>>> On 22 May 2014, at 22:57, Ronald Bonica >>> > wrote: >>>> >>>> >>>> >>>> Dino, >>>> >>>> Today's Internet is not as fragile as you think. This mail >>>> traversed many routers between my house and yours. If those >>>> routers are well-managed, there is nothing that I can do from my >>>> house that will cause any of those routers to consume control >>>> plane resources. Therefore, there is nothing that I can do from >>>> my house that will cause a DoS attack against those routers' >>>> control planes. >>>> >>>> We tend to disagree with that, for example you have ICMP >>>> today... >>>> >>>> */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn't >>>> make a very good routing protocol. That's why we don't use it for >>>> routing. By contrast, LISP map-request messages are susceptible >>>> to DoS attacks and they do carry routing information./* >>>> >>>> >>>> >>>> In LISP, separation between the forwarding and control plane is >>>> lost. As a matter of course, forwarding plane activity causes >>>> control plane activity. Since forwarding plane bandwidth exceeds >>>> control plane bandwidth, DoS attacks against the control plane >>>> are possible. >>>> >>>> In order to be complete, the threats document must describe the >>>> DoS threat. It should also describe mitigations, if any exist. >>>> >>>> DoS is already explained and the definition given: >>>> >>>> " A Denial of Service (DoS) attack aims at disrupting a specific >>>> >>>> targeted service either by exhausting the resources of the >>>> victim up >>>> >>>> to the point that it is not able to provide a reliable service >>>> to >>>> >>>> legit traffic and/or systems or by exploiting vulnerabilities to >>>> make >>>> >>>> the targeted service unable to operate properly. >>>> >>>> " >>>> >>>> is covering the case you mention. >>>> >>>> */[RPB] /* >>>> >>>> */You might want to add the following details to section 5.2:/* >>>> >>>> *//* >>>> >>>> -A DoS attack can be launched by anybody who can send a packet to >>>> the XTR's LOC >>>> >>>> -DoS attacks can render an XTR inoperable >>>> >>>> -DDoS attacks can render the mapping system inoperable. >>>> >>>> This is what differentiates LISP from today's routing system. >>>> >>>> Ron >>>> >>>> Damien Saucez >>>> >>>> >>>> >>>> >>>> Ron >>>> >>>> >>>> >>>> -----Original Message----- From: Dino Farinacci >>>> [mailto:farinacci@gmail.com] Sent: Wednesday, May 21, 2014 6:58 >>>> PM To: Ronald Bonica Cc: Roger Jorgensen; lisp@ietf.org >>>> Subject: Re: [lisp] Restarting last call >>>> on LISP threats >>>> >>>> >>>> The attacker sends a flow of crafted packets to the victim XTR. >>>> Each packet >>>> >>>> is a well-formed LISP data packet. It contains: >>>> >>>> >>>> - an outer IP header (LOC->LOC) - a UDP header - a LISP Header - >>>> an IP header (EID->EID) - payload >>>> >>>> >>>> Just like a regular packet I can send to your home router today. >>>> So yes okay. So let's continue. See comments below. >>>> >>>> >>>> Each packet contains control plane information that is new to the >>>> victim >>>> >>>> >>>> Be more specific about what control information are in these >>>> encapsulated packets. >>>> >>>> >>>> XTR. For example, the victim XTR has no mapping information >>>> regarding >>>> >>>> either the source LOC or source EID prefix. Rather than gleaning >>>> this mapping information from the crafted packet, the victim XTR >>>> sends a verifying MAP- REQUEST to the mapping system. >>>> >>>> >>>> Assume that the attack flow is large (N packets per second). >>>> Assume also >>>> >>>> that the XTRs rate limit for MAP-REQUEST messages is less than N >>>> packets per second. Has the attack not effectively DoS'd the >>>> victim XTR? >>>> >>>> It caches the rate the rate the packets are coming in and >>>> eventually stops sending Map-Requests completely. >>>> >>>> It cannot stop the incoming rate of packets today just like a >>>> roque BGP attacker can send millions of packets per second to a >>>> peer regardless if it does or does not have the peer >>>> authentication key. >>>> >>>> >>>> To make this attack work, every packet in the attack flow may >>>> need to have >>>> >>>> a unique, spoofed, source LOC. >>>> >>>> An implementation can detect that after rate limiting 1000s of >>>> such requests are happening that it just stops operation. >>>> >>>> What if I sent a Juniper 20 million routes today? >>>> >>>> The Internet is very fragile and LISP IS NOT making it worse. And >>>> in some cases it is making it better with integrated techniques. >>>> >>>> Dino >>>> >>>> >>>> _______________________________________________ lisp mailing >>>> list lisp@ietf.org >>>> https://www.ietf.org/mailman/listinfo/lisp >>>> >>>> >>>> >>>> _______________________________________________ lisp mailing >>>> list lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp >>>> >> >> _______________________________________________ lisp mailing list >> lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp >> > > _______________________________________________ > lisp mailing list > lisp@ietf.org > https://www.ietf.org/mailman/listinfo/lisp > From nobody Tue May 27 07:17:16 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D6461A0394 for ; Tue, 27 May 2014 07:17:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.601 X-Spam-Level: X-Spam-Status: No, score=-102.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qqeE46NiJRm0 for ; Tue, 27 May 2014 07:17:11 -0700 (PDT) Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2lp0207.outbound.protection.outlook.com [207.46.163.207]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A15D1A0158 for ; Tue, 27 May 2014 07:17:10 -0700 (PDT) Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB443.namprd05.prod.outlook.com (10.141.73.152) with Microsoft SMTP Server (TLS) id 15.0.949.11; Tue, 27 May 2014 14:17:06 +0000 Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) with mapi id 15.00.0949.001; Tue, 27 May 2014 14:17:06 +0000 From: Ronald Bonica To: Sharon , "Joel M. Halpern" Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEIABfmkAgAefyVCAAITngIABbBJggAETbwCABC0O0IAAtqUAgAAFh4CAAXMyQA== Date: Tue, 27 May 2014 14:17:05 +0000 Message-ID: References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <538361DA.10808@joelhalpern.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.14] x-forefront-prvs: 02243C58C6 x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(377454003)(13464003)(51704005)(479174003)(199002)(189002)(24454002)(52604005)(21056001)(81342001)(76482001)(74502001)(74662001)(81542001)(74316001)(76576001)(76176999)(86362001)(2656002)(79102001)(80022001)(87936001)(101416001)(15975445006)(33646001)(83072002)(4396001)(99396002)(77982001)(19580395003)(19580405001)(83322001)(99286001)(66066001)(50986999)(46102001)(64706001)(20776003)(54356999)(85852003)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO1PR05MB443; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/nevNYrcqYQf7PIQlmpDy1fCKwo4 Cc: Roger Jorgensen , LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 May 2014 14:17:14 -0000 SGkgU2hhcm9uLA0KDQpXZSBtYXkgYmUgdGFsa2luZyBhYm91dCBhbiBYVFIgdGhhdCBpcyBzaWNr IGR1ZSB0byBhIGJ1ZyBvciBhdHRhY2suIFdlIG1heSBhbHNvIGJlIHRhbGtpbmcgYWJvdXQgYW4g YXR0YWNrZXIgdGhhdCBpc24ndCBhbiBYVFIgYXQgYWxsLCBqdXN0IGltcGVyc29uYXRpbmcgb25l Lg0KDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBSb24NCg0KDQo+IC0tLS0tT3JpZ2luYWwgTWVzc2Fn ZS0tLS0tDQo+IEZyb206IFNoYXJvbiBbbWFpbHRvOnNiYXJrYWlAZ21haWwuY29tXQ0KPiBTZW50 OiBNb25kYXksIE1heSAyNiwgMjAxNCAxMjowNiBQTQ0KPiBUbzogSm9lbCBNLiBIYWxwZXJuDQo+ IENjOiBSb25hbGQgQm9uaWNhOyBEYW1pZW4gU2F1Y2V6OyBSb2dlciBKb3JnZW5zZW47IExJU1Ag bWFpbGluZyBsaXN0IGxpc3QNCj4gU3ViamVjdDogUmU6IFtsaXNwXSBSZXN0YXJ0aW5nIGxhc3Qg Y2FsbCBvbiBMSVNQIHRocmVhdHMNCj4gDQo+IEpvZWwsIHRoYW5rcyBmb3IgY2xlYXJpbmcuDQo+ IEl0IHdhcyBoYXJkIHRvIGZvbGxvdy4NCj4gDQo+IElmIHRoZSBjaGFsbGVuZ2UgaXMgZm9yIGEg ZGlzdHJpYnV0ZWQgbWFwcGluZyBzeXN0ZW0gdG8ga2VlcCB0cmFjayBhbmQgcHJvdGVjdA0KPiBp dHNlbGYgZnJvbSBhICJzaWNrIiB4VFIsIHNpY2sgYmVjYXVzZSBvZiBhIGJ1ZyBvciBhbiBhdHRh Y2suLg0KPiBUaGVuIHBlcmhhcHMgd2UgY291bGQgbWFpbnRhaW4gbWFwcGluZyBsb29rdXAgcGVy IHNlYyBjb3VudGVycyBwZXIgeFRSIGluDQo+IHRoZSBtYXBwaW5nLiBJdCBhZGRzIHNvbWUgb3Zl cmhlYWQgdG8gdGhlIG1hcHBpbmcsIGJ1dCBkb2Vzbid0IHNsb3cgZG93bg0KPiBmb3J3YXJkaW5n LiBDYW4gYmUgYWdncmVnYXRlZCBieSBtYXAgc2VydmVycyBmb3IgZWZmaWNpZW5jeS4NCj4gDQo+ IC0tc3piDQo+IA0KPiBPbiBNYXkgMjYsIDIwMTQsIGF0IDg6NDYgQU0sICJKb2VsIE0uIEhhbHBl cm4iIDxqbWhAam9lbGhhbHBlcm4uY29tPg0KPiB3cm90ZToNCj4gDQo+IFRvcCBwb3N0aW5nIHRv IG1ha2Ugc3VyZSBJIGFtIHVuZGVyc3RhbmRpbmc6DQo+IA0KPiBZb3UgYXNzc2VydCB0aGF0IGFu eSB4VFIgaXMgc3ViamVjdCB0byBhIERvUyBhdHRhY2suICBBbmQgdGhhdCBzdWNoIGEgRG9TDQo+ IGF0dGFjayBjYW4gcmVuZGVyIHRoZSBtYXBwaW5nIHN5c3RlbSB1bnVzYWJsZS4NCj4gDQo+IEl0 IHRhcmdldGluZyBhbiBJVFIsIHRoaXMgd291bGQgbmVlZCB0byBiZSBmcm9tIHdpdGhpbiB0aHMg Y29wZSB0aGUgSVRSIHNlcnZlcy4NCj4gSSBiZWxpZXZlIHRoYXQgaXMgZGlzY3Vzc2VkLg0KPiAN Cj4gSWYgSSBoYXZlIGNvbm5lY3RlZCB0aGUgZG90cyBjb3JyZWN0bHksIHRoZSBhdHRhY2sgeW91 IGFyZSBjb250ZW1wbGF0aW5nIGlzDQo+IHNlbmRpbmcgYSBsYXJnZSBzdHJlYW0gb2YgcGFja2V0 cyB3aXRoIGRpZmZlcmVudCBpbm5lciBzb3VyY2UgYWRkcmVzc2VzIHRvIGFuDQo+IEVUUi4gIFRo aXMgd291bGQgcHJvbXB0IHRoZSBFVFIgdG8gY2hlY2sgd2l0aCB0aGUgbWFwcGluZyBzeXN0ZW0g YWJvdXQNCj4gZWFjaCBhbmQgZXZlcnkgYWRkcmVzcy4NCj4gDQo+IElmIEkgaGF2ZSB1bmRlcnN0 b29kIHRoaXMgcHJvcGVybHksIHdoaWxlIHRoZXJlIGFyZSBzZXZlcmFsIHZlcnkgZWZmZWN0aXZl DQo+IG1pdGlnYXRpb25zLCB0aGF0IGRvZXMgbm90IGNoYW5nZSB0aGUgYmFzaWMgbWVzc2FnZSB0 aGF0IHRoaXMgaXMgYW4gYXR0YWNrLCBhbmQNCj4gYXMgc3VjaCBvdWdodCB0byBiZSBkZXNjcmli ZWQgaW4gdGhlIHRocmVhdHMgZG9jdW1lbnQuICBUaGVyZSBhcmUgY2xlYWxyeSBhDQo+IG51bWJl ciBvZiB2YXJpYXRpb25zIG9uIHRoaXMgYXR0YWNrLiAgRm9yIGV4YW1wbGUsIHVzaW5nIHRoZSBz YW1lIG91dGVyDQo+IHNvdXJjZSBhZGRyZXNzIG1ha2VzIG1pdGlnYXRpb24gZWFzaWVyLCB3aGls ZSB1c2luZyBkaWZmZXJlbnQgb3V0ZXIgc291cmNlDQo+IGFkZHJlc3NlcyBlaXRoZXIgcmVxdWly ZXMgYSBib3QtbmV0IG9yIGEgbGFyZ2UgdW5jaGVja2VkIEJDUDM4IGhvbGUgKGFuZA0KPiB0aG9z ZSBjYW4gYmUgdXNlZCBmb3IgTUFOWSBhdHRhY2tzIG9uIG1hbnkgc3lzdGVtcy4pICBCb3RoIHBy ZXN1bWFibHkNCj4gc2hvdWxkIGJlIGRlc2NyaWJlZC4NCj4gDQo+IEhhdmUgSSBjYXB0dXJlZCB5 b3VyIHJlcXVlc3QgYWNjdXJhdGVseT8NCj4gDQo+IFlvdXJzLA0KPiBKb2VsDQo+IA0KPiA+IE9u IDUvMjYvMTQsIDE6MDYgQU0sIFJvbmFsZCBCb25pY2Egd3JvdGU6DQo+ID4gKkZyb206KkRhbWll biBTYXVjZXogW21haWx0bzpkYW1pZW4uc2F1Y2V6QGdtYWlsLmNvbV0NCj4gPiAqU2VudDoqIEZy aWRheSwgTWF5IDIzLCAyMDE0IDk6MDcgQU0NCj4gPiAqVG86KiBSb25hbGQgQm9uaWNhDQo+ID4g KkNjOiogRGlubyBGYXJpbmFjY2k7IFJvZ2VyIEpvcmdlbnNlbjsgTElTUCBtYWlsaW5nIGxpc3Qg bGlzdA0KPiA+ICpTdWJqZWN0OiogUmU6IFtsaXNwXSBSZXN0YXJ0aW5nIGxhc3QgY2FsbCBvbiBM SVNQIHRocmVhdHMNCj4gPg0KPiA+IEhlbGxvIFJvbmFsZCwNCj4gPg0KPiA+IE9uIDIyIE1heSAy MDE0LCBhdCAyMjo1NywgUm9uYWxkIEJvbmljYSA8cmJvbmljYUBqdW5pcGVyLm5ldA0KPiA+IDxt YWlsdG86cmJvbmljYUBqdW5pcGVyLm5ldD4+IHdyb3RlOg0KPiA+DQo+ID4NCj4gPg0KPiA+ICAg IERpbm8sDQo+ID4NCj4gPiAgICBUb2RheSdzIEludGVybmV0IGlzIG5vdCBhcyBmcmFnaWxlIGFz IHlvdSB0aGluay4gVGhpcyBtYWlsIHRyYXZlcnNlZA0KPiA+ICAgIG1hbnkgcm91dGVycyBiZXR3 ZWVuIG15IGhvdXNlIGFuZCB5b3Vycy4gSWYgdGhvc2Ugcm91dGVycyBhcmUNCj4gPiAgICB3ZWxs LW1hbmFnZWQsIHRoZXJlIGlzIG5vdGhpbmcgdGhhdCBJIGNhbiBkbyBmcm9tIG15IGhvdXNlIHRo YXQgd2lsbA0KPiA+ICAgIGNhdXNlIGFueSBvZiB0aG9zZSByb3V0ZXJzIHRvIGNvbnN1bWUgY29u dHJvbCBwbGFuZSByZXNvdXJjZXMuDQo+ID4gICAgVGhlcmVmb3JlLCB0aGVyZSBpcyBub3RoaW5n IHRoYXQgSSBjYW4gZG8gZnJvbSBteSBob3VzZSB0aGF0IHdpbGwNCj4gPiAgICBjYXVzZSBhIERv UyBhdHRhY2sgYWdhaW5zdCB0aG9zZSByb3V0ZXJzJyBjb250cm9sIHBsYW5lcy4NCj4gPg0KPiA+ IFdlIHRlbmQgdG8gZGlzYWdyZWUgd2l0aCB0aGF0LCBmb3IgZXhhbXBsZSB5b3UgaGF2ZSBJQ01Q IHRvZGF5Li4uDQo+ID4NCj4gPiAqL1tSUEJdIEJlY2F1c2UgSUNNUCBpcyBzdXNjZXB0aWJsZSB0 byBEb1MgYXR0YWNrcywgaXQgd291bGRu4oCZdCBtYWtlIGENCj4gPiB2ZXJ5IGdvb2Qgcm91dGlu ZyBwcm90b2NvbC4gVGhhdOKAmXMgd2h5IHdlIGRvbuKAmXQgdXNlIGl0IGZvciByb3V0aW5nLiBC eQ0KPiA+IGNvbnRyYXN0LCBMSVNQIG1hcC1yZXF1ZXN0IG1lc3NhZ2VzIGFyZSBzdXNjZXB0aWJs ZSB0byBEb1MgYXR0YWNrcyBhbmQNCj4gPiB0aGV5IGRvIGNhcnJ5IHJvdXRpbmcgaW5mb3JtYXRp b24uLyoNCj4gPg0KPiA+DQo+ID4NCj4gPiAgICBJbiBMSVNQLCBzZXBhcmF0aW9uIGJldHdlZW4g dGhlIGZvcndhcmRpbmcgYW5kIGNvbnRyb2wgcGxhbmUgaXMNCj4gPiAgICBsb3N0LiBBcyBhIG1h dHRlciBvZiBjb3Vyc2UsIGZvcndhcmRpbmcgcGxhbmUgYWN0aXZpdHkgY2F1c2VzDQo+ID4gICAg Y29udHJvbCBwbGFuZSBhY3Rpdml0eS4gU2luY2UgZm9yd2FyZGluZyBwbGFuZSBiYW5kd2lkdGgg ZXhjZWVkcw0KPiA+ICAgIGNvbnRyb2wgcGxhbmUgYmFuZHdpZHRoLCBEb1MgYXR0YWNrcyBhZ2Fp bnN0IHRoZSBjb250cm9sIHBsYW5lIGFyZQ0KPiA+ICAgIHBvc3NpYmxlLg0KPiA+DQo+ID4gICAg SW4gb3JkZXIgdG8gYmUgY29tcGxldGUsIHRoZSB0aHJlYXRzIGRvY3VtZW50IG11c3QgZGVzY3Jp YmUgdGhlIERvUw0KPiA+ICAgIHRocmVhdC4gSXQgc2hvdWxkIGFsc28gZGVzY3JpYmUgbWl0aWdh dGlvbnMsIGlmIGFueSBleGlzdC4NCj4gPg0KPiA+IERvUyBpcyBhbHJlYWR5IGV4cGxhaW5lZCBh bmQgdGhlIGRlZmluaXRpb24gZ2l2ZW46DQo+ID4NCj4gPiAiIEEgRGVuaWFsIG9mIFNlcnZpY2Ug KERvUykgYXR0YWNrIGFpbXMgYXQgZGlzcnVwdGluZyBhIHNwZWNpZmljDQo+ID4NCj4gPiAgICB0 YXJnZXRlZCBzZXJ2aWNlIGVpdGhlciBieSBleGhhdXN0aW5nIHRoZSByZXNvdXJjZXMgb2YgdGhl IHZpY3RpbQ0KPiA+IHVwDQo+ID4NCj4gPiAgICB0byB0aGUgcG9pbnQgdGhhdCBpdCBpcyBub3Qg YWJsZSB0byBwcm92aWRlIGEgcmVsaWFibGUgc2VydmljZSB0bw0KPiA+DQo+ID4gICAgbGVnaXQg dHJhZmZpYyBhbmQvb3Igc3lzdGVtcyBvciBieSBleHBsb2l0aW5nIHZ1bG5lcmFiaWxpdGllcyB0 bw0KPiA+IG1ha2UNCj4gPg0KPiA+ICAgIHRoZSB0YXJnZXRlZCBzZXJ2aWNlIHVuYWJsZSB0byBv cGVyYXRlIHByb3Blcmx5Lg0KPiA+DQo+ID4gIg0KPiA+DQo+ID4gaXMgY292ZXJpbmcgdGhlIGNh c2UgeW91IG1lbnRpb24uDQo+ID4NCj4gPiAqL1tSUEJdIC8qDQo+ID4NCj4gPiAqL1lvdSBtaWdo dCB3YW50IHRvIGFkZCB0aGUgZm9sbG93aW5nIGRldGFpbHMgdG8gc2VjdGlvbiA1LjI6LyoNCj4g Pg0KPiA+ICovLyoNCj4gPg0KPiA+IC1BIERvUyBhdHRhY2sgY2FuIGJlIGxhdW5jaGVkIGJ5IGFu eWJvZHkgd2hvIGNhbiBzZW5kIGEgcGFja2V0IHRvIHRoZQ0KPiA+IFhUUuKAmXMgTE9DDQo+ID4N Cj4gPiAtRG9TIGF0dGFja3MgY2FuIHJlbmRlciBhbiBYVFIgaW5vcGVyYWJsZQ0KPiA+DQo+ID4g LUREb1MgYXR0YWNrcyBjYW4gcmVuZGVyIHRoZSBtYXBwaW5nIHN5c3RlbSBpbm9wZXJhYmxlLg0K PiA+DQo+ID4gVGhpcyBpcyB3aGF0IGRpZmZlcmVudGlhdGVzIExJU1AgZnJvbSB0b2RheeKAmXMg cm91dGluZyBzeXN0ZW0uDQo+ID4NCj4gPiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIFJvbg0KPiA+DQo+ID4gRGFtaWVuIFNhdWNleg0KPiA+DQo+ID4NCj4gPg0KPiA+DQo+ ID4gUm9uDQo+ID4NCj4gPg0KPiA+DQo+ID4gICAgICAgIC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0t LS0tDQo+ID4gICAgICAgIEZyb206IERpbm8gRmFyaW5hY2NpIFttYWlsdG86ZmFyaW5hY2NpQGdt YWlsLmNvbV0NCj4gPiAgICAgICAgU2VudDogV2VkbmVzZGF5LCBNYXkgMjEsIDIwMTQgNjo1OCBQ TQ0KPiA+ICAgICAgICBUbzogUm9uYWxkIEJvbmljYQ0KPiA+ICAgICAgICBDYzogUm9nZXIgSm9y Z2Vuc2VuOyBsaXNwQGlldGYub3JnIDxtYWlsdG86bGlzcEBpZXRmLm9yZz4NCj4gPiAgICAgICAg U3ViamVjdDogUmU6IFtsaXNwXSBSZXN0YXJ0aW5nIGxhc3QgY2FsbCBvbiBMSVNQIHRocmVhdHMN Cj4gPg0KPiA+DQo+ID4gICAgICAgICAgICBUaGUgYXR0YWNrZXIgc2VuZHMgYSBmbG93IG9mIGNy YWZ0ZWQgcGFja2V0cyB0byB0aGUgdmljdGltDQo+ID4gICAgICAgICAgICBYVFIuIEVhY2ggcGFj a2V0DQo+ID4NCj4gPiAgICAgICAgaXMgYSB3ZWxsLWZvcm1lZCBMSVNQIGRhdGEgcGFja2V0LiBJ dCBjb250YWluczoNCj4gPg0KPiA+DQo+ID4gICAgICAgICAgICAtIGFuIG91dGVyIElQIGhlYWRl ciAoTE9DLT5MT0MpDQo+ID4gICAgICAgICAgICAtIGEgVURQIGhlYWRlcg0KPiA+ICAgICAgICAg ICAgLSBhIExJU1AgSGVhZGVyDQo+ID4gICAgICAgICAgICAtIGFuIElQIGhlYWRlciAoRUlELT5F SUQpDQo+ID4gICAgICAgICAgICAtIHBheWxvYWQNCj4gPg0KPiA+DQo+ID4gICAgICAgIEp1c3Qg bGlrZSBhIHJlZ3VsYXIgcGFja2V0IEkgY2FuIHNlbmQgdG8geW91ciBob21lIHJvdXRlciB0b2Rh eS4NCj4gPiAgICAgICAgU28geWVzIG9rYXkuDQo+ID4gICAgICAgIFNvIGxldCdzIGNvbnRpbnVl LiBTZWUgY29tbWVudHMgYmVsb3cuDQo+ID4NCj4gPg0KPiA+ICAgICAgICAgICAgRWFjaCBwYWNr ZXQgY29udGFpbnMgY29udHJvbCBwbGFuZSBpbmZvcm1hdGlvbiB0aGF0IGlzIG5ldw0KPiA+ICAg ICAgICAgICAgdG8gdGhlIHZpY3RpbQ0KPiA+DQo+ID4NCj4gPiAgICAgICAgQmUgbW9yZSBzcGVj aWZpYyBhYm91dCB3aGF0IGNvbnRyb2wgaW5mb3JtYXRpb24gYXJlIGluIHRoZXNlDQo+ID4gICAg ICAgIGVuY2Fwc3VsYXRlZA0KPiA+ICAgICAgICBwYWNrZXRzLg0KPiA+DQo+ID4NCj4gPiAgICAg ICAgICAgIFhUUi4gRm9yIGV4YW1wbGUsIHRoZSB2aWN0aW0gWFRSIGhhcyBubyBtYXBwaW5nIGlu Zm9ybWF0aW9uDQo+ID4gICAgICAgICAgICByZWdhcmRpbmcNCj4gPg0KPiA+ICAgICAgICBlaXRo ZXIgdGhlIHNvdXJjZSBMT0Mgb3Igc291cmNlIEVJRCBwcmVmaXguIFJhdGhlciB0aGFuIGdsZWFu aW5nDQo+ID4gICAgICAgIHRoaXMgbWFwcGluZw0KPiA+ICAgICAgICBpbmZvcm1hdGlvbiBmcm9t IHRoZSBjcmFmdGVkIHBhY2tldCwgdGhlIHZpY3RpbSBYVFIgc2VuZHMgYQ0KPiA+ICAgICAgICB2 ZXJpZnlpbmcgTUFQLQ0KPiA+ICAgICAgICBSRVFVRVNUIHRvIHRoZSBtYXBwaW5nIHN5c3RlbS4N Cj4gPg0KPiA+DQo+ID4gICAgICAgICAgICBBc3N1bWUgdGhhdCB0aGUgYXR0YWNrIGZsb3cgaXMg bGFyZ2UgKE4gcGFja2V0cyBwZXIgc2Vjb25kKS4NCj4gPiAgICAgICAgICAgIEFzc3VtZSBhbHNv DQo+ID4NCj4gPiAgICAgICAgdGhhdCB0aGUgWFRScyByYXRlIGxpbWl0IGZvciBNQVAtUkVRVUVT VCBtZXNzYWdlcyBpcyBsZXNzIHRoYW4gTg0KPiA+ICAgICAgICBwYWNrZXRzDQo+ID4gICAgICAg IHBlciBzZWNvbmQuIEhhcyB0aGUgYXR0YWNrIG5vdCBlZmZlY3RpdmVseSBEb1MnZCB0aGUgdmlj dGltIFhUUj8NCj4gPg0KPiA+ICAgICAgICBJdCBjYWNoZXMgdGhlIHJhdGUgdGhlIHJhdGUgdGhl IHBhY2tldHMgYXJlIGNvbWluZyBpbiBhbmQNCj4gPiAgICAgICAgZXZlbnR1YWxseSBzdG9wcw0K PiA+ICAgICAgICBzZW5kaW5nIE1hcC1SZXF1ZXN0cyBjb21wbGV0ZWx5Lg0KPiA+DQo+ID4gICAg ICAgIEl0IGNhbm5vdCBzdG9wIHRoZSBpbmNvbWluZyByYXRlIG9mIHBhY2tldHMgdG9kYXkganVz dCBsaWtlIGENCj4gPiAgICAgICAgcm9xdWUgQkdQDQo+ID4gICAgICAgIGF0dGFja2VyIGNhbiBz ZW5kIG1pbGxpb25zIG9mIHBhY2tldHMgcGVyIHNlY29uZCB0byBhIHBlZXINCj4gPiAgICAgICAg cmVnYXJkbGVzcyBpZiBpdA0KPiA+ICAgICAgICBkb2VzIG9yIGRvZXMgbm90IGhhdmUgdGhlIHBl ZXIgYXV0aGVudGljYXRpb24ga2V5Lg0KPiA+DQo+ID4NCj4gPiAgICAgICAgICAgIFRvIG1ha2Ug dGhpcyBhdHRhY2sgd29yaywgZXZlcnkgcGFja2V0IGluIHRoZSBhdHRhY2sgZmxvdw0KPiA+ICAg ICAgICAgICAgbWF5IG5lZWQgdG8gaGF2ZQ0KPiA+DQo+ID4gICAgICAgIGEgdW5pcXVlLCBzcG9v ZmVkLCBzb3VyY2UgTE9DLg0KPiA+DQo+ID4gICAgICAgIEFuIGltcGxlbWVudGF0aW9uIGNhbiBk ZXRlY3QgdGhhdCBhZnRlciByYXRlIGxpbWl0aW5nIDEwMDBzIG9mDQo+ID4gICAgICAgIHN1Y2gg cmVxdWVzdHMNCj4gPiAgICAgICAgYXJlIGhhcHBlbmluZyB0aGF0IGl0IGp1c3Qgc3RvcHMgb3Bl cmF0aW9uLg0KPiA+DQo+ID4gICAgICAgIFdoYXQgaWYgSSBzZW50IGEgSnVuaXBlciAyMCBtaWxs aW9uIHJvdXRlcyB0b2RheT8NCj4gPg0KPiA+ICAgICAgICBUaGUgSW50ZXJuZXQgaXMgdmVyeSBm cmFnaWxlIGFuZCBMSVNQIElTIE5PVCBtYWtpbmcgaXQgd29yc2UuDQo+ID4gICAgICAgIEFuZCBp biBzb21lDQo+ID4gICAgICAgIGNhc2VzIGl0IGlzIG1ha2luZyBpdCBiZXR0ZXIgd2l0aCBpbnRl Z3JhdGVkIHRlY2huaXF1ZXMuDQo+ID4NCj4gPiAgICAgICAgRGlubw0KPiA+DQo+ID4NCj4gPiAg ICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPiA+ICAg IGxpc3AgbWFpbGluZyBsaXN0DQo+ID4gICAgbGlzcEBpZXRmLm9yZyA8bWFpbHRvOmxpc3BAaWV0 Zi5vcmc+DQo+ID4gICAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9saXNw DQo+ID4NCj4gPg0KPiA+DQo+ID4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX18NCj4gPiBsaXNwIG1haWxpbmcgbGlzdA0KPiA+IGxpc3BAaWV0Zi5vcmcNCj4g PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2xpc3ANCj4gPg0KPiANCj4g X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4gbGlzcCBt YWlsaW5nIGxpc3QNCj4gbGlzcEBpZXRmLm9yZw0KPiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL2xpc3ANCg== From nobody Tue May 27 08:04:50 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 156DD1A0171 for ; Tue, 27 May 2014 08:04:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EVd-QHaqyCJk for ; Tue, 27 May 2014 08:04:48 -0700 (PDT) Received: from mail-pa0-x230.google.com (mail-pa0-x230.google.com [IPv6:2607:f8b0:400e:c03::230]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2F37E1A013B for ; Tue, 27 May 2014 08:04:48 -0700 (PDT) Received: by mail-pa0-f48.google.com with SMTP id rd3so9266739pab.21 for ; Tue, 27 May 2014 08:04:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=q/WQFsB8U/4xmswLh2qKzseqpLnIvBOC/sybEMC/vqs=; b=Lmhcf6ucRAVSHwY9vYKqwuQb5t+g5E1KLH+oZeM5HeGAO+i5c4SAuqijZvNU3fjkOW I4GeM3Xc8sFGVqBcZEwoYzJS63IyHN0BVVfjbFAygrrvTGSUMQioqmga5mijyug71Ngy TK21OT18X6d2oijTK+6RV4bguWlLPqdYkiR7B13+moH+88m+rusv/ZU1OBRHAx7Ljudp pcOlbPscmVEJIVzhn4o+9ppHf8u50LpsnaoOrfxr+n+US9fchdlX+ZnwHBKUkxEKS6AM +1EEQ/Qxgrinsb/Z8vN6xeRxYif9lf/eZqJlw7Ge+ApmW3hmP+Di6KcvBllX7T2IksDh 8YPw== X-Received: by 10.68.226.197 with SMTP id ru5mr37329621pbc.77.1401203085074; Tue, 27 May 2014 08:04:45 -0700 (PDT) Received: from [192.168.1.174] ([207.145.253.66]) by mx.google.com with ESMTPSA id op3sm23786662pbc.40.2014.05.27.08.04.43 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 27 May 2014 08:04:44 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\)) From: Dino Farinacci In-Reply-To: <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> Date: Tue, 27 May 2014 08:04:42 -0700 Content-Transfer-Encoding: quoted-printable Message-Id: References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <538361DA.10808@joelhalpern.com> <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> To: Ronald Bonica X-Mailer: Apple Mail (2.1874) Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/VrY-4Uh_MKW4kFrGLLVlmTViqwU Cc: Roger Jorgensen , LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 May 2014 15:04:49 -0000 > Also, recall that large BCP38 holes exist in today's internet. And I am going to repeat again, this is not a binary statement. That is, = if a BCP38 hole exists in one part of the network, source spoofing can = still be detected in other parts of the network. Dino From nobody Tue May 27 08:12:04 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C32771A0428 for ; Tue, 27 May 2014 08:12:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vGlInooZ_rKX for ; Tue, 27 May 2014 08:12:01 -0700 (PDT) Received: from mail-pb0-x22b.google.com (mail-pb0-x22b.google.com [IPv6:2607:f8b0:400e:c01::22b]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AAB3A1A040C for ; Tue, 27 May 2014 08:12:01 -0700 (PDT) Received: by mail-pb0-f43.google.com with SMTP id up15so9403612pbc.2 for ; Tue, 27 May 2014 08:11:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=bgM/xqzvpYutgsV/i/NbWsmDZSqsWfnb28kNRk79I8o=; b=ReBPaKeiHA/J/MIfcHIoWUPLer6SgS7jt0y1rR+ASIVZuQQcZQgJi+REvUCDEmri+m VDqxtsfbwLfSznGExhV10rD+bYJh6Ldj8YkS/CfER1SAXEFOxFQwh8kEufuWGPUGQNZ/ 8FaH0ZxV98Iyswr/7PDooH4i1O1Don63oz9uT+RDSxBI4cc3P8uC2hA3tg6CXLDevHna iIbHfPXX/FUbBu4Mr7WfKFUPQXSNs5ELbb9kT9nzi4UYLzqXRTlJ1f/Hel7bmT+Q0vrX LE64xYQkMe3Iu7iaqEXLxIrDG6tD9SaMpnJ8Dcmy766PawKwRUCovauTu2HJfslTBOvT fRgw== X-Received: by 10.66.233.73 with SMTP id tu9mr19141986pac.78.1401203518521; Tue, 27 May 2014 08:11:58 -0700 (PDT) Received: from [192.168.1.174] ([207.145.253.66]) by mx.google.com with ESMTPSA id ck10sm74759678pac.0.2014.05.27.08.11.56 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 27 May 2014 08:11:57 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\)) From: Dino Farinacci In-Reply-To: <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> Date: Tue, 27 May 2014 08:11:55 -0700 Content-Transfer-Encoding: quoted-printable Message-Id: <2BC8321B-26CD-4A33-B999-64B8A44428DD@gmail.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <538361DA.10808@joelhalpern.com>, <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> To: Paul Vinciguerra X-Mailer: Apple Mail (2.1874) Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/KSj1cdakPnQMNh0cyCbUlgeeXKI Cc: Roger Jorgensen , LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 May 2014 15:12:03 -0000 > I would defer to Dino and others on the list, but I do not believe = that the ETR does a reverse lookup on every packet. At least that is = not the behavior we observe. What we see happen is that the packet is = decapsulated=20 Right Paul. We did not document an ETR doing reverse lookups to solve = this problem. When I mentioned it, I said it is something that COULD be = done. It comes at a cost but wouldn't come at a per-packet cost, not = even close. And as you said if the inner source is changing but the = mapping system covers those addresses with a coarse prefix (that is = returned from a lookup), then that reduces the number of RPF lookups, in = addition to rate-limiting the number you do. But I would suggest that implementations do what they are already doing. = That is what you describe here: > and sent to the destination. If a valid destination host responds, = then the ITR does a map-request for the reply packet. There is not a = 1:1 relationship between the number of packets and the number of = map-requests. The mapping system is no different in its load then the DNS system. We = engineer and build that infrastructure the same way to protect it.=20 So how many more magnitudes of hosts are sending DNS queries than xTRs = sending Map-Requests (and please normalize this to every site having at = least 2 xTRs per site). We are over-reacting a bit, but just saying that is not going to calm = fears. With continued experimentation and deployment, we will prove it. Dino P.S. Don't eat that burger today, it will kill you just like the = cigarette you may smoke today. ;-) From nobody Tue May 27 08:12:28 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 157AC1A0456 for ; Tue, 27 May 2014 08:12:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Foo5og5xXsBp for ; Tue, 27 May 2014 08:12:19 -0700 (PDT) Received: from mailc1.tigertech.net (mailc1.tigertech.net [208.80.4.155]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 627AB1A0166 for ; Tue, 27 May 2014 08:12:19 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mailc1.tigertech.net (Postfix) with ESMTP id 004B8220DA5; Tue, 27 May 2014 08:12:16 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at c1.tigertech.net Received: from Joels-MacBook-Pro.local (pool-70-106-135-10.clppva.east.verizon.net [70.106.135.10]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mailc1.tigertech.net (Postfix) with ESMTPSA id E5964220D91; Tue, 27 May 2014 08:12:14 -0700 (PDT) Message-ID: <5384AB4E.2010208@joelhalpern.com> Date: Tue, 27 May 2014 11:12:14 -0400 From: "Joel M. Halpern" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.5.0 MIME-Version: 1.0 To: Dino Farinacci , Ronald Bonica References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <538361DA.10808@joelhalpern.com> <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/rDMnyFhIdP1qvDcrnwSK15DDsCM Cc: Roger Jorgensen , LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 May 2014 15:12:26 -0000 Can we please not get into a debate about how well BCP38 is or is not deployed, whether violations are remotely detectable, ...This is NOT the working group for that. For our purposes, given that source address forging is known to occur, we have to allow it in the threat analysis. Yours, Joel On 5/27/14, 11:04 AM, Dino Farinacci wrote: > >> Also, recall that large BCP38 holes exist in today's internet. > > And I am going to repeat again, this is not a binary statement. That is, if a BCP38 hole exists in one part of the network, source spoofing can still be detected in other parts of the network. > > Dino > > From nobody Tue May 27 08:17:21 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C7A071A013B for ; Tue, 27 May 2014 08:17:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4N-CRgrmb6pJ for ; Tue, 27 May 2014 08:17:19 -0700 (PDT) Received: from mail-pb0-x22c.google.com (mail-pb0-x22c.google.com [IPv6:2607:f8b0:400e:c01::22c]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B14071A00F9 for ; Tue, 27 May 2014 08:17:19 -0700 (PDT) Received: by mail-pb0-f44.google.com with SMTP id rq2so9465897pbb.3 for ; Tue, 27 May 2014 08:17:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=ZQWnbPGAQFlxqPIZRi3Wb0LkSv70QGtVt9EXB1muU9Q=; b=d0yXPw2ma1Jzc/e7GjyWckOx8jVSj1sBNNho0v+Zi9Q3vEjn0NEx8UZL9TuNQQDgnj QRcCOKtklXo3BBTWgVt0qBkCJ+kAF774yW4w3KOFpW87mg+w3gcjRDKdoaaN/oTS0CPf n4spo0HJ4UuF1X3Atvx4/pT6voy01fGzCJQCCmWVRjEWOqrhw7GEtmL46DUYxhXU7RTC 0vhN2q80r69edpNx3ZAZNYl1q0L2+jJ4duY0aPA5VCEL9NwCNKgX1cLv+fViwjqV4oGX 7U9zGW7296qLQacLV+EYS7HBe2/HYajc1EbUAmj10ly2Uo43LUrbWcugFQ6w3/ZUPL5K mHkg== X-Received: by 10.66.251.136 with SMTP id zk8mr37255642pac.137.1401203836605; Tue, 27 May 2014 08:17:16 -0700 (PDT) Received: from [192.168.1.174] ([207.145.253.66]) by mx.google.com with ESMTPSA id tg9sm23840475pbc.29.2014.05.27.08.17.15 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 27 May 2014 08:17:15 -0700 (PDT) Content-Type: text/plain; charset=iso-8859-1 Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\)) From: Dino Farinacci In-Reply-To: <5384AB4E.2010208@joelhalpern.com> Date: Tue, 27 May 2014 08:17:14 -0700 Content-Transfer-Encoding: quoted-printable Message-Id: References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <538361DA.10808@joelhalpern.com> <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <5384AB4E.2010208@joelhalpern.com> To: "Joel M. Halpern" X-Mailer: Apple Mail (2.1874) Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/XxM6C7nWi9dnRq6SRNpNlHBxKbo Cc: Roger Jorgensen , LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 May 2014 15:17:20 -0000 > Can we please not get into a debate about how well BCP38 is or is not = deployed, whether violations are remotely detectable, ...This is NOT the = working group for that. The point is that LISP makes spoofing no worse even though many think = that it could because there are more addreses in the packet to = manipulate. This aspect is on topic. > For our purposes, given that source address forging is known to occur, = we have to allow it in the threat analysis. I agree. Dino >=20 > Yours, > Joel >=20 > On 5/27/14, 11:04 AM, Dino Farinacci wrote: >>=20 >>> Also, recall that large BCP38 holes exist in today's internet. >>=20 >> And I am going to repeat again, this is not a binary statement. That = is, if a BCP38 hole exists in one part of the network, source spoofing = can still be detected in other parts of the network. >>=20 >> Dino >>=20 >>=20 From nobody Tue May 27 08:24:47 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC0D31A03DD for ; Tue, 27 May 2014 08:24:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rppaLh-xt6AF for ; Tue, 27 May 2014 08:24:37 -0700 (PDT) Received: from emea01-db3-obe.outbound.protection.outlook.com (mail-db3lp0075.outbound.protection.outlook.com [213.199.154.75]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 17A391A046A for ; Tue, 27 May 2014 08:23:47 -0700 (PDT) Received: from DBXPR06MB399.eurprd06.prod.outlook.com (10.141.14.23) by DBXPR06MB400.eurprd06.prod.outlook.com (10.141.14.24) with Microsoft SMTP Server (TLS) id 15.0.944.11; Tue, 27 May 2014 15:23:42 +0000 Received: from DBXPR06MB399.eurprd06.prod.outlook.com ([10.141.14.23]) by DBXPR06MB399.eurprd06.prod.outlook.com ([10.141.14.23]) with mapi id 15.00.0944.000; Tue, 27 May 2014 15:23:42 +0000 From: Sharon Barkai To: Ronald Bonica Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa57m+o2Brd1FsE6b44HD+a1mF5s9MyiAgAD04oCAAJ/u8IAAAtXQgADypYCAAm1DAIABaYAAgAeql4CAAHoZgIABcK+AgAEO0wCABDDMAIAAsuYAgAAFh4CAAXPOgIAAEpt4 Date: Tue, 27 May 2014 15:23:41 +0000 Message-ID: <358B4B1A-1883-45F9-986B-13E9D6BB8836@Contextream.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <538361DA.10808@joelhalpern.com> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [2600:1010:b10a:df8c:c68:6ef8:2041:5023] x-forefront-prvs: 02243C58C6 x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(51704005)(13464003)(52604005)(479174003)(24454002)(189002)(199002)(377454003)(36756003)(20776003)(77982001)(2656002)(81542001)(81342001)(76176999)(21056001)(92726001)(86362001)(1941001)(83072002)(87936001)(19580395003)(64706001)(85852003)(74662001)(83322001)(50986999)(46102001)(79102001)(33656002)(74502001)(83716003)(54356999)(4396001)(15975445006)(80022001)(99396002)(19580405001)(82746002)(76482001)(101416001)(77096999)(3826001)(80792004); DIR:OUT; SFP:; SCL:1; SRVR:DBXPR06MB400; H:DBXPR06MB399.eurprd06.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (: Contextream.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=Sharon@Contextream.com; Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: Contextream.com Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/bCpwyYna6CImZITOzja5OzwwAVM Cc: Roger Jorgensen , LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 May 2014 15:24:44 -0000 Hi Roland, Got it. Tnx. I thought that since the mapping is in the underlay, then existing underla= y protections apply.. unless "outerlay" elements use the XTRs in order to i= ndirectly attack the mapping service. I thought that's what you meant..=20 And that the problem of why this is not a trivial throttling is because the= mapping itself is distributed so no one place can identify the XTR being l= everaged for the attack. That's why I thought keeping an mapping internal l= caf/counter-Schema can help. But I think Joel is correct, and let's first phrase the problem. Thanks for the clarification. --szb On May 27, 2014, at 7:17 AM, "Ronald Bonica" wrote: Hi Sharon, We may be talking about an XTR that is sick due to a bug or attack. We may = also be talking about an attacker that isn't an XTR at all, just impersonat= ing one. = Ron > -----Original Message----- > From: Sharon [mailto:sbarkai@gmail.com] > Sent: Monday, May 26, 2014 12:06 PM > To: Joel M. Halpern > Cc: Ronald Bonica; Damien Saucez; Roger Jorgensen; LISP mailing list list > Subject: Re: [lisp] Restarting last call on LISP threats >=20 > Joel, thanks for clearing. > It was hard to follow. >=20 > If the challenge is for a distributed mapping system to keep track and pr= otect > itself from a "sick" xTR, sick because of a bug or an attack.. > Then perhaps we could maintain mapping lookup per sec counters per xTR in > the mapping. It adds some overhead to the mapping, but doesn't slow down > forwarding. Can be aggregated by map servers for efficiency. >=20 > --szb >=20 > On May 26, 2014, at 8:46 AM, "Joel M. Halpern" > wrote: >=20 > Top posting to make sure I am understanding: >=20 > You asssert that any xTR is subject to a DoS attack. And that such a DoS > attack can render the mapping system unusable. >=20 > It targeting an ITR, this would need to be from within ths cope the ITR s= erves. > I believe that is discussed. >=20 > If I have connected the dots correctly, the attack you are contemplating = is > sending a large stream of packets with different inner source addresses t= o an > ETR. This would prompt the ETR to check with the mapping system about > each and every address. >=20 > If I have understood this properly, while there are several very effectiv= e > mitigations, that does not change the basic message that this is an attac= k, and > as such ought to be described in the threats document. There are clealry= a > number of variations on this attack. For example, using the same outer > source address makes mitigation easier, while using different outer sourc= e > addresses either requires a bot-net or a large unchecked BCP38 hole (and > those can be used for MANY attacks on many systems.) Both presumably > should be described. >=20 > Have I captured your request accurately? >=20 > Yours, > Joel >=20 >> On 5/26/14, 1:06 AM, Ronald Bonica wrote: >> *From:*Damien Saucez [mailto:damien.saucez@gmail.com] >> *Sent:* Friday, May 23, 2014 9:07 AM >> *To:* Ronald Bonica >> *Cc:* Dino Farinacci; Roger Jorgensen; LISP mailing list list >> *Subject:* Re: [lisp] Restarting last call on LISP threats >>=20 >> Hello Ronald, >>=20 >> On 22 May 2014, at 22:57, Ronald Bonica > > wrote: >>=20 >>=20 >>=20 >> Dino, >>=20 >> Today's Internet is not as fragile as you think. This mail traversed >> many routers between my house and yours. If those routers are >> well-managed, there is nothing that I can do from my house that will >> cause any of those routers to consume control plane resources. >> Therefore, there is nothing that I can do from my house that will >> cause a DoS attack against those routers' control planes. >>=20 >> We tend to disagree with that, for example you have ICMP today... >>=20 >> */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn=92t make a >> very good routing protocol. That=92s why we don=92t use it for routing. = By >> contrast, LISP map-request messages are susceptible to DoS attacks and >> they do carry routing information./* >>=20 >>=20 >>=20 >> In LISP, separation between the forwarding and control plane is >> lost. As a matter of course, forwarding plane activity causes >> control plane activity. Since forwarding plane bandwidth exceeds >> control plane bandwidth, DoS attacks against the control plane are >> possible. >>=20 >> In order to be complete, the threats document must describe the DoS >> threat. It should also describe mitigations, if any exist. >>=20 >> DoS is already explained and the definition given: >>=20 >> " A Denial of Service (DoS) attack aims at disrupting a specific >>=20 >> targeted service either by exhausting the resources of the victim >> up >>=20 >> to the point that it is not able to provide a reliable service to >>=20 >> legit traffic and/or systems or by exploiting vulnerabilities to >> make >>=20 >> the targeted service unable to operate properly. >>=20 >> " >>=20 >> is covering the case you mention. >>=20 >> */[RPB] /* >>=20 >> */You might want to add the following details to section 5.2:/* >>=20 >> *//* >>=20 >> -A DoS attack can be launched by anybody who can send a packet to the >> XTR=92s LOC >>=20 >> -DoS attacks can render an XTR inoperable >>=20 >> -DDoS attacks can render the mapping system inoperable. >>=20 >> This is what differentiates LISP from today=92s routing system. >>=20 >> Ron >>=20 >> Damien Saucez >>=20 >>=20 >>=20 >>=20 >> Ron >>=20 >>=20 >>=20 >> -----Original Message----- >> From: Dino Farinacci [mailto:farinacci@gmail.com] >> Sent: Wednesday, May 21, 2014 6:58 PM >> To: Ronald Bonica >> Cc: Roger Jorgensen; lisp@ietf.org >> Subject: Re: [lisp] Restarting last call on LISP threats >>=20 >>=20 >> The attacker sends a flow of crafted packets to the victim >> XTR. Each packet >>=20 >> is a well-formed LISP data packet. It contains: >>=20 >>=20 >> - an outer IP header (LOC->LOC) >> - a UDP header >> - a LISP Header >> - an IP header (EID->EID) >> - payload >>=20 >>=20 >> Just like a regular packet I can send to your home router today. >> So yes okay. >> So let's continue. See comments below. >>=20 >>=20 >> Each packet contains control plane information that is new >> to the victim >>=20 >>=20 >> Be more specific about what control information are in these >> encapsulated >> packets. >>=20 >>=20 >> XTR. For example, the victim XTR has no mapping information >> regarding >>=20 >> either the source LOC or source EID prefix. Rather than gleaning >> this mapping >> information from the crafted packet, the victim XTR sends a >> verifying MAP- >> REQUEST to the mapping system. >>=20 >>=20 >> Assume that the attack flow is large (N packets per second). >> Assume also >>=20 >> that the XTRs rate limit for MAP-REQUEST messages is less than N >> packets >> per second. Has the attack not effectively DoS'd the victim XTR? >>=20 >> It caches the rate the rate the packets are coming in and >> eventually stops >> sending Map-Requests completely. >>=20 >> It cannot stop the incoming rate of packets today just like a >> roque BGP >> attacker can send millions of packets per second to a peer >> regardless if it >> does or does not have the peer authentication key. >>=20 >>=20 >> To make this attack work, every packet in the attack flow >> may need to have >>=20 >> a unique, spoofed, source LOC. >>=20 >> An implementation can detect that after rate limiting 1000s of >> such requests >> are happening that it just stops operation. >>=20 >> What if I sent a Juniper 20 million routes today? >>=20 >> The Internet is very fragile and LISP IS NOT making it worse. >> And in some >> cases it is making it better with integrated techniques. >>=20 >> Dino >>=20 >>=20 >> _______________________________________________ >> lisp mailing list >> lisp@ietf.org >> https://www.ietf.org/mailman/listinfo/lisp >>=20 >>=20 >>=20 >> _______________________________________________ >> lisp mailing list >> lisp@ietf.org >> https://www.ietf.org/mailman/listinfo/lisp >=20 > _______________________________________________ > lisp mailing list > lisp@ietf.org > https://www.ietf.org/mailman/listinfo/lisp _______________________________________________ lisp mailing list lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp From nobody Tue May 27 08:49:56 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2DA7D1A034E for ; Tue, 27 May 2014 08:49:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0q04HXiO6jDd for ; Tue, 27 May 2014 08:49:53 -0700 (PDT) Received: from mail-pb0-x232.google.com (mail-pb0-x232.google.com [IPv6:2607:f8b0:400e:c01::232]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1B57E1A0254 for ; Tue, 27 May 2014 08:49:53 -0700 (PDT) Received: by mail-pb0-f50.google.com with SMTP id ma3so9452072pbc.23 for ; Tue, 27 May 2014 08:49:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=haWattmyeJdO5WADRVPirz7GPuA33bBmWHRJ+EypYzk=; b=CPdU+YddBP19/zpdR0QwDUxeBY/+rFl3Bp7gRIXZ9CLVUGzplL7kwtALDjlOedSt/H XBytrae5hjAF2v2IWa4YeCuOpBhRKUPW1BubcS3l1uYavNitt5jRZ6y5JgAj/fUFNlvf FYvyk5cMgFmgHnNJDcNIM30cJazSkfFmCJr+8Int7u3mlcX837lVUPyNvH3ZkCYsHGnX BMKS6oEd8+XfiZJP2ctqzk1XxpuHxBPBiwC7rWwLP3SatfHA0x+Xcm/1w/hUF5oiXouI G9a1Bg0VS6746L+vBHzAR3YXQd47QTlWU4wDapLjyI/xC3dteQBr7rL7e3OguGBLNVoJ CYdA== X-Received: by 10.68.196.137 with SMTP id im9mr37129825pbc.105.1401205789953; Tue, 27 May 2014 08:49:49 -0700 (PDT) Received: from [192.168.1.174] ([207.145.253.66]) by mx.google.com with ESMTPSA id ln2sm48901945pab.35.2014.05.27.08.49.43 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 27 May 2014 08:49:47 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\)) From: Dino Farinacci In-Reply-To: <16a14e1029954a9cb74c6115dd3c1a71@CO2PR05MB636.namprd05.prod.outlook.com> Date: Tue, 27 May 2014 08:49:42 -0700 Content-Transfer-Encoding: quoted-printable Message-Id: <64174C84-3DF2-43B0-891C-2237B84A44CA@gmail.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <16a14e1029954a9cb74c6115dd3c1a71@CO2PR05MB636.namprd05.prod.outlook.com> To: Ross Callon X-Mailer: Apple Mail (2.1874) Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/S0RRUjr7KduKyrIxv8VDB7yhvOM Cc: LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 May 2014 15:49:55 -0000 Ross, see my responses inline. > Detailed comments below. To summarize, these details include three = threats which are new to LISP and which are not adequately explained in = the current threats document: >=20 > (1) The Control Plane Threat: LISP allows a dataplane DOS attack (lots = of packets sent to overwhelm a site) to turn into a control plane attack = (the router is forced to respond to the attack in the control plane, = which is of course frequently multiple orders of magnitude slower than = the data plane, particularly for very high speed routers).=20 It turns into a control-plane request stream which is many orders of = magnitude less than the data packet stream. And since the data-plane = bandwidth to the control-plane bandwidth inside of the xTR is also = orders of magnitude of difference, you will find this will protect the = mapping database control-plane. That is, no router control-plane will be capable of sending Map-Requests = at any rate faster than at least 2 orders of magnitude of what the = control-plane in that router implementation can do. And then, if this = xTR will rate-limit on top of the Map-Request rate, it is even slower. This is not speculation. This has been proven with many different = implementation attempts over the last 7 years. > (2) The Privacy Threat: LISP provides an attacker with a relatively = easy way to determine the identity of large numbers of PE and/or CE = routers (globally, if LISP is deployed on that level) . We should document this, but there are tons of easily accessible = databases in protocols, operational data structures, key management = data, and application systems that do this as well. But LISP can encrypt or require authentication of this information, so = it can be hidden from potential attackers. When we built the mapping database system, we wanted it to look like DNS = for scale and accessiblility but knew the security concerns and hence = why we have several mechanisms to allow a mapping database to be a = closed system, even at Internet scale. > (3) the Traffic Gleaning Threat: If an xTR gleans EID -> RLOC mappings = from incoming packets, this provides an easy way for hackers to = intercept traffic. I put this threat third because gleaning can be = turned off, and thus this threat can be defeated simply by not gleaning = EID -> RLOC mappings.=20 This is why the spec says MAY for data gleaning. We put this in the main = specification because in closed enterprise environments people wanted = this feature. > WRT the first of these, Dino has pointed out that the control plane of = routers already receive BGP packets from sources outside their domain. = Thus a DOS attack on the control plane of routers can be launched = through BGP.=20 I don't want to make this a LISP versus BGP debate. Because if we do, we = won't make any progress. But with a centrally managed database system, you can put controls in = without getting an entire Internet peering topology to buy in. The = security systems we can put into the mapping database, can be = incrementally added and provide benefit to xTRs that don't even know = what was added. The mapping database is distributed like DNS to scale but managed = centrally. And I am not talking about using SDN type approaches either = to achieve this. > However, the number of BGP peers that a router has is limited, and can = be known a priori. Thus it is possible, and relatively common, for a = router to be configured to only accept BGP updates from a very limited = number of identified other routers (in many cases a moderate number of = external peers plus a few internal route reflectors). Each of these = known BGP sessions can be individually rate limited, and no other source = can be allowed to send BGP updates to the router. Also, other control = traffic to the router can be limited to internal peers (eg, OSPF, IS-IS, = LDP, and/or RSVP from other internal routers, plus network management = traffic from internal sources only). Thus today every source of control = plane traffic to the router can be controlled and rate limited. For C If you compare the IGPs and protocols that run inside of an AS with = LISP, then LISP has all the same benefits because a single organization = is managing the architecture, so they can decide unilaterally decide how = much security, gleaning, uRPFing they use. I often compare LISP to BGP because of the scale we want LISP to grow = to.=20 > E routers the number of BGP peers can be even more limited, possibly = to one (the PE) or even none (for stub domains use manually configured = static routes).=20 >=20 > If LISP were ubiquitously and globally deployed across the Internet, = then mapping requests could come from pretty much anywhere. Similarly = incoming data plane traffic which contains EID's that are not currently = listed But those Map-Requests can be authenticated if the attacker chose a = Map-Resolver that wanted to operate at a high security level. There will always be open Map-Resolvers (just like DNS server 8.8.8.8) = which has to scale for good and bad requests. Those systems have dozens = of implementation techniques to do signature detection and mitigation of = suspicious packet-request trains. > in your EID -> RLOC mapping would cause a mapping request to be = generated in the control plane. I understand that mapping requests (both = incoming and outgoing) can be rate limited, but this simply turns a = "shut down the router's control plane" attack to turn into a "shut down = the router's mapping function" attack. If correct operation relies on = the mapping function, then you have still broken the router.=20 You have to couple rate-limiting with some cacheing and timing = information. > The second of these is a big deal which has not been talked about = much. We don't want hackers to know the identity of all PE and/or CE = routers. It is difficult to fully anticipate what attacks will occur, = but there certainly have already been intrusions of various kinds = against routers and making it fundamentally easier for hackers to know = the identity of a large number of routers is something that it at least = important enough to mention.=20 If I traceroute to your house Ross, I know all routers on the path. LISP = does not make this problem worse.=20 And we cannot practically say every weakness in the Internet is also a = weakness in LISP, so we may as well not deploy LISP. That will give = people the wrong impression. We want to be honest and document threats, = but we can't get out of hand, because we will ALWAYs be incomplete. And the danger and effort spent on LISP will be what it can't do rather = than what new things it brings to the Internet. > Regarding the third of these, there have already been attacks which = mis-route traffic. Eg: > http://www.wired.com/2013/12/bgp-hijacking-belarus-iceland/ =20 I recommend that no one use data-packet gleaning in an ETR unless the = mapping system knows all sources sending map-requests to a closed and = control mapping system. Data-plane gleaning should not be used generally on the capital-I = Internet. Dino From nobody Tue May 27 09:06:45 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 167911A04AF for ; Tue, 27 May 2014 09:06:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.65 X-Spam-Level: X-Spam-Status: No, score=-1.65 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HELO_EQ_FR=0.35, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4YHlTCNWR_JU for ; Tue, 27 May 2014 09:06:36 -0700 (PDT) Received: from mail-wi0-x233.google.com (mail-wi0-x233.google.com [IPv6:2a00:1450:400c:c05::233]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6406E1A0489 for ; Tue, 27 May 2014 09:06:03 -0700 (PDT) Received: by mail-wi0-f179.google.com with SMTP id bs8so2013304wib.6 for ; Tue, 27 May 2014 09:05:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=pm4h/bA4toOaykfJYXK6UYeu9NopWzoyVThxhOZlNJQ=; b=GHXskJ317fyfs4bSFBNObsUN2rGmT0/2jGk4Kca7w+uoRfEGbedHtGcot8Hr54p1FM Bk4PPz3hv25QRKvsory8gFY6oWhpV5bvCYl3eqaX+7D8K9mnDHBAPjN/UsIGGTeRLLVD 3Cvq0EQsxPApZ5obNJplrwPrxAvP9ogTyNU+CU4HISLrfttjQfTMmseznU51bT+vpelZ csd5yRap8eviQxKyHbWs/V3NRgi4xAatBeXEX+1yuKAEaJ31/sG1TWVH/sN9G8m7nf84 Lyayec737xQkyCzof6ISzS4xQhsRR2m59VplH3FeoMNuTmtm7gU9oizHmRI69/TfEE1F pK3w== X-Received: by 10.194.9.8 with SMTP id v8mr42148735wja.53.1401206757262; Tue, 27 May 2014 09:05:57 -0700 (PDT) Received: from faucon.inria.fr (faucon.inria.fr. [138.96.201.73]) by mx.google.com with ESMTPSA id l2sm9418172wix.13.2014.05.27.09.05.56 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 27 May 2014 09:05:56 -0700 (PDT) Content-Type: text/plain; charset=iso-8859-1 Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.2\)) From: Damien Saucez In-Reply-To: <5384AB4E.2010208@joelhalpern.com> Date: Tue, 27 May 2014 18:05:55 +0200 Content-Transfer-Encoding: quoted-printable Message-Id: <8F830D21-5689-476C-97E9-7D92A1CBAA28@gmail.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <538361DA.10808@joelhalpern.com> <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <5384AB4E.2010208@joelhalpern.com> To: LISP mailing list list X-Mailer: Apple Mail (2.1878.2) Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/5wI5DEd1UIYaj79K5EPBDhzhMM8 Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 May 2014 16:06:38 -0000 Dear all, Thank you all for the passion you put in discussing the threats document. We have read all the arguments and arrived to the conclusion that the threat document needs to be reshaped so to clear all misunderstandings. We will provide a new version for early July that does not exclude any scenarios. Actually most of problems pinpointed are already covered somehow in the document but precisions/rephrasing have to be done to make things clear. For the sake of efficiency, while writing the new proposal in the coming weeks, we will make point-to-point exchanges with the different people that contributed to the discussion so to be sure that we address all their comments. Thanks, Damien Saucez On 27 May 2014, at 17:12, Joel M. Halpern wrote: > Can we please not get into a debate about how well BCP38 is or is not = deployed, whether violations are remotely detectable, ...This is NOT the = working group for that. >=20 > For our purposes, given that source address forging is known to occur, = we have to allow it in the threat analysis. >=20 > Yours, > Joel >=20 > On 5/27/14, 11:04 AM, Dino Farinacci wrote: >>=20 >>> Also, recall that large BCP38 holes exist in today's internet. >>=20 >> And I am going to repeat again, this is not a binary statement. That = is, if a BCP38 hole exists in one part of the network, source spoofing = can still be detected in other parts of the network. >>=20 >> Dino >>=20 >>=20 From nobody Tue May 27 15:45:15 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C103A1A0790 for ; Tue, 27 May 2014 15:45:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.902 X-Spam-Level: X-Spam-Status: No, score=-101.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id soPic6PLPHyS for ; Tue, 27 May 2014 15:45:10 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1blp0186.outbound.protection.outlook.com [207.46.163.186]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8950D1A0503 for ; Tue, 27 May 2014 15:45:09 -0700 (PDT) Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB441.namprd05.prod.outlook.com (10.141.73.147) with Microsoft SMTP Server (TLS) id 15.0.949.11; Tue, 27 May 2014 22:45:02 +0000 Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) with mapi id 15.00.0949.001; Tue, 27 May 2014 22:45:02 +0000 From: Ronald Bonica To: Paul Vinciguerra , "Joel M. Halpern" , Damien Saucez Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEIABfmkAgAefyVCAAITngIABbBJggAETbwCABC0O0IAAtqUAgAABTnCAADykgIABvzTg Date: Tue, 27 May 2014 22:45:02 +0000 Message-ID: <936e209eb2fb49288f3a776aaa4b71cb@CO1PR05MB442.namprd05.prod.outlook.