Subject: [savi] feasibility of impmentation SAVI in a switch

From: Frank Xia <[email-masked]>
Date: Thu, 25 Jun 2009 10:38:29 -0500

Hi Guys

This question has been obsessing me for a while.

Aside from high end switches (such as layer 3 switches),
most switches use commercial chips which only inspect
layer 2 information(mac, vlan,etc).  At the same time,
SAVI requires switches to parse layer 3 information of
each packet.  

Apparantly, current switch chips can not handle this.  
That means switch vendors should in turn require
chip vendors to support this feature.

IMHO, the impact of chip design probably will impede
the adoption of SAVI in switch.

BR
Frank

---

From: "Greg Daley" <[email-masked]>
Date: Fri, 26 Jun 2009 09:30:10 +1000

Hi Frank,
 
We are talking about the sort of switches which can already snoop MLD.

Greg Daley
Security Consultant
NetStar Australia Pty Ltd

E-mail: [email-masked]
Mobile: +61 401 772 770
Direct: +61 3 8532 4042
Fax:    +61 3 8532 4032 

________________________________

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Frank Xia
Sent: Friday, 26 June 2009 1:38 AM
To: SAVI Mailing List
Subject: [savi] feasibility of impmentation SAVI in a switch

Hi Guys

 

BR
Frank

---

From: Frank Xia <[email-masked]>
Date: Thu, 25 Jun 2009 21:09:08 -0500

Hi Greg

Each switch has programable CPU could easily handle snooping
MLD/DAD/DHCP etc, and each switch also has non-programable
 ASIC to forward packets.

I am talking about SAVI packets forwarding processing which 
changes switches normal behavior which ususally inspects only
layer 2.

BR
Frank
  ----- Original Message ----- 
  From: Greg Daley 
  To: Frank Xia ; SAVI Mailing List 
  Sent: Thursday, June 25, 2009 6:30 PM
  Subject: Re: [savi] feasibility of impmentation SAVI in a switch

  Hi Frank,

  Greg Daley
  Security Consultant

------------------------------------------------------------------------------
  From: [email-masked] [mailto:[email-masked]] On Behalf Of Frank Xia
  Sent: Friday, 26 June 2009 1:38 AM
  To: SAVI Mailing List
  Subject: [savi] feasibility of impmentation SAVI in a switch

  Hi Guys

  BR
  Frank

------------------------------------------------------------------------------

  _______________________________________________
  savi mailing list
  [email-masked]
  https://www.ietf.org/mailman/listinfo/savi

---

From: "Greg Daley" <[email-masked]>
Date: Fri, 26 Jun 2009 12:24:15 +1000

Hi Frank, 
 
I think we can safely say that customizing the SAVI protocol to those
limited devices
which today cannot parse an IP datagram are certainly out-of-scope.
 
Even  existing equipment vendors have a graduated set of features for
their 
LAN switching equipment, from the most basic commodity based systems to 
the more sophisticated 
 
Additionally, as technology advances, the price point for the capability
to put IP
datagram recognition into consumer devices will be more attractive.
 
So I am not worried or interested in developing for the lowest common
denominator here.
I would only really be worried if we placed complex cryptographic
requirements on the
analysis mechanisms, as most LAN switches do not have this capability on
the data plane.

Greg Daley
Security Consultant

From: Frank Xia [mailto:[email-masked]] 
Sent: Friday, 26 June 2009 12:09 PM
To: Greg Daley; SAVI Mailing List
Subject: Re: [savi] feasibility of impmentation SAVI in a switch

Hi Greg

 
BR
Frank

	----- Original Message ----- 
	From: Greg Daley <mailto:[email-masked]>  
	To: Frank Xia <mailto:[email-masked]>  ; SAVI Mailing
List <mailto:[email-masked]>  
	Sent: Thursday, June 25, 2009 6:30 PM
	Subject: Re: [savi] feasibility of impmentation SAVI in a switch

	Hi Frank,
	 
	We are talking about the sort of switches which can already
snoop MLD.

