Subject: [savi] Your opinion on a different tradeoff for SAVI

From: Christian Vogt <[email-masked]>
Date: Sun, 14 Jun 2009 20:21:59 -0700

Folks -

In order to make a decision on whether or not to move forward with the
modified SAVI protocol that Marcelo has proposed [1], feedback from the
working group is important.  Several people have already provided their
feedback.  I would encourage also others to share their opinion.  Please
do so, on this mailing list, by Friday, June 19.

Thank you.

- Christian

[1] http://www.ietf.org/mail-archive/web/savi/current/msg00654.html

---

From: Fred Baker <[email-masked]>
Date: Sun, 14 Jun 2009 21:42:53 -0700

On Jun 14, 2009, at 8:21 PM, Christian Vogt wrote:

> working group is important.

A change of charter is also important.

---

From: "Guang Yao" <[email-masked]>
Date: Mon, 15 Jun 2009 16:07:09 +0800

Though [1] presents a novel idea, I'm not in favor of it because of its
lower filter capacity.

Attackers are free to send packets with addresses other than local bound
ones. I'm not sure that the benefit is enough to encourage administrators to
deploy, especially in a big network.

Local bindings always are part of all the bindings in the network, because
bindings are set up through DAD snooping, and DAD NS is a group cast
message, not broad cast. Thus, attackers can still spoof the address of
another host as long as it is not bound on the savi device along the packet
path.

However, I think it is a good step to find a final solution.

Regards,
Guang
-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Christian Vogt
Sent: Monday, June 15, 2009 11:22 AM
To: SAVI Mailing List
Subject: [savi] Your opinion on a different tradeoff for SAVI

Folks -

In order to make a decision on whether or not to move forward with the
modified SAVI protocol that Marcelo has proposed [1], feedback from the
working group is important.  Several people have already provided their
feedback.  I would encourage also others to share their opinion.  Please do
so, on this mailing list, by Friday, June 19.

Thank you.

- Christian

---

From: marcelo bagnulo braun <[email-masked]>
Date: Mon, 15 Jun 2009 16:49:34 +0200

> deploy, especially in a big network.
but in other solutions, the attacker can send a packet with any source 
address for which there is no binding by simply sending a DAD packet 
first, right?
So, what is the new vulnerability that is being introduced?

> another host as long as it is not bound on the savi device along the packet
right, but we can change that. I mean, we could simply require that SAVI 
devices snoop all MLD messages and that DAD packets are forwarded to all 
SAVI devices irrespectively whether there any host subscribed tot he 
particular solicited node mcast group on that particular SAVI device. 
That would essentially imply that all SAVI devices receive all DAD msgs. 
Would that solve the problem?

Regards, marcelo

> _______________________________________________
> savi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/savi
>
>

---

From: "Guang Yao" <[email-masked]>
Date: Tue, 16 Jun 2009 14:40:09 +0800

> From: marcelo bagnulo braun [mailto:[email-masked]]
> Sent: Monday, June 15, 2009 10:50 PM
> To: Guang Yao
> Cc: 'Christian Vogt'; 'SAVI Mailing List'
> Subject: Re: [savi] Your opinion on a different tradeoff for SAVI
> 
> Guang Yao escribió:
[Guang Yao] 
1 You have changed DAD, which violates the charter.
2 Problem is returned to that a savi device must have all the bindings in
the network. Then should we discuss the memory cost again?
> > feedback.  I would encourage also others to share their opinion.  Please
do

---

From: marcelo bagnulo braun <[email-masked]>
Date: Wed, 17 Jun 2009 09:52:39 +0200

Guang Yao escribió:
>>> ones. I'm not sure that the benefit is enough to encourage
>>>       
> administrators to
>   
>>> Local bindings always are part of all the bindings in the network,
>>>       
> because
>   
>>> another host as long as it is not bound on the savi device along the
>>>       
> packet
>   
>>> path.
>>>
>>>       
how comes this changes DAD? this would change how MDL snooping siwtches 
handle DAD but not the DAD protocol
How come this violates the charter? This would not requre any host change

> the network. Then should we discuss the memory cost again?
i guess we should. Current switches contain a table with the list of MAC 
addresses they have learnt using reverse learning. The table required by 
SAVI would be in the same order of magnitude. If the MAC address table 
is not a problem for switches, why would this SAVI table be a problem 
for switches?

