Subject: [Idr] draft-ietf-idr-bgp-prefix-sid - security considerations

From: "Susan Hares" <[email-masked]>
Date: Tue, 8 May 2018 12:58:23 -0400

Acee , Stephan, Hannes, Clarence, and Arjun:

IMHO the security section may need augmenting to 

indicate the issue with IPv6 and the lack of an SR-Domain identifier. 

You state in -19.txt 

   The internal

   information includes the BGP Prefix-SID.  In order to prevent such

   leaking, the common BGP mechanisms (filters) are applied at the

   boundary of the SR/administrative domain.  Local BGP attribute

   filtering policies and mechanisms are not standardized and,

   consequently, beyond the scope of this document.

In order to have security and manageability you will need to have:

1)      Indication of SR domain and boundaries 

2)      Type of forwarding within domain (SRv6 or MPLS)

3)      BGP peer policy that indicates BGP Prefix SID can be attached

4)      Filter policy for BGP attributes 

All of these could be expressed in Yang models and securely passed with 

the multiple AS boundary within an SR/Administrative domain. 

[The administrative domain concept was  defined in RFC 1136].

The yang model described in draft-ietf-spring-sr-yang-08 is a place

this information could be placed within a SR/Administrative 

domain and passed security via NETCONF or RESTCONF.

Similarly, the BGP yang model (draft-ietf-idr-bgp-model) could 

be used to track the BGP filters.  An augmentation to the BGP yang model 

could support tracking the policy for the BGP Prefix SID attachments. 

By referring to the yang modules and the passage of the management

information securely over TLS, I think the standardized management can 

resolve some of the security concerns about passing the policy that controls

BGP Prefix SID (and other BGP drafts relating to SR). 

The fact we still need to ratify these Yang models in 

as RFCs rather than WG drafts is something the 

OPS/NM and Security ADs can help us push. 

Susan Hares

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Tue, 8 May 2018 18:21:35 +0000

Hi Sue,
The Security Considerations section in this document are only defined for the BGP Prefix-SID mechanism. While you make some valid points, what you are describing is clearly beyond the scope and would impact multiple existing and possibly new drafts.
Thanks,
Acee

From: Susan Hares <[email-masked]>
Date: Tuesday, May 8, 2018 at 12:59 PM
To: IDR List <[email-masked]>
Cc: John Scudder <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: draft-ietf-idr-bgp-prefix-sid - security considerations
Resent-From: <[email-masked]>
Resent-To: Stefano Previdi <[email-masked]>, <[email-masked]>, Acee Lindem <[email-masked]>, Arjun Sreekantiah <[email-masked]>, <[email-masked]>
Resent-Date: Tuesday, May 8, 2018 at 12:59 PM

You state in -19.txt

   The internal

Susan Hares

---

From: "Susan Hares" <[email-masked]>
Date: Tue, 8 May 2018 15:53:26 -0400

Acee:

I’m not sure why this is out of scope for the security section

since it resolves some of the concerns security people may 

have about SR-Routing.  

With standardized Yang models that securely pass information (via TLS)

to configure and validate the configuration of the 

SR Domain boundaries, BGP peering, BGP filters, and packet

filters,  the IETF has provided secure mechanism to enact SR routing

and detect errors.  These tools reduce the attack surface of SR routing. 

Configuration and monitoring can push/pull or notify over a secure channel.

The whole process can undergo automatic tracking and validation. 

Indicating that  this milieu of management tools reduces risk for 

 BGP Prefix SID deployment seems to be important restatement of 

the environment that the IETF OPS and Routing Areas have been 

working on for the last 5 years. 

Sue

From: Acee Lindem (acee) [mailto:[email-masked]] 
Sent: Tuesday, May 8, 2018 2:22 PM
To: Susan Hares; [email-masked]
Cc: 'John Scudder'; [email-masked]
Subject: Re: draft-ietf-idr-bgp-prefix-sid - security considerations 

Hi Sue, 

Thanks,

Acee 

You state in -19.txt 

   The internal

Susan Hares

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Tue, 8 May 2018 20:12:44 +0000

Sue,

From: Susan Hares <[email-masked]>
Date: Tuesday, May 8, 2018 at 3:53 PM
To: Acee Lindem <[email-masked]>, IDR List <[email-masked]>
Cc: John Scudder <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: RE: draft-ietf-idr-bgp-prefix-sid - security considerations
Resent-From: <[email-masked]>
Resent-To: Stefano Previdi <[email-masked]>, <[email-masked]>, Acee Lindem <[email-masked]>, Arjun Sreekantiah <[email-masked]>, <[email-masked]>
Resent-Date: Tuesday, May 8, 2018 at 3:53 PM

Acee:

Again, the BGP Prefix-SID “Security Considerations” section discusses security issues relative to this mechanism. It is NOT the place to specify your proposal for a segment routing security framework. Note that this has already been through the IESG once so it is has already been subjected to the concerns of security people.