	Greg Daley
	Security Consultant

	

	From: [email-masked] [mailto:[email-masked]] On
Behalf Of Frank Xia
	Sent: Friday, 26 June 2009 1:38 AM
	To: SAVI Mailing List
	Subject: [savi] feasibility of impmentation SAVI in a switch

	Hi Guys

	 

	BR
	Frank

---

From: Frank Xia <[email-masked]>
Date: Fri, 26 Jun 2009 10:37:03 -0500

Hi Greg

Sure,you are not worried because I assume you
are not going to sell switches with SAVI function  :-).

Switch is layer 2 device while SAVI needs do layer 3
work,   and this introduces architectural issues.

I am not the only one who has such concerns which
are also shared by my hardware colleagues.

Please also check my inline reply...

BR
Frank
  ----- Original Message ----- 
  From: Greg Daley 
  To: Frank Xia ; SAVI Mailing List 
  Sent: Thursday, June 25, 2009 9:24 PM
  Subject: Re: [savi] feasibility of impmentation SAVI in a switch

  Hi Frank, 

  I think we can safely say that customizing the SAVI protocol to those limited devices
  which today cannot parse an IP datagram are certainly out-of-scope.
  Frank=>IMHO, talking about potential engineering problem seems to be relevent
  to SAVI protocol design

  Even  existing equipment vendors have a graduated set of features for their 
  LAN switching equipment, from the most basic commodity based systems to 
  the more sophisticated 
  Frank=>So, we should assume some of switchs are naturally not able to 
  implement SAVI.  

  Additionally, as technology advances, the price point for the capability to put IP
  datagram recognition into consumer devices will be more attractive.
  Frank=>it is always a tradeoff between price and performance.

  So I am not worried or interested in developing for the lowest common denominator here.
  I would only really be worried if we placed complex cryptographic requirements on the
  analysis mechanisms, as most LAN switches do not have this capability on the data plane.

  Greg Daley
  Security Consultant

  Hi Greg

  BR
  Frank
    ----- Original Message ----- 
    From: Greg Daley 
    To: Frank Xia ; SAVI Mailing List 
    Sent: Thursday, June 25, 2009 6:30 PM
    Subject: Re: [savi] feasibility of impmentation SAVI in a switch

    Hi Frank,

    Greg Daley
    Security Consultant

----------------------------------------------------------------------------
    From: [email-masked] [mailto:[email-masked]] On Behalf Of Frank Xia
    Sent: Friday, 26 June 2009 1:38 AM
    To: SAVI Mailing List
    Subject: [savi] feasibility of impmentation SAVI in a switch

    Hi Guys

    BR
    Frank

----------------------------------------------------------------------------

---

From: "Greg Daley" <[email-masked]>
Date: Mon, 29 Jun 2009 08:43:27 +1000

Dear Frank,
 
"Sure you are not worried because I assume you
are not going to sell switches with SAVI function  :-)."
 
This is insulting and incorrect.
 
I am finishing this thread.

Greg

---

From: Christian Vogt <[email-masked]>
Date: Mon, 29 Jun 2009 16:29:39 -0700

Frank -

I don't think SAVI imposes significant new requirements on the
forwarding plane of layer-2 switches.

The only new requirement for the forwarding plane is to look at an extra
field, the Source Address field in the IP header, and verify this in a
binding table.  This doesn't seem to involve significantly more
sophistication than what layer-2 switches do already today.

The processing of DAD and DHCP packets, in turn, is something that can
be done on the control plane, just as MLD-aware switches do it today.

- Christian

---

From: "Joel M. Halpern" <[email-masked]>
Date: Mon, 29 Jun 2009 19:39:49 -0400

There are two sides to this.
On the one hand, the charter explicitly states that we are concerned 
with L3 aware switches.  Obviosuly, any L3 aware switch can look at IP 
addresses in packets.