Regards, marcelo

---

From: "Guang Yao" <[email-masked]>
Date: Wed, 17 Jun 2009 16:20:47 +0800

> Sent: Wednesday, June 17, 2009 3:53 PM
> To: Guang Yao
[Guang Yao] 
" DAD packets are forwarded to all
SAVI devices irrespectively whether there any host subscribed tot he
particular solicited node mcast group on that particular SAVI device."

I think this is a big change. Charter also prohibit protocol change.

> is not a problem for switches, why would this SAVI table be a problem
[Guang Yao]
Even with same order of magnitude, MAC addresses are far less than possible
IPv6 addresses for a interface is potentially to have multiple addresses.
And MAC address always has a more static number, but IP address has a large
range of number.
This problem is even serious in an IP flooding attack.

Another problem is current switch doesn't ensure it has all the MAC
addresses. Sometimes the table may be full and it has to drop some entry. It
can
handle the no-matching case by flooding.
As to savi, can you drop any binding entry if the table is full? I don't
think so.

---

From: marcelo bagnulo braun <[email-masked]>
Date: Wed, 17 Jun 2009 15:44:29 +0200

Guang Yao escribió:
>>>>> Though [1] presents a novel idea, I'm not in favor of it because of
>>>>>           
> its
>   
>>>>> lower filter capacity.
>>>>>
>>>>>
>>>>> Attackers are free to send packets with addresses other than local
>>>>>           
> bound
>   
>>>>> message, not broad cast. Thus, attackers can still spoof the address
>>>>>           
> of
>   
>>>> right, but we can change that. I mean, we could simply require that
>>>>         
> SAVI
>   
>>>> devices snoop all MLD messages and that DAD packets are forwarded to
>>>>         
> all
>   
>>>> That would essentially imply that all SAVI devices receive all DAD
>>>>         
> msgs.
>   

this is not a protocol change, it is a change in the way mld snooping 
switches handle MLD packets, but i guess we won't agree on this
>>> 2 Problem is returned to that a savi device must have all the bindings
>>>       
> in
>   

in the sense that the maximum number of MAC address is 2^48 while the 
max number of IPv6 addresses in a link is 2^64?

I am not sure this really matters since they are both really big numbers 
and no table is expected to have all these entries

> And MAC address always has a more static number, but IP address has a large

I am not sure what do you mean and why does this matter

> As to savi, can you drop any binding entry if the table is full? I don't
Well, it really depends on whether you are discarding if no entry is 
available or if you forward if no entry is available.
Of course, if you discard, you cannot drop a binding entry
If you forward, well, you are not blocking a legitimate user, so it is 
less harmfull if you drop and entry.
In particular, i think that if the savi device is under attack, it is 
clear that the table will be full. So what can be done in that case? If 
you forward by defualt, you can drop the newer entries, so the attakc 
only affect the new entries and still you don't disconnect a legitimate 
from the netwrok,, while you don't protect them at least you don't block 
them.

regards, marcelo

>>>>> From: [email-masked] [mailto:[email-masked]] On Behalf
>>>>>           
> Of
>   
>>>>> Christian Vogt
>>>>> modified SAVI protocol that Marcelo has proposed [1], feedback from
>>>>>           
> the
>   
>>>>> working group is important.  Several people have already provided
>>>>>           
> their
>   
>>>>> feedback.  I would encourage also others to share their opinion.
>>>>>           
> Please
>   
>>> do
>>>
>>>

---

From: "Guang Yao" <[email-masked]>
Date: Thu, 18 Jun 2009 12:45:35 +0800

> Sent: Wednesday, June 17, 2009 9:44 PM
> To: Guang Yao
[Guang Yao] 
If there are 100 hosts(single interface) in the network, the total number of
MAC address is around 100.
However, the total number of IPv6 address is 100*N. N is the average value
of the address number per interface.
Generally, N>=2, and has a huge upper bound. 
I have checked my host and it has 6 IPv6 addresses. I think the value of N
will be larger when IPv6 get used more widely.
I don't think it is reasonable to declare N will be less than 10 in the
future.
In case N is larger than 10 in a network, the situation will be very
different.