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <538361DA.10808@joelhalpern.com>, <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> In-Reply-To: <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.14] x-forefront-prvs: 02243C58C6 x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(24454002)(377454003)(51704005)(52604005)(479174003)(13464003)(199002)(189002)(15975445006)(101416001)(76576001)(21056001)(19580405001)(83322001)(19580395003)(81342001)(81542001)(33646001)(92566001)(74316001)(86362001)(80022001)(66066001)(20776003)(46102001)(76482001)(79102001)(77982001)(64706001)(83072002)(85852003)(2656002)(87936001)(76176999)(54356999)(50986999)(99396002)(74662001)(99286001)(74502001)(4396001)(31966008)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO1PR05MB441; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/QAKyV-cBkDez99wUR5T4U6m9Lr4 Cc: Roger Jorgensen , LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 May 2014 22:45:13 -0000 Hi Paul, The attack scenario that I envision is slightly different from the on that = you describe below: - LISP is widely deployed. Tens of thousands of XTRs are deployed world-wid= e. The mapping system data base contains hundreds of thousands of EID prefi= xes. - The attack stream is large - Each packet in the attack stream has a unique source LOC - All packets in the attack stream have the same destination LOC. This LOC = represents the XTR under attack. - Each packet in the attack stream has a destination EID that will cause it= to reach a valid destination (i.e., a destination that will respond). Howe= ver, all packets in the attack stream don't have the same destination. The = attack stream is spread out across multiple valid EID destinations to make = it less detectable. - Each packet in the attack stream has a carefully chosen source EID. It is= chosen to maximize the ratio of attack packets to map-requests. One attack stream attacks an XTR. Multiple simultaneous attacks against mul= tiple XTRs can DoS the mapping system, itself. A PxTR probably won't generate this attack stream. However, an attack tool = might. Hope this helps. Ron > -----Original Message----- > From: Paul Vinciguerra [mailto:pvinci@VinciConsulting.com] > Sent: Monday, May 26, 2014 3:28 PM > To: Ronald Bonica; Joel M. Halpern; Damien Saucez > Cc: Roger Jorgensen; LISP mailing list list > Subject: RE: [lisp] Restarting last call on LISP threats >=20 > Every host on the Internet is subject to a DoS attack. An xTR is no more= so. I > am also not clear on how a DoS attack on an xTR would create any more ris= k > than an attack directly against the mapping system. >=20 > Joel describes Ronald's scenario of an attack where a large stream of pac= kets > with different inner source addresses to an ETR. I don't call this an at= tack. I > call this our steady-state. These would be the PxTR's we operate across = the > US. The PxTR's on the beta-network are no different. We take in packets > from anywhere. This is a "Free" attacker if you will. All that really m= eans is > that you do not have to incur the computational cost of encapsulating the > packet. >=20 > I would defer to Dino and others on the list, but I do not believe that t= he ETR > does a reverse lookup on every packet. At least that is not the behavior= we > observe. What we see happen is that the packet is decapsulated and sent = to > the destination. If a valid destination host responds, then the ITR does= a > map-request for the reply packet. There is not a 1:1 relationship betwee= n > the number of packets and the number of map-requests. >=20 > Map-replies for IP addresses return prefixes. These prefixes can cover la= rger > address spaces than the map-request and limit the number of future map- > requests needed. >=20 > Can you provide more specific details on how you see the xTR rendering th= e > mapping system unusable? >=20 > For what its worth, I still support the decision for last call and not to= place > mitigations within the document. Without knowing the specifics of a > configuration and implementation, that just leads to a false sense of sec= urity. >=20 >=20 > ________________________________________ > From: lisp [lisp-bounces@ietf.org] on behalf of Ronald Bonica > [rbonica@juniper.net] > Sent: Monday, May 26, 2014 11:57 AM > To: Joel M. Halpern; Damien Saucez > Cc: Roger Jorgensen; LISP mailing list list > Subject: Re: [lisp] Restarting last call on LISP threats >=20 > Inline..... >=20 > > -----Original Message----- > > From: Joel M. Halpern [mailto:jmh@joelhalpern.com] > > Sent: Monday, May 26, 2014 11:47 AM > > To: Ronald Bonica; Damien Saucez > > Cc: Roger Jorgensen; LISP mailing list list > > Subject: Re: [lisp] Restarting last call on LISP threats > > > > Top posting to make sure I am understanding: > > > > You asssert that any xTR is subject to a DoS attack. And that such a > > DoS attack can render the mapping system unusable. > [RPB] > Exactly! >=20 > > > > It targeting an ITR, this would need to be from within ths cope the ITR > serves. > [RPB] > I don't understand this sentence. Please try again. >=20 > > I believe that is discussed. > [RPB] > Given that I don't understand the sentence above, I have no idea if this > sentence is true. >=20 > > > > If I have connected the dots correctly, the attack you are > > contemplating is sending a large stream of packets with different > > inner source addresses to an ETR. This would prompt the ETR to check > > with the mapping system about each and every address. > [RPB] > Exactly! >=20 > > > > If I have understood this properly, while there are several very > > effective mitigations, that does not change the basic message that > > this is an attack, and as such ought to be described in the threats > document. > [RPB] > Even if there are effective mitigations, the attack should be described. >=20 > However, I am not convinced that an effective mitigation exists. >=20 > > There are clealry a number of variations on this attack. > [RPB] > True! >=20 > For example, using > > the same outer source address makes mitigation easier, while using > > different outer source addresses either requires a bot-net or a large > > unchecked BCP38 hole (and those can be used for MANY attacks on many > > systems.) Both presumably should be described. > [RPB] > Yes, both should be described. >=20 > Also, recall that large BCP38 holes exist in today's internet. >=20 > > > > Have I captured your request accurately? > [RPB] > Pretty much. >=20 > Thanks for taking the effort. >=20 > Ron >=20 > > > > Yours, > > Joel > > > > On 5/26/14, 1:06 AM, Ronald Bonica wrote: > > > *From:*Damien Saucez [mailto:damien.saucez@gmail.com] > > > *Sent:* Friday, May 23, 2014 9:07 AM > > > *To:* Ronald Bonica > > > *Cc:* Dino Farinacci; Roger Jorgensen; LISP mailing list list > > > *Subject:* Re: [lisp] Restarting last call on LISP threats > > > > > > Hello Ronald, > > > > > > On 22 May 2014, at 22:57, Ronald Bonica > > > wrote: > > > > > > > > > > > > Dino, > > > > > > Today's Internet is not as fragile as you think. This mail traver= sed > > > many routers between my house and yours. If those routers are > > > well-managed, there is nothing that I can do from my house that w= ill > > > cause any of those routers to consume control plane resources. > > > Therefore, there is nothing that I can do from my house that will > > > cause a DoS attack against those routers' control planes. > > > > > > We tend to disagree with that, for example you have ICMP today... > > > > > > */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn't make > > > a very good routing protocol. That's why we don't use it for > > > routing. By contrast, LISP map-request messages are susceptible to > > > DoS attacks and they do carry routing information./* > > > > > > > > > > > > In LISP, separation between the forwarding and control plane is > > > lost. As a matter of course, forwarding plane activity causes > > > control plane activity. Since forwarding plane bandwidth exceeds > > > control plane bandwidth, DoS attacks against the control plane ar= e > > > possible. > > > > > > In order to be complete, the threats document must describe the D= oS > > > threat. It should also describe mitigations, if any exist. > > > > > > DoS is already explained and the definition given: > > > > > > " A Denial of Service (DoS) attack aims at disrupting a specific > > > > > > targeted service either by exhausting the resources of the > > > victim up > > > > > > to the point that it is not able to provide a reliable service > > > to > > > > > > legit traffic and/or systems or by exploiting vulnerabilities to > > > make > > > > > > the targeted service unable to operate properly. > > > > > > " > > > > > > is covering the case you mention. > > > > > > */[RPB] /* > > > > > > */You might want to add the following details to section 5.2:/* > > > > > > *//* > > > > > > -A DoS attack can be launched by anybody who can send a packet to > > > the XTR's LOC > > > > > > -DoS attacks can render an XTR inoperable > > > > > > -DDoS attacks can render the mapping system inoperable. > > > > > > This is what differentiates LISP from today's routing system. > > > > > > Ron > > > > > > Damien Saucez > > > > > > > > > > > > > > > Ron > > > > > > > > > > > > -----Original Message----- > > > From: Dino Farinacci [mailto:farinacci@gmail.com] > > > Sent: Wednesday, May 21, 2014 6:58 PM > > > To: Ronald Bonica > > > Cc: Roger Jorgensen; lisp@ietf.org > > > Subject: Re: [lisp] Restarting last call on LISP threats > > > > > > > > > The attacker sends a flow of crafted packets to the victi= m > > > XTR. Each packet > > > > > > is a well-formed LISP data packet. It contains: > > > > > > > > > - an outer IP header (LOC->LOC) > > > - a UDP header > > > - a LISP Header > > > - an IP header (EID->EID) > > > - payload > > > > > > > > > Just like a regular packet I can send to your home router tod= ay. > > > So yes okay. > > > So let's continue. See comments below. > > > > > > > > > Each packet contains control plane information that is ne= w > > > to the victim > > > > > > > > > Be more specific about what control information are in these > > > encapsulated > > > packets. > > > > > > > > > XTR. For example, the victim XTR has no mapping informati= on > > > regarding > > > > > > either the source LOC or source EID prefix. Rather than glean= ing > > > this mapping > > > information from the crafted packet, the victim XTR sends a > > > verifying MAP- > > > REQUEST to the mapping system. > > > > > > > > > Assume that the attack flow is large (N packets per secon= d). > > > Assume also > > > > > > that the XTRs rate limit for MAP-REQUEST messages is less tha= n N > > > packets > > > per second. Has the attack not effectively DoS'd the victim X= TR? > > > > > > It caches the rate the rate the packets are coming in and > > > eventually stops > > > sending Map-Requests completely. > > > > > > It cannot stop the incoming rate of packets today just like a > > > roque BGP > > > attacker can send millions of packets per second to a peer > > > regardless if it > > > does or does not have the peer authentication key. > > > > > > > > > To make this attack work, every packet in the attack flow > > > may need to have > > > > > > a unique, spoofed, source LOC. > > > > > > An implementation can detect that after rate limiting 1000s o= f > > > such requests > > > are happening that it just stops operation. > > > > > > What if I sent a Juniper 20 million routes today? > > > > > > The Internet is very fragile and LISP IS NOT making it worse. > > > And in some > > > cases it is making it better with integrated techniques. > > > > > > Dino > > > > > > > > > _______________________________________________ > > > lisp mailing list > > > lisp@ietf.org > > > https://www.ietf.org/mailman/listinfo/lisp > > > > > > > > > > > > _______________________________________________ > > > lisp mailing list > > > lisp@ietf.org > > > https://www.ietf.org/mailman/listinfo/lisp > > > >=20 > _______________________________________________ > lisp mailing list > lisp@ietf.org > https://www.ietf.org/mailman/listinfo/lisp From nobody Tue May 27 15:55:07 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2A191A02B0 for ; Tue, 27 May 2014 15:55:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.602 X-Spam-Level: X-Spam-Status: No, score=-102.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V_JEKy51mqeA for ; Tue, 27 May 2014 15:54:58 -0700 (PDT) Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2lp0242.outbound.protection.outlook.com [207.46.163.242]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 685791A029F for ; Tue, 27 May 2014 15:54:58 -0700 (PDT) Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB444.namprd05.prod.outlook.com (10.141.73.140) with Microsoft SMTP Server (TLS) id 15.0.949.11; Tue, 27 May 2014 22:54:47 +0000 Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) with mapi id 15.00.0949.001; Tue, 27 May 2014 22:54:47 +0000 From: Ronald Bonica To: Marc Binderberger , "Joel M. Halpern" Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEIABfmkAgAefyVCAAITngIABbBJggAETbwCABC0O0IAAtqUAgAABTnCAADykgIAAAb6AgADP7YCAAPi2YA== Date: Tue, 27 May 2014 22:54:46 +0000 Message-ID: References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <538361DA.10808@joelhalpern.com> <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> <53839747.1080806@joelhalpern.com> <20140527005843634679.23839638@sniff.de> In-Reply-To: <20140527005843634679.23839638@sniff.de> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.14] x-forefront-prvs: 02243C58C6 x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(13464003)(479174003)(377454003)(24454002)(51704005)(52604005)(199002)(189002)(2656002)(77982001)(87936001)(74502001)(31966008)(50986999)(92566001)(99286001)(76576001)(76176999)(85852003)(74662001)(83072002)(81342001)(81542001)(54356999)(33646001)(79102001)(66066001)(101416001)(21056001)(86362001)(20776003)(64706001)(76482001)(19580405001)(83322001)(15975445006)(19580395003)(99396002)(74316001)(80022001)(46102001)(4396001)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO1PR05MB444; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/qETFufVVotml4IKh_puwSGr5XZU Cc: Roger Jorgensen , LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 May 2014 22:55:01 -0000 >=20 > The discussion was IMHO too much focused on gleaning. LISP is made for a > large number of EID networks. If e.g. someone scans the address ranges of > an ISP and the PiTR(s) of the ISP have no forwarding entry then they need= to > send a map-request - a task typically done in control plane. Punting pack= ets > from data to control plane may saturate the punt channel for a time T, du= ring > which a legitimate request may not be processed. [RPB]=20 Agreed. The attack scenario that I describe in my previous message relies n= either on gleening nor source address spoofing. >=20 > To be fair, even for a large number of EID networks (e.g. lots of /29) th= e > period T should not be more than several minutes (my guess, assuming 1k > lookup per second) and it would not affect already established flows, onl= y > the establishment of new flows during the time T, assuming the (P)iTR can > hold all the map-cache entries. >=20 [RPB]=20 Also agreed. We should say something in a threats document about the relati= onship between period T and the size of memory available for the map-cache. >=20 > Regards, Marc >=20 >=20 >=20 > On Mon, 26 May 2014 15:34:31 -0400, Joel M. Halpern wrote: > > It sounds like the PxTRs you are using are already implementing > > sensible mitigations. But the base document does not actually call thi= s out. > > > > On the base document, the ETR can do gleaning (and by some readings > > mgiht be being encouraged to do so). Because of the security threat > > from gleaning, and because the Etr wants to avoid the delay on > > returning traffic, nor use a false glean to direct returning traffic, > > there is text suggesting that the ETR would, immediately upon > > gleaning, check the information with the mapping system. > > > > That would mean that a packet flow to an ETR (which all nodes are, as > > you say, subject to) could become a significant load on the mapping > system. > > > > Making different choices about when to learn or verify entries changes > > that dramatically. But since the document does currently include the > > problematic behavior as legitimate, we need to document that it can > > cause problems. > > > > I am glad to hear that sensible implementations are already dealing > > with this well. > > > > Yours, > > Joel > > > > On 5/26/14, 3:28 PM, Paul Vinciguerra wrote: > >> Every host on the Internet is subject to a DoS attack. An xTR is no > >> more so. I am also not clear on how a DoS attack on an xTR would > >> create any more risk than an attack directly against the mapping > >> system. > >> > >> Joel describes Ronald's scenario of an attack where a large stream of > >> packets with different inner source addresses to an ETR. I don't > >> call this an attack. I call this our steady-state. These would be > >> the PxTR's we operate across the US. The PxTR's on the beta-network > >> are no different. We take in packets from anywhere. This is a > >> "Free" attacker if you will. All that really means is that you do > >> not have to incur the computational cost of encapsulating the packet. > >> > >> I would defer to Dino and others on the list, but I do not believe > >> that the ETR does a reverse lookup on every packet. At least that is > >> not the behavior we observe. What we see happen is that the packet > >> is decapsulated and sent to the destination. If a valid destination > >> host responds, then the ITR does a map-request for the reply packet. > >> There is not a 1:1 relationship between the number of packets and the > >> number of map-requests. > >> > >> Map-replies for IP addresses return prefixes. These prefixes can > >> cover larger address spaces than the map-request and limit the number > >> of future map-requests needed. > >> > >> Can you provide more specific details on how you see the xTR > >> rendering the mapping system unusable? > >> > >> For what its worth, I still support the decision for last call and > >> not to place mitigations within the document. Without knowing the > >> specifics of a configuration and implementation, that just leads to a > >> false sense of security. > >> > >> > >> ________________________________________ From: lisp > >> [lisp-bounces@ietf.org] on behalf of Ronald Bonica > >> [rbonica@juniper.net] Sent: Monday, May 26, 2014 11:57 AM To: Joel M. > >> Halpern; Damien Saucez Cc: Roger Jorgensen; LISP mailing list list > >> Subject: Re: [lisp] Restarting last call on LISP threats > >> > >> Inline..... > >> > >>> -----Original Message----- From: Joel M. Halpern > >>> [mailto:jmh@joelhalpern.com] Sent: Monday, May 26, 2014 11:47 AM > >>> To: Ronald Bonica; Damien Saucez Cc: Roger Jorgensen; LISP mailing > >>> list list Subject: Re: [lisp] Restarting last call on LISP threats > >>> > >>> Top posting to make sure I am understanding: > >>> > >>> You asssert that any xTR is subject to a DoS attack. And that such > >>> a DoS attack can render the mapping system unusable. > >> [RPB] Exactly! > >> > >>> > >>> It targeting an ITR, this would need to be from within ths cope the > >>> ITR serves. > >> [RPB] I don't understand this sentence. Please try again. > >> > >>> I believe that is discussed. > >> [RPB] Given that I don't understand the sentence above, I have no > >> idea if this sentence is true. > >> > >>> > >>> If I have connected the dots correctly, the attack you are > >>> contemplating is sending a large stream of packets with different > >>> inner source addresses to an ETR. This would prompt the ETR to > >>> check with the mapping system about each and every address. > >> [RPB] Exactly! > >> > >>> > >>> If I have understood this properly, while there are several very > >>> effective mitigations, that does not change the basic message that > >>> this is an attack, and as such ought to be described in the threats > >>> document. > >> [RPB] Even if there are effective mitigations, the attack should be > >> described. > >> > >> However, I am not convinced that an effective mitigation exists. > >> > >>> There are clealry a number of variations on this attack. > >> [RPB] True! > >> > >> For example, using > >>> the same outer source address makes mitigation easier, while using > >>> different outer source addresses either