On the other hand, in fairness to Frank, if we take as given taht we 
must support environments in which very low end edge switches are used, 
it is not reasonable to expect those devices to be able to perform 
content inspection.  They do not support policy.  They do not support 
high level ACLs.  They might be able to redirect some packets to a 
control infrastructure, but then again, they may not.  As far as I can 
tell, our charter says "too bad."  But we seem perfectly willing to 
overlook the charter in other regards, so we should not pretend that all 
edge switches are L3 aware.  (Many are.  Some aren't.)

Yours,
Joel

---

From: Christian Vogt <[email-masked]>
Date: Mon, 29 Jun 2009 19:50:49 -0700

Joel -

This is a very good summary.

The point I was making is that the requirements we impose on SAVI
devices are actually not that high and, therefore, meeting these
requirements should be feasible without significantly increasing the
cost of a switch.  Does this make sense?

- Christian

On Jun 29, 2009, Joel M. Halpern wrote:

> There are two sides to this. On the one hand, the charter explicitly
> states that we are concerned with L3 aware switches.  Obviosuly, any  
> L3
> aware switch can look at IP addresses in packets.
>
> Yours, Joel

---

From: "Joel M. Halpern" <[email-masked]>
Date: Mon, 29 Jun 2009 23:10:56 -0400

I tend to think that if we can get clarity on the problem, we can find a 
set of solutions with a moderate set of requirements on the devices and 
the system as a whole.  There may be some choices which even allow us to 
move some of the costs around.  (If the network uses 802.1x, then the 
routers may be able to be leveraged because the MACs are meaningful. 
Alternatively, if the leaf devices can do a little more, it may allow 
more flexible topologies ...)

My point was that we should not pretend that the cost will be zero, or 
that every device out there now will be inherently upgradable.  We will 
ahve to make some choices, which have implications.

Yours,
Joel M. Halpern

Christian Vogt wrote:
>> states that we are concerned with L3 aware switches.  Obviosuly, any L3

---

From: Frank Xia <[email-masked]>
Date: Mon, 29 Jun 2009 22:14:46 -0500

Hi Christian

Please see  my inline...

BR
Frank

----- Original Message ----- 
From: "Christian Vogt" <[email-masked]>
To: "Frank Xia" <[email-masked]>
Cc: "Greg Daley" <[email-masked]>; "SAVI Mailing List" 
<[email-masked]>
Sent: Monday, June 29, 2009 6:29 PM
Subject: Re: [savi] feasibility of impmentation SAVI in a switch

> sophistication than what layer-2 switches do already today.
Frank=>This processing needs extra hardware which seems to be
more difficult than software update.  Even though we can expect
more sophisticated switches,  I still think some switches are incapable
of  implementing SAVI.   We should consider this constraint.

> be done on the control plane, just as MLD-aware switches do it today.
Frank=> I am fine with control plane processing.

---

From: Christian Vogt <[email-masked]>
Date: Tue, 30 Jun 2009 10:28:06 -0700

> of  implementing SAVI.   We should consider this constraint.

This is true, of course.  And yet there is no way around it.  SAVI is  
about
protecting IP source addresses, so SAVI devices must at least be  
capable of
looking at packets' IP source addresses.

- Christian

---

From: Christian Vogt <[email-masked]>
Date: Tue, 30 Jun 2009 10:43:32 -0700

On Jun 29, 2009, Joel M. Halpern wrote:

> the system as a whole.

Absolutely.  That's why we now discuss whether to protect unused
addresses.

Our charter is very clear about the need to protect the addresses in use
on a link, but it doesn't make a statement about the protection of
unused addresses.  This was deliberately left to the working group,
since making a decision on this matter requires some up-front analysis
on the benefits and costs involved.

I therefore urge people now to focus on answering the key question [1]
of whether we want to protect unused addresses. I would also like people
to consider the middle-ground approach of protecting unused addresses
only in DHCP-only networks, which I proposed in [1].

- Christian

[1] http://www.ietf.org/mail-archive/web/savi/current/msg00715.html