> less harmfull if you drop and entry.
[Guang Yao] 
Well, I agree to drop bindings in forwarding model will not block legitimate
user.
Actually, if there are no bindings, legitimate user will never be blocked.
Because any binding, which is set up on unreliable DAD, is potentially to
discard legitimate packet, it is better that there are no bindings.
Then, if SAVI is intent to let legitimate packets never be discarded,
current network is working well. So why we need SAVI?

I think there are two targets in SAVI:

False positive: To which ratio the legitimate packets are discarded.
False negative: To which ratio the illegal packets are discarded.

If a "NULL" method is designed, it has a perfect false positive. But it has
no sense.
On the other hand, if a "DROP ALL" method is designed, it has a perfect
false negative, still it has no sense.

Although we have a clear target that false positive must be 0, we don't have
a clear target on the false negative.

So, I think it is important to set a clear false negative target. 100%? Or
10%? Or not specified?

> from the netwrok,, while you don't protect them at least you don't block
[Guang Yao] 
I think, if a switch port is attached by a host, the upper bound of the
address number can be set to a reasonable  value to
avoid DoS. Then there will be no dropping problem. The problem is that when
the bindings are also set up for other kinds of port,
the switch is not clear how many hosts are there and can not set the upper
bound for that port. Thus I suggest not set up bindings
for other kinds of port, but just use local bindings to drop collision
packets from these ports.

---

From: Christian Vogt <[email-masked]>
Date: Tue, 23 Jun 2009 16:06:50 -0700

> A change of charter is also important.

Fred -

Why do you think the current charter is insufficient?  Are you referring
to the following charter statement?

   The purpose of the proposed "Source Address Validation Improvements"
   working group is to standardize mechanisms that prevent nodes  
attached
   to the same IP link from spoofing each other's IP addresses.

If so, note that Marcelo's proposed FCFS variant does comply with this
charter statement because it only changes the bahavior of a SAVI device
for unused IP addresses.  Above charter statement, in turn, is about IP
addresses being used by a link neighbor.  If you are referring to a
different charter statement, which one?

- Christian

---

From: Fred Baker <[email-masked]>
Date: Tue, 23 Jun 2009 16:39:22 -0700

I think you are talking about writing a protocol for address binding,  
and the charter says

> - The WG is prohibited from creating its own protocols or extensions/ 
> modifications of current protocols.

I don't consider the current charter insufficient. I consider that  
before the working group even met the working group started  
considering something that it was told in its charter to not do, spent  
at least one entire interim meeting on the subject, and included it in  
the agenda of its first formal meeting. If you want that badly to work  
on something you agreed in writing your charter to not do, I think you  
need to change your charter.

---

From: Christian Vogt <[email-masked]>
Date: Tue, 23 Jun 2009 16:41:13 -0700

Guang -

> administrators to deploy, especially in a big network.

It is true that Marcelo's proposed FCFS variant does not protect unused
addresses.  It only protects addresses being used by a link neighbor.
But don't you think this alone is attractive?

I personally claim that it is, in particular since, in IPv6, there is
not much point in protecting unused addresses:  It is trivial for an
attacker to turn an unused addresses into its own address.  All is
needed is a DAD solicitation.