requires a bot-net or a > >>> large unchecked BCP38 hole (and those can be used for MANY attacks > >>> on many systems.) Both presumably should be described. > >> [RPB] Yes, both should be described. > >> > >> Also, recall that large BCP38 holes exist in today's internet. > >> > >>> > >>> Have I captured your request accurately? > >> [RPB] Pretty much. > >> > >> Thanks for taking the effort. > >> > >> Ron > >> > >>> > >>> Yours, Joel > >>> > >>> On 5/26/14, 1:06 AM, Ronald Bonica wrote: > >>>> *From:*Damien Saucez [mailto:damien.saucez@gmail.com] *Sent:* > >>>> Friday, May 23, 2014 9:07 AM *To:* Ronald Bonica *Cc:* Dino > >>>> Farinacci; Roger Jorgensen; LISP mailing list list *Subject:* Re: > >>>> [lisp] Restarting last call on LISP threats > >>>> > >>>> Hello Ronald, > >>>> > >>>> On 22 May 2014, at 22:57, Ronald Bonica >>>> > wrote: > >>>> > >>>> > >>>> > >>>> Dino, > >>>> > >>>> Today's Internet is not as fragile as you think. This mail > >>>> traversed many routers between my house and yours. If those routers > >>>> are well-managed, there is nothing that I can do from my house that > >>>> will cause any of those routers to consume control plane resources. > >>>> Therefore, there is nothing that I can do from my house that will > >>>> cause a DoS attack against those routers' > >>>> control planes. > >>>> > >>>> We tend to disagree with that, for example you have ICMP today... > >>>> > >>>> */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn't > >>>> make a very good routing protocol. That's why we don't use it for > >>>> routing. By contrast, LISP map-request messages are susceptible to > >>>> DoS attacks and they do carry routing information./* > >>>> > >>>> > >>>> > >>>> In LISP, separation between the forwarding and control plane is > >>>> lost. As a matter of course, forwarding plane activity causes > >>>> control plane activity. Since forwarding plane bandwidth exceeds > >>>> control plane bandwidth, DoS attacks against the control plane are > >>>> possible. > >>>> > >>>> In order to be complete, the threats document must describe the DoS > >>>> threat. It should also describe mitigations, if any exist. > >>>> > >>>> DoS is already explained and the definition given: > >>>> > >>>> " A Denial of Service (DoS) attack aims at disrupting a specific > >>>> > >>>> targeted service either by exhausting the resources of the victim > >>>> up > >>>> > >>>> to the point that it is not able to provide a reliable service to > >>>> > >>>> legit traffic and/or systems or by exploiting vulnerabilities to > >>>> make > >>>> > >>>> the targeted service unable to operate properly. > >>>> > >>>> " > >>>> > >>>> is covering the case you mention. > >>>> > >>>> */[RPB] /* > >>>> > >>>> */You might want to add the following details to section 5.2:/* > >>>> > >>>> *//* > >>>> > >>>> -A DoS attack can be launched by anybody who can send a packet to > >>>> the XTR's LOC > >>>> > >>>> -DoS attacks can render an XTR inoperable > >>>> > >>>> -DDoS attacks can render the mapping system inoperable. > >>>> > >>>> This is what differentiates LISP from today's routing system. > >>>> > >>>> Ron > >>>> > >>>> Damien Saucez > >>>> > >>>> > >>>> > >>>> > >>>> Ron > >>>> > >>>> > >>>> > >>>> -----Original Message----- From: Dino Farinacci > >>>> [mailto:farinacci@gmail.com] Sent: Wednesday, May 21, 2014 6:58 PM > >>>> To: Ronald Bonica Cc: Roger Jorgensen; lisp@ietf.org > >>>> Subject: Re: [lisp] Restarting last call on > >>>> LISP threats > >>>> > >>>> > >>>> The attacker sends a flow of crafted packets to the victim XTR. > >>>> Each packet > >>>> > >>>> is a well-formed LISP data packet. It contains: > >>>> > >>>> > >>>> - an outer IP header (LOC->LOC) - a UDP header - a LISP Header - an > >>>> IP header (EID->EID) - payload > >>>> > >>>> > >>>> Just like a regular packet I can send to your home router today. > >>>> So yes okay. So let's continue. See comments below. > >>>> > >>>> > >>>> Each packet contains control plane information that is new to the > >>>> victim > >>>> > >>>> > >>>> Be more specific about what control information are in these > >>>> encapsulated packets. > >>>> > >>>> > >>>> XTR. For example, the victim XTR has no mapping information > >>>> regarding > >>>> > >>>> either the source LOC or source EID prefix. Rather than gleaning > >>>> this mapping information from the crafted packet, the victim XTR > >>>> sends a verifying MAP- REQUEST to the mapping system. > >>>> > >>>> > >>>> Assume that the attack flow is large (N packets per second). > >>>> Assume also > >>>> > >>>> that the XTRs rate limit for MAP-REQUEST messages is less than N > >>>> packets per second. Has the attack not effectively DoS'd the victim > >>>> XTR? > >>>> > >>>> It caches the rate the rate the packets are coming in and > >>>> eventually stops sending Map-Requests completely. > >>>> > >>>> It cannot stop the incoming rate of packets today just like a roque > >>>> BGP attacker can send millions of packets per second to a peer > >>>> regardless if it does or does not have the peer authentication key. > >>>> > >>>> > >>>> To make this attack work, every packet in the attack flow may need > >>>> to have > >>>> > >>>> a unique, spoofed, source LOC. > >>>> > >>>> An implementation can detect that after rate limiting 1000s of such > >>>> requests are happening that it just stops operation. > >>>> > >>>> What if I sent a Juniper 20 million routes today? > >>>> > >>>> The Internet is very fragile and LISP IS NOT making it worse. And > >>>> in some cases it is making it better with integrated techniques. > >>>> > >>>> Dino > >>>> > >>>> > >>>> _______________________________________________ lisp > mailing list > >>>> lisp@ietf.org > >>>> https://www.ietf.org/mailman/listinfo/lisp > >>>> > >>>> > >>>> > >>>> _______________________________________________ lisp > mailing list > >>>> lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp > >>>> > >> > >> _______________________________________________ lisp mailing > list > >> lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp > >> > > > > _______________________________________________ > > lisp mailing list > > lisp@ietf.org > > https://www.ietf.org/mailman/listinfo/lisp > > From nobody Tue May 27 16:18:47 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 625F11A0704 for ; Tue, 27 May 2014 16:18:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id avXE7eVi0xBO for ; Tue, 27 May 2014 16:18:45 -0700 (PDT) Received: from mail-ig0-x234.google.com (mail-ig0-x234.google.com [IPv6:2607:f8b0:4001:c05::234]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 10AD61A02AF for ; Tue, 27 May 2014 16:18:45 -0700 (PDT) Received: by mail-ig0-f180.google.com with SMTP id c1so1778394igq.7 for ; Tue, 27 May 2014 16:18:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=XAfNGbR6ARhrSm1cxmkhvlx10ikaL3yIAQL9GJPacxE=; b=1Gcm2RWJ8bZgW1xbw9EUmTbNgbBtcqNmypDp4JLtOliHKaTxng+Qkv9KzgPzvkrsoA Y/wzUJ5GzG2iBF9FQlNo2n1c9lr3qZKx5crNDtaP98yGPnjpGz+IH4xwptz4XZlIcB1D rC67ulqSsDW7dz5fiL6yqPafwCKIDPKblvei5bett4f5EZg1uPnArxV0zdFMRRewgYpY acdDZ8ctorpwPhV+FDZxS5omzP2UwRKdKoqiD9/zrTGpNDTgKfHH+AhlGjdvSd7Krle1 3SejoW02ASBi5I8QBVvwvwN3GRDayChg3oRpEbUIIPFCema+xx9w97lwrKNFbPymj75q WCzQ== X-Received: by 10.50.30.6 with SMTP id o6mr38030123igh.43.1401232721552; Tue, 27 May 2014 16:18:41 -0700 (PDT) Received: from [192.168.1.10] ([50.141.65.3]) by mx.google.com with ESMTPSA id ng17sm8347989igb.13.2014.05.27.16.18.40 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 27 May 2014 16:18:40 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\)) From: Dino Farinacci In-Reply-To: <936e209eb2fb49288f3a776aaa4b71cb@CO1PR05MB442.namprd05.prod.outlook.com> Date: Tue, 27 May 2014 16:18:37 -0700 Content-Transfer-Encoding: quoted-printable Message-Id: <7E76C55E-CCD0-4A52-A481-5BA9BF6A6689@gmail.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <538361DA.10808@joelhalpern.com>, <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> <936e209eb2fb49288f3a776aaa4b71cb@CO1PR05MB442.namprd05.prod.outlook.com> To: Ronald Bonica X-Mailer: Apple Mail (2.1874) Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/Xu4IzvqnIn4tc8zt3JMnn4bix5U Cc: Roger Jorgensen , LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 May 2014 23:18:46 -0000 > Hi Paul, >=20 > The attack scenario that I envision is slightly different from the on = that you describe below: >=20 > - LISP is widely deployed. Tens of thousands of XTRs are deployed = world-wide. The mapping system data base contains hundreds of thousands = of EID prefixes. > - The attack stream is large > - Each packet in the attack stream has a unique source LOC > - All packets in the attack stream have the same destination LOC. This = LOC represents the XTR under attack. > - Each packet in the attack stream has a destination EID that will = cause it to reach a valid destination (i.e., a destination that will = respond). However, all packets in the attack stream don't have the same = destination. The attack stream is spread out across multiple valid EID = destinations to make it less detectable. > - Each packet in the attack stream has a carefully chosen source EID. = It is chosen to maximize the ratio of attack packets to map-requests. >=20 > One attack stream attacks an XTR. Multiple simultaneous attacks = against multiple XTRs can DoS the mapping system, itself. >=20 > A PxTR probably won't generate this attack stream. However, an attack = tool might. Ignoring the unique source RLOC (which makes no difference in this = attack because we are not doing a RPF check on the ETR), it is the same = as if a PITR was encapsulating from the same set of source-EIDs to the = same set of destination-EIDs you describe above. That was his point. So some clarifications: (1) What does unique source LOC mean? I assume you mean each packet as a = different source RLOC and that the address is not duplicated from = multiple sites (i.e. is it not a private address like 192.168.1.1), or = do you meawn something else? (2) And what is carefully chosen mean? You might mean a scan of = differnet source EIDs in each packet so the xTR that returns packets = will get more map-cache misses?=20 Dino From nobody Tue May 27 17:18:39 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6075E1A07DD for ; Tue, 27 May 2014 17:18:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -99.602 X-Spam-Level: X-Spam-Status: No, score=-99.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MANGLED_WRLDWD=2.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VgsSRbYdhVoh for ; Tue, 27 May 2014 17:18:36 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0142.outbound.protection.outlook.com [207.46.163.142]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 415471A02E4 for ; Tue, 27 May 2014 17:18:36 -0700 (PDT) Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB443.namprd05.prod.outlook.com (10.141.73.152) with Microsoft SMTP Server (TLS) id 15.0.949.11; Wed, 28 May 2014 00:18:29 +0000 Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) with mapi id 15.00.0949.001; Wed, 28 May 2014 00:18:29 +0000 From: Ronald Bonica To: Dino Farinacci Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEIABfmkAgAefyVCAAITngIABbBJggAETbwCABC0O0IAAtqUAgAABTnCAADykgIABvzTggAATfICAAA/EoA== Date: Wed, 28 May 2014 00:18:29 +0000 Message-ID: <9091dab3083e460abb2080f1e9315aba@CO1PR05MB442.namprd05.prod.outlook.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <538361DA.10808@joelhalpern.com>, <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> <936e209eb2fb49288f3a776aaa4b71cb@CO1PR05MB442.namprd05.prod.outlook.com> <7E76C55E-CCD0-4A52-A481-5BA9BF6A6689@gmail.com> In-Reply-To: <7E76C55E-CCD0-4A52-A481-5BA9BF6A6689@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.14] x-forefront-prvs: 0225B0D5BC x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(377454003)(13464003)(51704005)(199002)(189002)(1411001)(21056001)(76482001)(81342001)(74502001)(74662001)(81542001)(74316001)(76576001)(79102001)(2656002)(76176999)(86362001)(87936001)(101416001)(31966008)(33646001)(83072002)(4396001)(99396002)(77982001)(19580405001)(19580395003)(83322001)(99286001)(46102001)(92566001)(50986999)(80022001)(64706001)(20776003)(54356999)(66066001)(85852003)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO1PR05MB443; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/VPuIynrHIRoLHv0yEqSCPnPr0EE Cc: Roger Jorgensen , LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 May 2014 00:18:38 -0000 Inline.... > -----Original Message----- > From: Dino Farinacci [mailto:farinacci@gmail.com] > Sent: Tuesday, May 27, 2014 7:19 PM > To: Ronald Bonica > Cc: Paul Vinciguerra; Joel M. Halpern; Damien Saucez; Roger Jorgensen; LI= SP > mailing list list > Subject: Re: [lisp] Restarting last call on LISP threats >=20 >=20 > > Hi Paul, > > > > The attack scenario that I envision is slightly different from the on t= hat you > describe below: > > > > - LISP is widely deployed. Tens of thousands of XTRs are deployed world= - > wide. The mapping system data base contains hundreds of thousands of EID > prefixes. > > - The attack stream is large > > - Each packet in the attack stream has a unique source LOC > > - All packets in the attack stream have the same destination LOC. This = LOC > represents the XTR under attack. > > - Each packet in the attack stream has a destination EID that will caus= e it to > reach a valid destination (i.e., a destination that will respond). Howeve= r, all > packets in the attack stream don't have the same destination. The attack > stream is spread out across multiple valid EID destinations to make it le= ss > detectable. > > - Each packet in the attack stream has a carefully chosen source EID. I= t is > chosen to maximize the ratio of attack packets to map-requests. > > > > One attack stream attacks an XTR. Multiple simultaneous attacks against > multiple XTRs can DoS the mapping system, itself. > > > > A PxTR probably won't generate this attack stream. However, an attack t= ool > might. >=20 > Ignoring the unique source RLOC (which makes no difference in this attack > because we are not doing a RPF check on the ETR), it is the same as if a = PITR > was encapsulating from the same set of source-EIDs to the same set of > destination-EIDs you describe above. >=20 > That was his point. >=20 > So some clarifications: >=20 > (1) What does unique source LOC mean? I assume you mean each packet as > a different source RLOC and that the address is not duplicated from multi= ple > sites (i.e. is it not a private address like 192.168.1.1), or do you meaw= n > something else? [RPB]=20 No two packets in the attack stream have the same Source RLOC. >=20 > (2) And what is carefully chosen mean? You might mean a scan of differnet > source EIDs in each packet so the xTR that returns packets will get more = map- > cache misses? [RPB]=20 Exactly. Source EIDs are chosen to maximize the ratio of attack packets to = map-requests sent by the victim XTR. This is what make the attack stream so different from a stream that a PiTR = is likely to send during normal operation. = Ron >=20 > Dino From nobody Tue May 27 18:12:39 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5D7C1A0850 for ; Tue, 27 May 2014 18:12:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WNNMCqDfzyVu for ; Tue, 27 May 2014 18:12:29 -0700 (PDT) Received: from mail-pb0-x236.google.com (mail-pb0-x236.google.com [IPv6:2607:f8b0:400e:c01::236]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 197AE1A084A for ; Tue, 27 May 2014 18:12:29 -0700 (PDT) Received: by mail-pb0-f54.google.com with SMTP id jt11so10261096pbb.27 for ; Tue, 27 May 2014 18:12:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=QjijGiaREw2bfLEvWiFtGT/8G/kpDI/UyiS+ZizI5Tw=; b=eOLVeL624rc7l93WSEy22n7ygEDeiFkRm0Jkq78p8yWe8DEuZ38pPMDaeS7JBb9Pbw x6WeKHA0ZDVjfxc9lZ83z+xiBV+OaY7kUgp6dfHnsmXYXLo7ZHwQdFwE4H9XIhad1xHH AH9E4oZ3xV0SvgRpIJ6bvsVeHZqbxpw7gPAvM/wkYVLJtXuwJyXO0//by71CEdY7G/JU vXGrFiCOifQu86WU9JBn0Dh8ArwIkmdkKi7lcmlI2ZoHxcA0qGywJ7h/Ym7o8uI0ce2b Hg5sNs3XS6rka62Cw21NMCjBHPgonD+ywrh00LHWyIpg8tJzafq1JStC4qqM+DKy7nJq Fxug== X-Received: by 10.68.134.169 with SMTP id pl9mr40951924pbb.133.1401239545795; Tue, 27 May 2014 18:12:25 -0700 (PDT) Received: from [192.168.1.7] (173-8-188-29-SFBA.hfc.comcastbusiness.net. [173.8.188.29]) by mx.google.com with ESMTPSA id z3sm80596717pas.15.2014.05.27.18.12.24 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 27 May 2014 18:12:24 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Dino Farinacci X-Mailer: iPad Mail (11D201) In-Reply-To: <9091dab3083e460abb2080f1e9315aba@CO1PR05MB442.namprd05.prod.outlook.com> Date: Tue, 27 May 2014 18:12:24 -0700 Content-Transfer-Encoding: quoted-printable Message-Id: <4B057F83-72DF-44B8-A6D5-2DF6829C8948@gmail.com> References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <538361DA.10808@joelhalpern.com> <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> <936e209eb2fb49288f3a776aaa4b71cb@CO1PR05MB442.namprd05.prod.outlook.com> <7E76C55E-CCD0-4A52-A481-5BA9BF6A6689@gmail.com> <9091dab3083e460abb2080f1e9315aba@CO1PR05MB442.namprd05.prod.outlook.com> To: Ronald Bonica Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/bse790RnRgVV-7ZRt655ZYY_l7w Cc: Roger Jorgensen , LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 May 2014 01:12:33 -0000 > On May 27, 2014, at 5:18 PM, Ronald Bonica wrote: >=20 > RPB]=20 > Exactly. Source EIDs are chosen to maximize the ratio of attack packets to= map-requests sent by the victim XTR. >=20 > This is what make the attack stream so different from a stream that a PiTR= is likely to send during normal operation. It is not different for that reason. It is different because packets encapsu= lated by PITRs originate from non-LISP sources. Thereby the ITR at the LISP s= ite will natively-forward to those random places. And those native-forward m= ap-cache entries are very coarse since the mapping system returns the least s= pecific prefix that covers all non-LISP sites.=20 I believe Paul is still right IMO.