Subject: [trill] Stephen Farrell's Discuss on draft-ietf-trill-pseudonode-nickname-06: (with DISCUSS)

From: "Stephen Farrell" <[email-masked]>
Date: Thu, 17 Sep 2015 03:34:47 -0700

Stephen Farrell has entered the following ballot position for
draft-ietf-trill-pseudonode-nickname-06: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-trill-pseudonode-nickname/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

I have two questions where it's not clear to me if this
specification does or does not introduce new vulnerabilities.
It could well be that it does not and these are handled
elsewhere, but I'm not sure so...

(1) How is authorization for being a member of an RBv handled? 

(2) If a rogue RB can add itself to an RBv can it arrange
things so the rogue RB becomes the DF for the RBv?  (If so,
that would seem to create new DoS opportunities at least.)

---

From: Donald Eastlake <[email-masked]>
Date: Thu, 17 Sep 2015 09:49:27 -0400

Hi Stephen,

On Thu, Sep 17, 2015 at 6:34 AM, Stephen Farrell
<[email-masked]> wrote:
> ...

Currently I think that this is out of scope because the active-active
edge groups, each of which is represented by an RBv, are proprietary
MC-LAG implementations with proprietary management. (See bottom of
page 5 of RFC 7379. This draft is standardizing a TRILL campus facing
interface for an AAE group.)

> that would seem to create new DoS opportunities at least.)

I don't see any problem in mentioning this in the Security Considerations.

Thanks,
Donald
=============================
 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 155 Beaver Street, Milford, MA 01757 USA
 [email-masked]

---

From: Donald Eastlake <[email-masked]>
Date: Wed, 23 Sep 2015 23:46:54 -0400

Hi Stephen,

Would the following change resolve your DISCUSS?

OLD
   This draft does not introduce any extra security risks. For general
   TRILL Security Considerations, see [RFC6325].

NEW
   Since currently deployed LAALPs [RFC7379] are proprietary, security
   over membership in and internal management of active-active edge
   groups is proprietary. A rogue RBridge that insinuates itself into
   an active-active edge group can disrupt end station traffic flowing
   into or out of that group. For example, if there are N RBridges in
   the group, it could typically control 1/Nth of the traffic flowing
   out of that group and a similar amount of unicast traffic flowing
   into that group.  For multi-destination traffice flowing into that
   group, it could control all that was in a VLAN for which it was DF
   and it can exercise substantial control over the DF election by
   changing its own System ID.

   For general TRILL Security Considerations, see [RFC6325].

Thanks,
Donald

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 24 Sep 2015 11:58:14 +0100

Hi Don,

Yes, that'd do the job. If there were any sensible pointers
to the kind of proprietary things folks do (e.g. in some
workshop paper or product documentation) then that might be
useful, but I can imagine there might not be.

Thanks,
S.

---

From: Donald Eastlake <[email-masked]>
Date: Thu, 24 Sep 2015 16:26:00 -0400

Hi Stephen,

> useful, but I can imagine there might not be.

I'm not aware of such write-ups.

Thanks,
Donald

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 24 Sep 2015 21:27:16 +0100

> I'm not aware of such write-ups.

Fair enough, wasn't meant as a blocking comment anyway, so
I'm fine to clear with your suggested change.

S
g

---

From: Donald Eastlake <[email-masked]>
Date: Sat, 26 Sep 2015 18:31:29 -0400

Hi Stephen,

> I'm fine to clear with your suggested change.

draft-ietf-trill-pseudonode-nickname-07.txt has been uploaded with
this change in it. So, unless you have further comments, we'd
appreciate it if you cleared you DISCUSS.

Thanks,
Donald