- Christian

---

From: Christian Vogt <[email-masked]>
Date: Tue, 23 Jun 2009 16:44:13 -0700

On Jun 15, 2009, Guang and Marcelo wrote:

>> because bindings are set up through DAD snooping, and DAD NS is a  
>> group
>> cast message, not broad cast. Thus, attackers can still spoof the
>> address of another host as long as it is not bound on the savi device
>> along the packet path.
>

Do we really have to forward all DAD solicitations to solve the problem?
Is there a problem to begin with?  I don't see why lack of a binding in
a SAVI device would help an attacker hijacking an address.

After all, a SAVI binding can only be created with a DAD solicitation
that receives no response.  So even if a SAVI device did not see the DAD
solicitation of the legitimate address owner, it will see the DAD
response of the legitimate address owner in case an attacker is trying  
to
hijack that owner's address.

- Christian

---

From: Christian Vogt <[email-masked]>
Date: Tue, 23 Jun 2009 16:46:43 -0700

On Jun 23, 2009, Fred Baker wrote:

> I think you are talking about writing a protocol for address  
> binding...

No we are not.  On the contrary:  The proposed FCFS variant we are
talking about has the potential to avoid the need for any extra binding
distribution/verification protocol.

- Christian

---

From: Fred Baker <[email-masked]>
Date: Tue, 23 Jun 2009 16:48:46 -0700

I remain of the opinion that a switch is able to prevent its own  
clients from using addresses they have not been assigned, and that  
this is sufficient for a network of SAVI devices. The costs of a  
switch escalate if it has to have memory for devices that are not its  
clients, meaning that SAVI is unlikely to get market traction in this  
very cost-sensitive market if we force the switches to have large  
memories.

the primary argument for a binding protocol is that there might be  
some non-savi devices in the network. I think the simpler solution is  
to tell people that they don't get the benefits of SAVI in that  
environment.

On Jun 23, 2009, at 4:44 PM, Christian Vogt wrote:

> response of the legitimate address owner in case an attacker is  
> trying to

---

From: Fred Baker <[email-masked]>
Date: Tue, 23 Jun 2009 16:51:23 -0700

> But don't you think this alone is attractive?

no, not at all.

On a given /64 LAN, there are O(2^64) potential addresses that are not  
being used. The 5 or 8 or 24 or maybe 4096 that are being used are nil  
by comparison. The objective is not only to prevent hosts from  
spoofing each other, but to provide a BCP 38 solution that forces them  
to in fact use addresses they are supposed to be using.

SAVI without protecting unused addresses is pointless.

---

From: Christian Vogt <[email-masked]>
Date: Tue, 23 Jun 2009 17:28:18 -0700

On Jun 23, 2009, Fred Baker wrote:

> clients
> from using addresses they have not been assigned, and that this is
> sufficient for a network of SAVI devices. The costs of a switch  
> escalate
> if it has to have memory for devices that are not its clients, meaning
> that SAVI is unlikely to get market traction in this very cost- 
> sensitive
> market if we force the switches to have large memories.

Fred -

The FCFS variant we are considering exactly addresses your concern:
Since lack of a binding cannot lead to false packet drops, bindings do
not have to be explicitly copied across SAVI devices.  This reduces
memory requirements.  In particular, bindings for a given address are
only created in SAVI devices on the path of the corresponding DAD
solicitation or DHCP address assignment.  The number of bindings for a
given address can be reduced further by manually disabling SAVI
protection on large port trunks.

> some
> non-savi devices in the network. I think the simpler solution is to  
> tell
> people that they don't get the benefits of SAVI in that environment.

FWIW:  The main argument is actually the prevention of false packet
drops.  This affects SAVI solutions that drop packets in the absence of
a binding.  A dedicated binding protocol can then ensure that the
necessary bindings are in place, hence avoiding false packet drops.

Since Marcelo's proposed FCFS variant does NOT drop packets in the
absence of a binding, I don't see the need for a dedicated binding
protocol.  This is what I am explaining in my message below.

- Christian

On Jun 23, 2009, Christian Vogt wrote:

>> trying
>> to hijack that owner's address.
>>
>> - Christian