=20 Dino= From nobody Tue May 27 22:50:51 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A073A1A0358 for ; Tue, 27 May 2014 22:50:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.553 X-Spam-Level: X-Spam-Status: No, score=-2.553 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.651, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CatqCIwM1our for ; Tue, 27 May 2014 22:50:44 -0700 (PDT) Received: from roura.ac.upc.es (roura.ac.upc.edu [147.83.33.10]) by ietfa.amsl.com (Postfix) with ESMTP id C986F1A033E for ; Tue, 27 May 2014 22:50:43 -0700 (PDT) Received: from gw-3.ac.upc.es (gw-3.ac.upc.es [147.83.30.9]) by roura.ac.upc.es (8.13.8/8.13.8) with ESMTP id s4S5jcYj025307; Wed, 28 May 2014 07:45:38 +0200 Received: from [192.168.1.16] (unknown [90.163.230.43]) by gw-3.ac.upc.es (Postfix) with ESMTPSA id C3D4944F; Wed, 28 May 2014 07:50:38 +0200 (CEST) Message-ID: <5385792B.1010103@ac.upc.edu> Date: Wed, 28 May 2014 07:50:35 +0200 From: Florin Coras User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.5.0 MIME-Version: 1.0 To: lisp@ietf.org References: <536CFA13.4010102@joelhalpern.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <538361DA.10808@joelhalpern.com>, <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> <936e209eb2fb49288f3a776aaa4b71cb@CO1PR05MB442.namprd05.prod.outlook.com> In-Reply-To: <936e209eb2fb49288f3a776aaa4b71cb@CO1PR05MB442.namprd05.prod.outlook.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/vFAfoMI-FYFZ-rxjV0NZX-8Mm_I Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 May 2014 05:50:48 -0000 Hi Ron, It turns out that just doing a flat scan of the EID-prefix space, i.e., using as source EID an IP in each existing EID-prefix, has the most damaging consequences (see fig. 5 in [1]). This, if you contrast it with the case when you try to craft packets whose replies (coming from intra-domain sources) will always generate misses in the xTR under attack. If the attack intensity (attack packet rate to legitimate traffic rate ratio) is high, say above 0.01, you are right to assume that such an attack could cripple an xTR and generate lots of misses. However, as we mention in the paper, some simple solutions could be set in place to avoid this. For instance: 1) When the attack is detected (due to the higher than normal miss rate), the most important entries in the cache, the most popular (say, Google, Fb, Amazon ..) can be protected from eviction. Thereby, on the one hand, set up flows won't have their entries evicted and on the other, this set of entries will ensure that a very large part of the new outgoing flows will cache hit. 2) Just add more memory! Besides the TCAM in the xTR we could use a large second level memory able to cache the whole EID address space. Alternatively, you could imagine having an xTR per site, capable of holding the whole EID address space, that could act as default for packets that miss in all the other sub-provisioned xTRs. [1] http://arxiv.org/pdf/1312.1378v2.pdf Florin On 05/28/2014 12:45 AM, Ronald Bonica wrote: > Hi Paul, > > The attack scenario that I envision is slightly different from the on that you describe below: > > - LISP is widely deployed. Tens of thousands of XTRs are deployed world-wide. The mapping system data base contains hundreds of thousands of EID prefixes. > - The attack stream is large > - Each packet in the attack stream has a unique source LOC > - All packets in the attack stream have the same destination LOC. This LOC represents the XTR under attack. > - Each packet in the attack stream has a destination EID that will cause it to reach a valid destination (i.e., a destination that will respond). However, all packets in the attack stream don't have the same destination. The attack stream is spread out across multiple valid EID destinations to make it less detectable. > - Each packet in the attack stream has a carefully chosen source EID. It is chosen to maximize the ratio of attack packets to map-requests. > > One attack stream attacks an XTR. Multiple simultaneous attacks against multiple XTRs can DoS the mapping system, itself. > > A PxTR probably won't generate this attack stream. However, an attack tool might. > > Hope this helps. > > Ron > >> -----Original Message----- >> From: Paul Vinciguerra [mailto:pvinci@VinciConsulting.com] >> Sent: Monday, May 26, 2014 3:28 PM >> To: Ronald Bonica; Joel M. Halpern; Damien Saucez >> Cc: Roger Jorgensen; LISP mailing list list >> Subject: RE: [lisp] Restarting last call on LISP threats >> >> Every host on the Internet is subject to a DoS attack. An xTR is no more so. I >> am also not clear on how a DoS attack on an xTR would create any more risk >> than an attack directly against the mapping system. >> >> Joel describes Ronald's scenario of an attack where a large stream of packets >> with different inner source addresses to an ETR. I don't call this an attack. I >> call this our steady-state. These would be the PxTR's we operate across the >> US. The PxTR's on the beta-network are no different. We take in packets >> from anywhere. This is a "Free" attacker if you will. All that really means is >> that you do not have to incur the computational cost of encapsulating the >> packet. >> >> I would defer to Dino and others on the list, but I do not believe that the ETR >> does a reverse lookup on every packet. At least that is not the behavior we >> observe. What we see happen is that the packet is decapsulated and sent to >> the destination. If a valid destination host responds, then the ITR does a >> map-request for the reply packet. There is not a 1:1 relationship between >> the number of packets and the number of map-requests. >> >> Map-replies for IP addresses return prefixes. These prefixes can cover larger >> address spaces than the map-request and limit the number of future map- >> requests needed. >> >> Can you provide more specific details on how you see the xTR rendering the >> mapping system unusable? >> >> For what its worth, I still support the decision for last call and not to place >> mitigations within the document. Without knowing the specifics of a >> configuration and implementation, that just leads to a false sense of security. >> >> >> ________________________________________ >> From: lisp [lisp-bounces@ietf.org] on behalf of Ronald Bonica >> [rbonica@juniper.net] >> Sent: Monday, May 26, 2014 11:57 AM >> To: Joel M. Halpern; Damien Saucez >> Cc: Roger Jorgensen; LISP mailing list list >> Subject: Re: [lisp] Restarting last call on LISP threats >> >> Inline..... >> >>> -----Original Message----- >>> From: Joel M. Halpern [mailto:jmh@joelhalpern.com] >>> Sent: Monday, May 26, 2014 11:47 AM >>> To: Ronald Bonica; Damien Saucez >>> Cc: Roger Jorgensen; LISP mailing list list >>> Subject: Re: [lisp] Restarting last call on LISP threats >>> >>> Top posting to make sure I am understanding: >>> >>> You asssert that any xTR is subject to a DoS attack. And that such a >>> DoS attack can render the mapping system unusable. >> [RPB] >> Exactly! >> >>> It targeting an ITR, this would need to be from within ths cope the ITR >> serves. >> [RPB] >> I don't understand this sentence. Please try again. >> >>> I believe that is discussed. >> [RPB] >> Given that I don't understand the sentence above, I have no idea if this >> sentence is true. >> >>> If I have connected the dots correctly, the attack you are >>> contemplating is sending a large stream of packets with different >>> inner source addresses to an ETR. This would prompt the ETR to check >>> with the mapping system about each and every address. >> [RPB] >> Exactly! >> >>> If I have understood this properly, while there are several very >>> effective mitigations, that does not change the basic message that >>> this is an attack, and as such ought to be described in the threats >> document. >> [RPB] >> Even if there are effective mitigations, the attack should be described. >> >> However, I am not convinced that an effective mitigation exists. >> >>> There are clealry a number of variations on this attack. >> [RPB] >> True! >> >> For example, using >>> the same outer source address makes mitigation easier, while using >>> different outer source addresses either requires a bot-net or a large >>> unchecked BCP38 hole (and those can be used for MANY attacks on many >>> systems.) Both presumably should be described. >> [RPB] >> Yes, both should be described. >> >> Also, recall that large BCP38 holes exist in today's internet. >> >>> Have I captured your request accurately? >> [RPB] >> Pretty much. >> >> Thanks for taking the effort. >> >> Ron >> >>> Yours, >>> Joel >>> >>> On 5/26/14, 1:06 AM, Ronald Bonica wrote: >>>> *From:*Damien Saucez [mailto:damien.saucez@gmail.com] >>>> *Sent:* Friday, May 23, 2014 9:07 AM >>>> *To:* Ronald Bonica >>>> *Cc:* Dino Farinacci; Roger Jorgensen; LISP mailing list list >>>> *Subject:* Re: [lisp] Restarting last call on LISP threats >>>> >>>> Hello Ronald, >>>> >>>> On 22 May 2014, at 22:57, Ronald Bonica >>> > wrote: >>>> >>>> >>>> >>>> Dino, >>>> >>>> Today's Internet is not as fragile as you think. This mail traversed >>>> many routers between my house and yours. If those routers are >>>> well-managed, there is nothing that I can do from my house that will >>>> cause any of those routers to consume control plane resources. >>>> Therefore, there is nothing that I can do from my house that will >>>> cause a DoS attack against those routers' control planes. >>>> >>>> We tend to disagree with that, for example you have ICMP today... >>>> >>>> */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn't make >>>> a very good routing protocol. That's why we don't use it for >>>> routing. By contrast, LISP map-request messages are susceptible to >>>> DoS attacks and they do carry routing information./* >>>> >>>> >>>> >>>> In LISP, separation between the forwarding and control plane is >>>> lost. As a matter of course, forwarding plane activity causes >>>> control plane activity. Since forwarding plane bandwidth exceeds >>>> control plane bandwidth, DoS attacks against the control plane are >>>> possible. >>>> >>>> In order to be complete, the threats document must describe the DoS >>>> threat. It should also describe mitigations, if any exist. >>>> >>>> DoS is already explained and the definition given: >>>> >>>> " A Denial of Service (DoS) attack aims at disrupting a specific >>>> >>>> targeted service either by exhausting the resources of the >>>> victim up >>>> >>>> to the point that it is not able to provide a reliable service >>>> to >>>> >>>> legit traffic and/or systems or by exploiting vulnerabilities to >>>> make >>>> >>>> the targeted service unable to operate properly. >>>> >>>> " >>>> >>>> is covering the case you mention. >>>> >>>> */[RPB] /* >>>> >>>> */You might want to add the following details to section 5.2:/* >>>> >>>> *//* >>>> >>>> -A DoS attack can be launched by anybody who can send a packet to >>>> the XTR's LOC >>>> >>>> -DoS attacks can render an XTR inoperable >>>> >>>> -DDoS attacks can render the mapping system inoperable. >>>> >>>> This is what differentiates LISP from today's routing system. >>>> >>>> Ron >>>> >>>> Damien Saucez >>>> >>>> >>>> >>>> >>>> Ron >>>> >>>> >>>> >>>> -----Original Message----- >>>> From: Dino Farinacci [mailto:farinacci@gmail.com] >>>> Sent: Wednesday, May 21, 2014 6:58 PM >>>> To: Ronald Bonica >>>> Cc: Roger Jorgensen; lisp@ietf.org >>>> Subject: Re: [lisp] Restarting last call on LISP threats >>>> >>>> >>>> The attacker sends a flow of crafted packets to the victim >>>> XTR. Each packet >>>> >>>> is a well-formed LISP data packet. It contains: >>>> >>>> >>>> - an outer IP header (LOC->LOC) >>>> - a UDP header >>>> - a LISP Header >>>> - an IP header (EID->EID) >>>> - payload >>>> >>>> >>>> Just like a regular packet I can send to your home router today. >>>> So yes okay. >>>> So let's continue. See comments below. >>>> >>>> >>>> Each packet contains control plane information that is new >>>> to the victim >>>> >>>> >>>> Be more specific about what control information are in these >>>> encapsulated >>>> packets. >>>> >>>> >>>> XTR. For example, the victim XTR has no mapping information >>>> regarding >>>> >>>> either the source LOC or source EID prefix. Rather than gleaning >>>> this mapping >>>> information from the crafted packet, the victim XTR sends a >>>> verifying MAP- >>>> REQUEST to the mapping system. >>>> >>>> >>>> Assume that the attack flow is large (N packets per second). >>>> Assume also >>>> >>>> that the XTRs rate limit for MAP-REQUEST messages is less than N >>>> packets >>>> per second. Has the attack not effectively DoS'd the victim XTR? >>>> >>>> It caches the rate the rate the packets are coming in and >>>> eventually stops >>>> sending Map-Requests completely. >>>> >>>> It cannot stop the incoming rate of packets today just like a >>>> roque BGP >>>> attacker can send millions of packets per second to a peer >>>> regardless if it >>>> does or does not have the peer authentication key. >>>> >>>> >>>> To make this attack work, every packet in the attack flow >>>> may need to have >>>> >>>> a unique, spoofed, source LOC. >>>> >>>> An implementation can detect that after rate limiting 1000s of >>>> such requests >>>> are happening that it just stops operation. >>>> >>>> What if I sent a Juniper 20 million routes today? >>>> >>>> The Internet is very fragile and LISP IS NOT making it worse. >>>> And in some >>>> cases it is making it better with integrated techniques. >>>> >>>> Dino >>>> >>>> >>>> _______________________________________________ >>>> lisp mailing list >>>> lisp@ietf.org >>>> https://www.ietf.org/mailman/listinfo/lisp >>>> >>>> >>>> >>>> _______________________________________________ >>>> lisp mailing list >>>> lisp@ietf.org >>>> https://www.ietf.org/mailman/listinfo/lisp >>>> >> _______________________________________________ >> lisp mailing list >> lisp@ietf.org >> https://www.ietf.org/mailman/listinfo/lisp > _______________________________________________ > lisp mailing list > lisp@ietf.org > https://www.ietf.org/mailman/listinfo/lisp From nobody Wed May 28 00:38:03 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E33181A03CD for ; Wed, 28 May 2014 00:38:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.201 X-Spam-Level: X-Spam-Status: No, score=-2.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, RP_MATCHES_RCVD=-0.651] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XTOv2eH3jPHQ for ; Wed, 28 May 2014 00:37:55 -0700 (PDT) Received: from door.sniff.de (door.sniff.de [IPv6:2001:6f8:94f:1::1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D9021A03A2 for ; Wed, 28 May 2014 00:37:55 -0700 (PDT) Received: from [IPv6:::1] (localhost.sniff.de [127.0.0.1]) by door.sniff.de (Postfix) with ESMTP id 0B1412AA0F; Wed, 28 May 2014 07:37:48 +0000 (GMT) Date: Wed, 28 May 2014 00:37:56 -0700 From: Marc Binderberger To: Florin Coras , Ronald Bonica Message-ID: <20140528003756040812.38ca9d6c@sniff.de> In-Reply-To: <5385792B.1010103@ac.upc.edu> References: <536CFA13.4010102@joelhalpern.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <538361DA.10808@joelhalpern.com> <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> <936e209eb2fb49288f3a776aaa4b71cb@CO1PR05MB442.namprd05.prod.outlook.com> <5385792B.1010103@ac.upc.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Mailer: GyazMail version 1.5.15 Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/Cp61k_3_qYbnH0PBns6dSljz5FE Cc: lisp@ietf.org Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 May 2014 07:38:01 -0000 Hello Florin et al., interesting discussion and I think some aspects should continue to be discussed. But I start wondering: where is this thread heading? It doesn't seem to move forward with respect to the "last call" topic :-) Florin, your reply seems to indicate that Ronald's scenario is a valid attack as you describe mitigation strategies. But is Ronald's scenario really _new_ with respect to the draft? It seems to be covered by section 4.2/4.3.1.1 (?). If the opinion is that Ron's scenario is not covered by the draft yet then do we need additional text in the draft? Any proposal, Ron? Myself I'm expecting from the draft that it provides an overview of the potential problems and some attack vectors to stimulate ideas. I do not assume that the level of details in the draft and the "relevance" of the attack correspond - what is relevant or not may depend on whom you ask. Thanks & Regards, Marc On Wed, 28 May 2014 07:50:35 +0200, Florin Coras wrote: > Hi Ron, > > It turns out that just doing a flat scan of the EID-prefix space, i.e., > using as source EID an IP in each existing EID-prefix, has the most > damaging consequences (see fig. 5 in [1]). This, if you contrast it with > the case when you try to craft packets whose replies (coming from > intra-domain sources) will always generate misses in the xTR under attack. > > If the attack intensity (attack packet rate to legitimate traffic rate > ratio) is high, say above 0.01, you are right to assume that such an attack > could cripple an xTR and generate lots of misses. However, as we mention in > the paper, some simple solutions could be set in place to avoid this. For > instance: > > 1) When the attack is detected (due to the higher than normal miss rate), > the most important entries in the cache, the most popular (say, Google, Fb, > Amazon ..) can be protected from eviction. Thereby, on the one hand, set up > flows won't have their entries evicted and on the other, this set of > entries will ensure that a very large part of the new outgoing flows will > cache hit. > > 2) Just add more memory! Besides the TCAM in the xTR we could use a large > second level memory able to cache the whole EID address space. > Alternatively, you could imagine having an xTR per site, capable of holding > the whole EID address space, that could act as default for packets that > miss in all the other sub-provisioned xTRs. > > [1] http://arxiv.org/pdf/1312.1378v2.pdf > > Florin > > > On 05/28/2014 12:45 AM, Ronald Bonica wrote: >> Hi Paul, >> >> The attack scenario that I envision is slightly different from the on that >> you describe below: >> >> - LISP is widely deployed. Tens of thousands of XTRs are deployed >> world-wide. The mapping system data base contains hundreds of thousands of >> EID prefixes. >> - The attack stream is large >> - Each packet in the attack stream has a unique source LOC >> - All packets in the attack stream have the same destination LOC. This LOC >> represents the XTR under attack. >> - Each packet in the attack stream has a destination EID that will cause >> it to reach a valid destination (i.e., a destination that will respond). >> However, all packets in the attack stream don't have the same destination. >> The attack stream is spread out across multiple valid EID destinations to >> make it less detectable. >> - Each packet in the attack stream has a carefully chosen source EID. It >> is chosen to maximize the ratio of attack packets to map-requests. >> >> One attack stream attacks an XTR. Multiple simultaneous attacks against >> multiple XTRs can DoS the mapping system, itself. >> >> A PxTR probably won't generate this attack stream. However, an attack tool >> might. >> >> Hope this helps. >> >> Ron >> >>> -----Original Message----- >>> From: Paul Vinciguerra [mailto:pvinci@VinciConsulting.com] >>> Sent: Monday, May 26, 2014 3:28 PM >>> To: Ronald Bonica; Joel M. Halpern; Damien Saucez >>> Cc: Roger Jorgensen; LISP mailing list list >>> Subject: RE: [lisp] Restarting last call on LISP threats >>> >>> Every host on the Internet is subject to a DoS attack. An xTR is no more >>> so. I >>> am also not clear on how a DoS attack on an xTR would create any more risk >>> than an attack directly against the mapping system. >>> >>> Joel describes Ronald's scenario of an attack where a large stream of >>> packets >>> with different inner source addresses to an ETR. I don't call this an >>> attack. I >>> call this our steady-state. These would be the PxTR's we operate across >>> the >>> US. The PxTR's on the beta-network are no different. We take in packets >>> from anywhere. This is a "Free" attacker if you will. All that really >>> means is >>> that you do not have to incur the computational cost of encapsulating the >>> packet. >>> >>> I would defer to Dino and others on the list, but I do not believe that >>> the ETR >>> does a reverse lookup on every packet. At least that is not the behavior >>> we >>> observe. What we see happen is that the packet is decapsulated and sent >>> to >>> the destination. If a valid destination host responds, then the ITR does >>> a >>> map-request for the reply packet. There is not a 1:1 relationship between >>> the number of packets and the number of map-requests. >>> >>> Map-replies for IP addresses return prefixes. These prefixes can cover >>> larger >>> address spaces than the map-request and limit the number of future map- >>> requests needed. >>> >>> Can you provide more specific details on how you see the xTR rendering the >>> mapping system unusable? >>> >>> For what its worth, I still support the decision for last call and not to >>> place >>> mitigations within the document. Without knowing the specifics of a >>> configuration and implementation, that just leads to a false sense of >>> security. >>> >>> >>> ________________________________________ >>> From: lisp [lisp-bounces@ietf.org] on behalf of Ronald Bonica >>> [rbonica@juniper.net] >>> Sent: Monday, May 26, 2014 11:57 AM >>> To: Joel M. Halpern; Damien Saucez >>> Cc: Roger Jorgensen; LISP mailing list list >>> Subject: Re: [lisp] Restarting last call on LISP threats >>> >>> Inline..... >>> >>>> -----Original Message----- >>>> From: Joel M. Halpern [mailto:jmh@joelhalpern.com] >>>> Sent: Monday, May 26, 2014 11:47 AM >>>> To: Ronald Bonica; Damien Saucez >>>> Cc: Roger Jorgensen; LISP mailing list list >>>> Subject: Re: [lisp] Restarting last call on LISP threats >>>> >>>> Top posting to make sure I am understanding: >>>> >>>> You asssert that any xTR is subject to a DoS attack. And that such a >>>> DoS attack can render the mapping system unusable. >>> [RPB] >>> Exactly! >>> >>>> It targeting an ITR, this would need to be from within ths cope the ITR >>> serves. >>> [RPB] >>> I don't understand this sentence. Please try again. >>> >>>> I believe that is discussed. >>> [RPB] >>> Given that I don't understand the sentence above, I have no idea if this >>> sentence is true. >>> >>>> If I have connected the dots correctly, the attack you are >>>> contemplating is sending a large stream of packets with different >>>> inner source addresses to an ETR. This would prompt the ETR to check >>>> with the mapping system about each and every address. >>> [RPB] >>> Exactly! >>> >>>> If I have understood this properly, while there are several very >>>> effective mitigations, that does not change the basic message that >>>> this is an attack, and as such ought to be described in the threats >>> document. >>> [RPB] >>> Even if there are effective mitigations, the attack should be described. >>> >>> However, I am not convinced that an effective mitigation exists. >>> >>>> There are clealry a number of variations on this attack. >>> [RPB] >>> True! >>> >>> For example, using >>>> the same outer source address makes mitigation easier, while using >>>> different outer source addresses either requires a bot-net or a large >>>> unchecked BCP38 hole (and those can be used for MANY attacks on many >>>> systems.) Both presumably should be described. >>> [RPB] >>> Yes, both should be described. >>> >>> Also, recall that large BCP38 holes exist in today's internet. >>> >>>> Have I captured your request accurately? >>> [RPB] >>> Pretty much. >>> >>> Thanks for taking the effort. >>> >>> Ron >>> >>>> Yours, >>>> Joel >>>> >>>> On 5/26/14, 1:06 AM, Ronald Bonica wrote: >>>>> *From:*Damien Saucez [mailto:damien.saucez@gmail.com] >>>>> *Sent:* Friday, May 23, 2014 9:07 AM >>>>> *To:* Ronald Bonica >>>>> *Cc:* Dino Farinacci; Roger Jorgensen; LISP mailing list list >>>>> *Subject:* Re: [lisp] Restarting last call on LISP threats >>>>> >>>>> Hello Ronald, >>>>> >>>>> On 22 May 2014, at 22:57, Ronald Bonica >>>> > wrote: >>>>> >>>>> >>>>> >>>>> Dino, >>>>> >>>>> Today's Internet is not as fragile as you think. This mail >>>>> traversed >>>>> many routers between my house and yours. If those routers are >>>>> well-managed, there is nothing that I can do from my house that >>>>> will >>>>> cause any of those routers to consume control plane resources. >>>>> Therefore, there is nothing that I can do from my house that will >>>>> cause a DoS attack against those routers' control planes. >>>>> >>>>> We tend to disagree with that, for example you have ICMP today... >>>>> >>>>> */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn't make >>>>> a very good routing protocol. That's why we don't use it for >>>>> routing. By contrast, LISP map-request messages are susceptible to >>>>> DoS attacks and they do carry routing information./* >>>>> >>>>> >>>>> >>>>> In LISP, separation between the forwarding and control plane is >>>>> lost. As a matter of course, forwarding plane activity causes >>>>> control plane activity. Since forwarding plane bandwidth exceeds >>>>> control plane bandwidth, DoS attacks against the control plane are >>>>> possible. >>>>> >>>>> In order to be complete, the threats document must describe the DoS >>>>> threat. It should also describe mitigations, if any exist. >>>>> >>>>> DoS is already explained and the definition given: >>>>> >>>>> " A Denial of Service (DoS) attack aims at disrupting a specific >>>>> >>>>> targeted service either by exhausting the resources of the >>>>> victim up >>>>> >>>>> to the point that it is not able to provide a reliable service >>>>> to >>>>> >>>>> legit traffic and/or systems or by exploiting vulnerabilities to >>>>> make >>>>> >>>>> the targeted service unable to operate properly. >>>>> >>>>> " >>>>> >>>>> is covering the case you mention. >>>>> >>>>> */[RPB] /* >>>>> >>>>> */You might want to add the following details to section 5.2:/* >>>>> >>>>> *//* >>>>> >>>>> -A DoS attack can be launched by anybody who can send a packet to >>>>> the XTR's LOC >>>>> >>>>> -DoS attacks can render an XTR inoperable >>>>> >>>>> -DDoS attacks can render the mapping system inoperable. >>>>> >>>>> This is what differentiates LISP from today's routing system. >>>>> >>>>> Ron >>>>> >>>>> Damien Saucez >>>>> >>>>> >>>>> >>>>> >>>>> Ron >>>>> >>>>> >>>>> >>>>> -----Original Message----- >>>>> From: Dino Farinacci [mailto:farinacci@gmail.com] >>>>> Sent: Wednesday, May 21, 2014 6:58 PM >>>>> To: Ronald Bonica >>>>> Cc: Roger Jorgensen; lisp@ietf.org >>>>> Subject: Re: [lisp] Restarting last call on LISP threats >>>>> >>>>> >>>>> The attacker sends a flow of crafted packets to the victim >>>>> XTR. Each packet >>>>> >>>>> is a well-formed LISP data packet. It contains: >>>>> >>>>> >>>>> - an outer IP header (LOC->LOC) >>>>> - a UDP header >>>>> - a LISP Header >>>>> - an IP header (EID->EID) >>>>> - payload >>>>> >>>>> >>>>> Just like a regular packet I can send to your home router >>>>> today. >>>>> So yes okay. >>>>> So let's continue. See comments below. >>>>> >>>>> >>>>> Each packet contains control plane information that is new >>>>> to the victim >>>>> >>>>> >>>>> Be more specific about what control information are in these >>>>> encapsulated >>>>> packets. >>>>> >>>>> >>>>> XTR. For example, the victim XTR has no mapping information >>>>> regarding >>>>> >>>>> either the source LOC or source EID prefix. Rather than >>>>> gleaning >>>>> this mapping >>>>> information from the crafted packet, the victim XTR sends a >>>>> verifying MAP- >>>>> REQUEST to the mapping system. >>>>> >>>>> >>>>> Assume that the attack flow is large (N packets per >>>>> second). >>>>> Assume also >>>>> >>>>> that the XTRs rate limit for MAP-REQUEST messages is less than >>>>> N >>>>> packets >>>>> per second. Has the attack not effectively DoS'd the victim >>>>> XTR? >>>>> >>>>> It caches the rate the rate the packets are coming in and >>>>> eventually stops >>>>> sending Map-Requests completely. >>>>> >>>>> It cannot stop the incoming rate of packets today just like a >>>>> roque BGP >>>>> attacker can send millions of packets per second to a peer >>>>> regardless if it >>>>> does or does not have the peer authentication key. >>>>> >>>>> >>>>> To make this attack work, every packet in the attack flow >>>>> may need to have >>>>> >>>>> a unique, spoofed, source LOC. >>>>> >>>>> An implementation can detect that after rate limiting 1000s of >>>>> such requests >>>>> are happening that it just stops operation. >>>>> >>>>> What if I sent a Juniper 20 million routes today? >>>>> >>>>> The Internet is very fragile and LISP IS NOT making it worse. >>>>> And in some >>>>> cases it is making it better with integrated techniques. >>>>> >>>>> Dino >>>>> >>>>> >>>>> _______________________________________________ >>>>> lisp mailing list >>>>> lisp@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/lisp >>>>> >>>>> >>>>> >>>>> _______________________________________________ >>>>> lisp mailing list >>>>> lisp@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/lisp >>>>> >>> _______________________________________________ >>> lisp mailing list >>> lisp@ietf.org >>> https://www.ietf.org/mailman/listinfo/lisp >> _______________________________________________ >> lisp mailing list >> lisp@ietf.org >> https://www.ietf.org/mailman/listinfo/lisp > > _______________________________________________ > lisp mailing list > lisp@ietf.org > https://www.ietf.org/mailman/listinfo/lisp > From nobody Wed May 28 01:50:44 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 66C451A03D3 for ; Wed, 28 May 2014 01:50:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.553 X-Spam-Level: X-Spam-Status: No, score=-2.553 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.651, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ExNhRBNVxVkE for ; Wed, 28 May 2014 01:50:39 -0700 (PDT) Received: from roura.ac.upc.es (roura.ac.upc.edu [147.83.33.10]) by ietfa.amsl.com (Postfix) with ESMTP id 901C81A03D1 for ; Wed, 28 May 2014 01:50:38 -0700 (PDT) Received: from gw-3.ac.upc.es (gw-3.ac.upc.es [147.83.30.9]) by roura.ac.upc.es (8.13.8/8.13.8) with ESMTP id s4S8oY9d031161; Wed, 28 May 2014 10:50:34 +0200 Received: from [10.8.0.18] (gw-2-vpn-i.ac.upc.es [147.83.35.76]) by gw-3.ac.upc.es (Postfix) with ESMTPSA id 02FFD3CE; Wed, 28 May 2014 10:50:32 +0200 (CEST) Message-ID: <5385A353.1050300@ac.upc.edu> Date: Wed, 28 May 2014 10:50:27 +0200 From: Florin Coras User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.5.0 MIME-Version: 1.0 To: Marc Binderberger , Ronald Bonica References: <536CFA13.4010102@joelhalpern.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <538361DA.10808@joelhalpern.com> <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> <936e209eb2fb49288f3a776aaa4b71cb@CO1PR05MB442.namprd05.prod.outlook.com> <5385792B.1010103@ac.upc.edu> <20140528003756040812.38ca9d6c@sniff.de> In-Reply-To: <20140528003756040812.38ca9d6c@sniff.de> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/AUKqol4mimstIWW5lrExwwR2HOs Cc: lisp@ietf.org Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 May 2014 08:50:42 -0000 Hi Marc, Thanks for the reply and apologies for not being clear enough. More inline. On 05/28/2014 09:37 AM, Marc Binderberger wrote: > Hello Florin et al., > > interesting discussion and I think some aspects should continue to be > discussed. But I start wondering: where is this thread heading? It doesn't > seem to move forward with respect to the "last call" topic :-) > > Florin, your reply seems to indicate that Ronald's scenario is a valid attack > as you describe mitigation strategies. But is Ronald's scenario really _new_ > with respect to the draft? It seems to be covered by section 4.2/4.3.1.1 (?). It is. We've previously had discussions concerning cache poisoning on the mailing list and I wrongly assumed the subject as known-and-documented in the draft. In fact, Damien mentioned this several times in his replies. My previous email was only meant to bring this up to Ron's attention and answer his specific concerns. So, to clear up the confusion: Section 4.2 already mentions cache poisoning attacks and offers a pointer to an analysis and possible mitigation strategies. > If the opinion is that Ron's scenario is not covered by the draft yet then do > we need additional text in the draft? Any proposal, Ron? IMO, we do not need additional text. Regards, Florin > Myself I'm expecting from the draft that it provides an overview of the > potential problems and some attack vectors to stimulate ideas. I do not > assume that the level of details in the draft and the "relevance" of the > attack correspond - what is relevant or not may depend on whom you ask. > > > Thanks & Regards, > Marc > > > > On Wed, 28 May 2014 07:50:35 +0200, Florin Coras wrote: >> Hi Ron, >> >> It turns out that just doing a flat scan of the EID-prefix space, i.e., >> using as source EID an IP in each existing EID-prefix, has the most >> damaging consequences (see fig. 5 in [1]). This, if you contrast it with >> the case when you try to craft packets whose replies (coming from >> intra-domain sources) will always generate misses in the xTR under attack. >> >> If the attack intensity (attack packet rate to legitimate traffic rate >> ratio) is high, say above 0.01, you are right to assume that such an attack >> could cripple an xTR and generate lots of misses. However, as we mention in >> the paper, some simple solutions could be set in place to avoid this. For >> instance: >> >> 1) When the attack is detected (due to the higher than normal miss rate), >> the most important entries in the cache, the most popular (say, Google, Fb, >> Amazon ..) can be protected from eviction. Thereby, on the one hand, set up >> flows won't have their entries evicted and on the other, this set of >> entries will ensure that a very large part of the new outgoing flows will >> cache hit. >> >> 2) Just add more memory! Besides the TCAM in the xTR we could use a large >> second level memory able to cache the whole EID address space. >> Alternatively, you could imagine having an xTR per site, capable of holding >> the whole EID address space, that could act as default for packets that >> miss in all the other sub-provisioned xTRs. >> >> [1] http://arxiv.org/pdf/1312.1378v2.pdf >> >> Florin >> >> >> On 05/28/2014 12:45 AM, Ronald Bonica wrote: >>> Hi Paul, >>> >>> The attack scenario that I envision is slightly different from the on that >>> you describe below: >>> >>> - LISP is widely deployed. Tens of thousands of XTRs are deployed >>> world-wide. The mapping system data base contains hundreds of thousands of >>> EID prefixes. >>> - The attack stream is large >>> - Each packet in the attack stream has a unique source LOC >>> - All packets in the attack stream have the same destination LOC. This LOC >>> represents the XTR under attack. >>> - Each packet in the attack stream has a destination EID that will cause >>> it to reach a valid destination (i.e., a destination that will respond). >>> However, all packets in the attack stream don't have the same destination. >>> The attack stream is spread out across multiple valid EID destinations to >>> make it less detectable. >>> - Each packet in the attack stream has a carefully chosen source EID. It >>> is chosen to maximize the ratio of attack packets to map-requests. >>> >>> One attack stream attacks an XTR. Multiple simultaneous attacks against >>> multiple XTRs can DoS the mapping system, itself. >>> >>> A PxTR probably won't generate this attack stream. However, an attack tool >>> might. >>> >>> Hope this helps. >>> >>> Ron >>> >>>> -----Original Message----- >>>> From: Paul Vinciguerra [mailto:pvinci@VinciConsulting.com] >>>> Sent: Monday, May 26, 2014 3:28 PM >>>> To: Ronald Bonica; Joel M. Halpern; Damien Saucez >>>> Cc: Roger Jorgensen; LISP mailing list list >>>> Subject: RE: [lisp] Restarting last call on LISP threats >>>> >>>> Every host on the Internet is subject to a DoS attack. An xTR is no more >>>> so. I >>>> am also not clear on how a DoS attack on an xTR would create any more risk >>>> than an attack directly against the mapping system. >>>> >>>> Joel describes Ronald's scenario of an attack where a large stream of >>>> packets >>>> with different inner source addresses to an ETR. I don't call this an >>>> attack. I >>>> call this our steady-state. These would be the PxTR's we operate across >>>> the >>>> US. The PxTR's on the beta-network are no different. We take in packets >>>> from anywhere. This is a "Free" attacker if you will. All that really >>>> means is >>>> that you do not have to incur the computational cost of encapsulating the >>>> packet. >>>> >>>> I would defer to Dino and others on the list, but I do not believe that >>>> the ETR >>>> does a reverse lookup on every packet. At least that is not the behavior >>>> we >>>> observe. What we see happen is that the packet is decapsulated and sent >>>> to >>>> the destination. If a valid destination host responds, then the ITR does >>>> a >>>> map-request for the reply packet. There is not a 1:1 relationship between >>>> the number of packets and the number of map-requests. >>>> >>>> Map-replies for IP addresses return prefixes. These prefixes can cover >>>> larger >>>> address spaces than the map-request and limit the number of future map- >>>> requests needed. >>>> >>>> Can you provide more specific details on how you see the xTR rendering the >>>> mapping system unusable? >>>> >>>> For what its worth, I still support the decision for last call and not to >>>> place >>>> mitigations within the document. Without knowing the specifics of a >>>> configuration and implementation, that just leads to a false sense of >>>> security. >>>> >>>> >>>> ________________________________________ >>>> From: lisp [lisp-bounces@ietf.org] on behalf of Ronald Bonica >>>> [rbonica@juniper.net] >>>> Sent: Monday, May 26, 2014 11:57 AM >>>> To: Joel M. Halpern; Damien Saucez >>>> Cc: Roger Jorgensen; LISP mailing list list >>>> Subject: Re: [lisp] Restarting last call on LISP threats >>>> >>>> Inline..... >>>> >>>>> -----Original Message----- >>>>> From: Joel M. Halpern [mailto:jmh@joelhalpern.com] >>>>> Sent: Monday, May 26, 2014 11:47 AM >>>>> To: Ronald Bonica; Damien Saucez >>>>> Cc: Roger Jorgensen; LISP mailing list list >>>>> Subject: Re: [lisp] Restarting last call on LISP threats >>>>> >>>>> Top posting to make sure I am understanding: >>>>> >>>>> You asssert that any xTR is subject to a DoS attack. And that such a >>>>> DoS attack can render the mapping system unusable. >>>> [RPB] >>>> Exactly! >>>> >>>>> It targeting an ITR, this would need to be from within ths cope the ITR >>>> serves. >>>> [RPB] >>>> I don't understand this sentence. Please try again. >>>> >>>>> I believe that is discussed. >>>> [RPB] >>>> Given that I don't understand the sentence above, I have no idea if this >>>> sentence is true. >>>> >>>>> If I have connected the dots correctly, the attack you are >>>>> contemplating is sending a large stream of packets with different >>>>> inner source addresses to an ETR. This would prompt the ETR to check >>>>> with the mapping system about each and every address. >>>> [RPB] >>>> Exactly! >>>> >>>>> If I have understood this properly, while there are several very >>>>> effective mitigations, that does not change the basic message that >>>>> this is an attack, and as such ought to be described in the threats >>>> document. >>>> [RPB] >>>> Even if there are effective mitigations, the attack should be described. >>>> >>>> However, I am not convinced that an effective mitigation exists. >>>> >>>>> There are clealry a number of variations on this attack. >>>> [RPB] >>>> True! >>>> >>>> For example, using >>>>> the same outer source address makes mitigation easier, while using >>>>> different outer source addresses either requires a bot-net or a large >>>>> unchecked BCP38 hole (and those can be used for MANY attacks on many >>>>> systems.) Both presumably should be described. >>>> [RPB] >>>> Yes, both should be described. >>>> >>>> Also, recall that large BCP38 holes exist in today's internet. >>>> >>>>> Have I captured your request accurately? >>>> [RPB] >>>> Pretty much. >>>> >>>> Thanks for taking the effort. >>>> >>>> Ron >>>> >>>>> Yours, >>>>> Joel >>>>> >>>>> On 5/26/14, 1:06 AM, Ronald Bonica wrote: >>>>>> *From:*Damien Saucez [mailto:damien.saucez@gmail.com] >>>>>> *Sent:* Friday, May 23, 2014 9:07 AM >>>>>> *To:* Ronald Bonica >>>>>> *Cc:* Dino Farinacci; Roger Jorgensen; LISP mailing list list >>>>>> *Subject:* Re: [lisp] Restarting last call on LISP threats >>>>>> >>>>>> Hello Ronald, >>>>>> >>>>>> On 22 May 2014, at 22:57, Ronald Bonica >>>>> > wrote: >>>>>> >>>>>> >>>>>> >>>>>> Dino, >>>>>> >>>>>> Today's Internet is not as fragile as you think. This mail >>>>>> traversed >>>>>> many routers between my house and yours. If those routers are >>>>>> well-managed, there is nothing that I can do from my house that >>>>>> will >>>>>> cause any of those routers to consume control plane resources. >>>>>> Therefore, there is nothing that I can do from my house that will >>>>>> cause a DoS attack against those routers' control planes. >>>>>> >>>>>> We tend to disagree with that, for example you have ICMP today... >>>>>> >>>>>> */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn't make >>>>>> a very good routing protocol. That's why we don't use it for >>>>>> routing. By contrast, LISP map-request messages are susceptible to >>>>>> DoS attacks and they do carry routing information./* >>>>>> >>>>>> >>>>>> >>>>>> In LISP, separation between the forwarding and control plane is >>>>>> lost. As a matter of course, forwarding plane activity causes >>>>>> control plane activity. Since forwarding plane bandwidth exceeds >>>>>> control plane bandwidth, DoS attacks against the control plane are >>>>>> possible. >>>>>> >>>>>> In order to be complete, the threats document must describe the DoS >>>>>> threat. It should also describe mitigations, if any exist. >>>>>> >>>>>> DoS is already explained and the definition given: >>>>>> >>>>>> " A Denial of Service (DoS) attack aims at disrupting a specific >>>>>> >>>>>> targeted service either by exhausting the resources of the >>>>>> victim up >>>>>> >>>>>> to the point that it is not able to provide a reliable service >>>>>> to >>>>>> >>>>>> legit traffic and/or systems or by exploiting vulnerabilities to >>>>>> make >>>>>> >>>>>> the targeted service unable to operate properly. >>>>>> >>>>>> " >>>>>> >>>>>> is covering the case you mention. >>>>>> >>>>>> */[RPB] /* >>>>>> >>>>>> */You might want to add the following details to section 5.2:/* >>>>>> >>>>>> *//* >>>>>> >>>>>> -A DoS attack can be launched by anybody who can send a packet to >>>>>> the XTR's LOC >>>>>> >>>>>> -DoS attacks can render an XTR inoperable >>>>>> >>>>>> -DDoS attacks can render the mapping system inoperable. >>>>>> >>>>>> This is what differentiates LISP from today's routing system. >>>>>> >>>>>> Ron >>>>>> >>>>>> Damien Saucez >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> Ron >>>>>> >>>>>> >>>>>> >>>>>> -----Original Message----- >>>>>> From: Dino Farinacci [mailto:farinacci@gmail.com] >>>>>> Sent: Wednesday, May 21, 2014 6:58 PM >>>>>> To: Ronald Bonica >>>>>> Cc: Roger Jorgensen; lisp@ietf.org >>>>>> Subject: Re: [lisp] Restarting last call on LISP threats >>>>>> >>>>>> >>>>>> The attacker sends a flow of crafted packets to the victim >>>>>> XTR. Each packet >>>>>> >>>>>> is a well-formed LISP data packet. It contains: >>>>>> >>>>>> >>>>>> - an outer IP header (LOC->LOC) >>>>>> - a UDP header >>>>>> - a LISP Header >>>>>> - an IP header (EID->EID) >>>>>> - payload >>>>>> >>>>>> >>>>>> Just like a regular packet I can send to your home router >>>>>> today. >>>>>> So yes okay. >>>>>> So let's continue. See comments below. >>>>>> >>>>>> >>>>>> Each packet contains control plane information that is new >>>>>> to the victim >>>>>> >>>>>> >>>>>> Be more specific about what control information are in these >>>>>> encapsulated >>>>>> packets. >>>>>> >>>>>> >>>>>> XTR. For example, the victim XTR has no mapping information >>>>>> regarding >>>>>> >>>>>> either the source LOC or source EID prefix. Rather than >>>>>> gleaning >>>>>> this mapping >>>>>> information from the crafted packet, the victim XTR sends a >>>>>> verifying MAP- >>>>>> REQUEST to the mapping system. >>>>>> >>>>>> >>>>>> Assume that the attack flow is large (N packets per >>>>>> second). >>>>>> Assume also >>>>>> >>>>>> that the XTRs rate limit for MAP-REQUEST messages is less than >>>>>> N >>>>>> packets >>>>>> per second. Has the attack not effectively DoS'd the victim >>>>>> XTR? >>>>>> >>>>>> It caches the rate the rate the packets are coming in and >>>>>> eventually stops >>>>>> sending Map-Requests completely. >>>>>> >>>>>> It cannot stop the incoming rate of packets today just like a >>>>>> roque BGP >>>>>> attacker can send millions of packets per second to a peer >>>>>> regardless if it >>>>>> does or does not have the peer authentication key. >>>>>> >>>>>> >>>>>> To make this attack work, every packet in the attack flow >>>>>> may need to have >>>>>> >>>>>> a unique, spoofed, source LOC. >>>>>> >>>>>> An implementation can detect that after rate limiting 1000s of >>>>>> such requests >>>>>> are happening that it just stops operation. >>>>>> >>>>>> What if I sent a Juniper 20 million routes today? >>>>>> >>>>>> The Internet is very fragile and LISP IS NOT making it worse. >>>>>> And in some >>>>>> cases it is making it better with integrated techniques. >>>>>> >>>>>> Dino >>>>>> >>>>>> >>>>>> _______________________________________________ >>>>>> lisp mailing list >>>>>> lisp@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/lisp >>>>>> >>>>>> >>>>>> >>>>>> _______________________________________________ >>>>>> lisp mailing list >>>>>> lisp@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/lisp >>>>>> >>>> _______________________________________________ >>>> lisp mailing list >>>> lisp@ietf.org >>>> https://www.ietf.org/mailman/listinfo/lisp >>> _______________________________________________ >>> lisp mailing list >>> lisp@ietf.org >>> https://www.ietf.org/mailman/listinfo/lisp >> _______________________________________________ >> lisp mailing list >> lisp@ietf.org >> https://www.ietf.org/mailman/listinfo/lisp >> From nobody Wed May 28 10:53:07 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EAEAF1A01C1 for ; Wed, 28 May 2014 10:53:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XsQbCHL_2bXV for ; Wed, 28 May 2014 10:53:02 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0142.outbound.protection.outlook.com [207.46.163.142]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0D1F51A01B6 for ; Wed, 28 May 2014 10:53:01 -0700 (PDT) Received: from CO2PR05MB636.namprd05.prod.outlook.com (10.141.199.24) by CO2PR05MB634.namprd05.prod.outlook.com (10.141.199.17) with Microsoft SMTP Server (TLS) id 15.0.944.11; Wed, 28 May 2014 17:52:56 +0000 Received: from CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) by CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) with mapi id 15.00.0944.000; Wed, 28 May 2014 17:52:56 +0000 From: Ross Callon To: Damien Saucez Thread-Topic: [lisp] Restarting last call on LISP threats Thread-Index: AQHPa58M9eFhkxJvMEaw1MEc+Ryfdps9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAm1DAIABaYEAgAeql4CAAHoZgIABcK6AgAEO0wCABDDNAIAAsuYAgAADFoCAAYOMAIAAAhsAgAAPAICAAa+MAA== Date: Wed, 28 May 2014 17:52:55 +0000 Message-ID: References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <538361DA.10808@joelhalpern.com> <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <5384AB4E.2010208@joelhalpern.com> <8F830D21-5689-476C-97E9-7D92A1CBAA28@gmail.com> In-Reply-To: <8F830D21-5689-476C-97E9-7D92A1CBAA28@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [66.129.241.15] x-forefront-prvs: 0225B0D5BC x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(13464003)(164054003)(24454002)(52604005)(199002)(189002)(51704005)(377454003)(479174003)(99396002)(74662001)(64706001)(79102001)(19580405001)(20776003)(80022001)(561944003)(99286001)(74502001)(76482001)(33646001)(83072002)(81542001)(31966008)(15975445006)(19580395003)(77982001)(87936001)(2656002)(83322001)(46102001)(54356999)(50986999)(101416001)(77096999)(74316001)(21056001)(76176999)(66066001)(92566001)(4396001)(81342001)(76576001)(86362001)(85852003)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO2PR05MB634; H:CO2PR05MB636.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (: juniper.net does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rcallon@juniper.net; Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/LLJjRRt3RgBHx0YqYqBadi2GCV4 Cc: LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 May 2014 17:53:05 -0000 Thanks for agreeing to update the document. I would be happy to contribute = to discussions related to the update. Please include me on the appropriate = point to point exchanges.=20 Thanks, Ross -----Original Message----- From: lisp [mailto:lisp-bounces@ietf.org] On Behalf Of Damien Saucez Sent: Tuesday, May 27, 2014 12:06 PM To: LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats Dear all, Thank you all for the passion you put in discussing the threats document. We have read all the arguments and arrived to the conclusion that the threat document needs to be reshaped so to clear all misunderstandings. We will provide a new version for early July that does not exclude any scenarios. Actually most of problems pinpointed are already covered somehow in the document but precisions/rephrasing have to be done to make things clear. For the sake of efficiency, while writing the new proposal in the coming weeks, we will make point-to-point exchanges with the different people that contributed to the discussion so to be sure that we address all their comments. Thanks, Damien Saucez On 27 May 2014, at 17:12, Joel M. Halpern wrote: > Can we please not get into a debate about how well BCP38 is or is not dep= loyed, whether violations are remotely detectable, ...This is NOT the worki= ng group for that. >=20 > For our purposes, given that source address forging is known to occur, we= have to allow it in the threat analysis. >=20 > Yours, > Joel >=20 > On 5/27/14, 11:04 AM, Dino Farinacci wrote: >>=20 >>> Also, recall that large BCP38 holes exist in today's internet. >>=20 >> And I am going to repeat again, this is not a binary statement. That is,= if a BCP38 hole exists in one part of the network, source spoofing can sti= ll be detected in other parts of the network. >>=20 >> Dino >>=20 >>=20 _______________________________________________ lisp mailing list lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp From nobody Wed May 28 11:31:14 2014 Return-Path: X-Original-To: lisp@ietfa.amsl.com Delivered-To: lisp@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D93771A04A8 for ; Wed, 28 May 2014 11:31:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nwqyb-bNJ0NC for ; Wed, 28 May 2014 11:31:11 -0700 (PDT) Received: from mail-ob0-x231.google.com (mail-ob0-x231.google.com [IPv6:2607:f8b0:4003:c01::231]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6C8E71A0493 for ; Wed, 28 May 2014 11:31:11 -0700 (PDT) Received: by mail-ob0-f177.google.com with SMTP id wp4so10930814obc.36 for ; Wed, 28 May 2014 11:31:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=XwBuP4EC6GhulbDJjLGbjmho/evJJSG4BYD4dvC18fE=; b=mYX4iwBvvjSPAMFdcofJONLBmRlnKIcJrLzBEgFbwJjzsTG8fNZKZqy+ouvxfO5Wgr n7GEB4tt81XQeVT+UcHC9aUH7+swJMGvpSZM83Ql2SxQ95uduqFiclMsdifzTZTMjkNJ 8aHRU0zpTeQM815MPjRQyolJpITCO+9+KzSnTgUmSt4/RMGzgHnfOXVqbKzome0uKpoX 0O0A1gknTDf07x9g4ymCKFyS8aLzNqPYGKhTWKO8LgseDM4Kqxm9mVQLN/gXYbBTaflS aPSBAa5AEWbUIC7z5rzYn8EMQCkWerpU9PSKEJLYiIfRUYacDu8Ey3VogC3jPVobScMr dkfQ== X-Received: by 10.60.94.231 with SMTP id df7mr2049780oeb.26.1401301867588; Wed, 28 May 2014 11:31:07 -0700 (PDT) Received: from [10.0.0.196] ([12.7.174.218]) by mx.google.com with ESMTPSA id xg9sm22235525oeb.17.2014.05.28.11.31.05 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 28 May 2014 11:31:05 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\)) From: Dino Farinacci In-Reply-To: Date: Wed, 28 May 2014 11:31:03 -0700 Content-Transfer-Encoding: quoted-printable Message-Id: References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <538361DA.10808@joelhalpern.com> <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <5384AB4E.2010208@joelhalpern.com> <8F830D21-5689-476C-97E9-7D92A1CBAA28@gmail.com> To: Ross Callon X-Mailer: Apple Mail (2.1874) Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/zBDJ17TVGEiCWkqxwqzL85q-jV8 Cc: LISP mailing list list Subject: Re: [lisp] Restarting last call on LISP threats X-BeenThere: lisp@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List for the discussion of the Locator/ID Separation Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 May 2014 18:31:13 -0000 > Thanks for agreeing to update the document. I would be happy to = contribute to discussions related to the update. Please include me on = the appropriate point to point exchanges.=20 Thanks a lot Ross. And I'd be willing to help with the document that = identifies mitigation techniques to each of the threats in the threats = document. Dino >=20 > Thanks, Ross >=20 > -----Original Message----- > From: lisp [mailto:lisp-bounces@ietf.org] On Behalf Of Damien Saucez > Sent: Tuesday, May 27, 2014 12:06 PM > To: LISP mailing list list > Subject: Re: [lisp] Restarting last call on LISP threats >=20 > Dear all, >=20 > Thank you all for the passion you put in discussing the threats > document. We have read all the arguments and arrived to the > conclusion that the threat document needs to be reshaped so to clear > all misunderstandings. We will provide a new version for early July > that does not exclude any scenarios. Actually most of problems > pinpointed are already covered somehow in the document but > precisions/rephrasing have to be done to make things clear. >=20 > For the sake of efficiency, while writing the new proposal in the > coming weeks, we will make point-to-point exchanges with the different > people that contributed to the discussion so to be sure that we > address all their comments. >=20 > Thanks, >=20 > Damien Saucez >=20 > On 27 May 2014, at 17:12, Joel M. Halpern wrote: >=20 >> Can we please not get into a debate about how well BCP38 is or is not = deployed, whether violations are remotely detectable, ...This is NOT the = working group for that. >>=20 >> For our purposes, given that source address forging is known to = occur, we have to allow it in the threat analysis. >>=20 >> Yours, >> Joel >>=20 >> On 5/27/14, 11:04 AM, Dino Farinacci wrote: >>>=20 >>>> Also, recall that large BCP38 holes exist in today's internet. >>>=20 >>> And I am going to repeat again, this is not a binary statement. That = is, if a BCP38 hole exists in one part of the network, source spoofing = can still be detected in other parts of the network. >>>=20 >>> Dino >>>=20 >>>=20 >=20 > _______________________________________________ > lisp mailing list > lisp@ietf.org > https://www.ietf.org/mailman/listinfo/lisp >=20 > _______________________________________________ > lisp mailing list > lisp@ietf.org > https://www.ietf.org/mailman/listinfo/lisp