Thanks,
Acee

Sue

Hi Sue,

You state in -19.txt

   The internal

Susan Hares

---

From: "Susan Hares" <[email-masked]>
Date: Tue, 8 May 2018 16:22:35 -0400

Acee:

You are right that the security people have seen this draft before.

If they did not feel it was necessary to add that point

at that time,  perhaps they feel the OPS/NM milieu  

of NETCONF and Yang models is common knowledge. 

Leaving it out seems the best policy for this next round at the IESG.

Will you be creating another version soon with the changes? 

I we’ve resolve my comments with those changes, and it should go back 

to Alvaro’s AD review for this version. 

Sue 

Sent: Tuesday, May 8, 2018 4:13 PM

Sue, 

Acee:

have about SR-Routing.  

Thanks,

Acee 

Sue

Hi Sue, 

Thanks,

Acee 

You state in -19.txt 

   The internal

Susan Hares

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Tue, 8 May 2018 21:23:01 +0000

Hi Sue,

Date: Tuesday, May 8, 2018 at 4:22 PM

Acee:

I think it is more that it would require more details than thinking it is common knowledge.

Will get a version out tonight.

Thanks,
Acee

Sue

Sue,

Acee:

Thanks,
Acee

Sue

Hi Sue,

You state in -19.txt

   The internal

Susan Hares

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Tue, 8 May 2018 21:59:59 +0000

Hi Sue, et al,
I just posted the -20 version.
Thanks,
Acee

From: Acee Lindem <[email-masked]>
Date: Tuesday, May 8, 2018 at 5:23 PM
To: Susan Hares <[email-masked]>, IDR List <[email-masked]>
Cc: John Scudder <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: draft-ietf-idr-bgp-prefix-sid - security considerations
Resent-From: <[email-masked]>
Resent-To: Stefano Previdi <[email-masked]>, <[email-masked]>, Acee Lindem <[email-masked]>, Arjun Sreekantiah <[email-masked]>, <[email-masked]>
Resent-Date: Tuesday, May 8, 2018 at 5:23 PM

Hi Sue,

Acee:

Thanks,
Acee

Sue

Sue,

Acee:

Thanks,
Acee

Sue

Hi Sue,

You state in -19.txt

   The internal

Susan Hares

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Mon, 14 May 2018 17:03:11 +0000

Hi Sue, John,
Are we ready to send this document back to the IESG?
Thanks,
Acee

From: Acee Lindem <[email-masked]>
Date: Tuesday, May 8, 2018 at 5:59 PM
To: Susan Hares <[email-masked]>, IDR List <[email-masked]>
Cc: John Scudder <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: draft-ietf-idr-bgp-prefix-sid - security considerations
Resent-From: <[email-masked]>
Resent-To: Stefano Previdi <[email-masked]>, <[email-masked]>, Acee Lindem <[email-masked]>, Arjun Sreekantiah <[email-masked]>, <[email-masked]>
Resent-Date: Tuesday, May 8, 2018 at 6:00 PM

Hi Sue, et al,

Hi Sue,

Acee:

Thanks,
Acee

Sue

Sue,

Acee:

Thanks,
Acee

Sue

Hi Sue,

You state in -19.txt

   The internal

Susan Hares

---

From: "Susan Hares" <[email-masked]>
Date: Mon, 14 May 2018 13:32:16 -0400

Acee:

I think so.   John and I will be talking on Tuesday to confirm.  (John’s busy on Monday with Day-job work). 

Sue 

From: Acee Lindem (acee) [mailto:[email-masked]] 
Sent: Monday, May 14, 2018 1:03 PM
To: Susan Hares; [email-masked]
Cc: 'John Scudder'; [email-masked]; Alvaro Retana
Subject: Re: draft-ietf-idr-bgp-prefix-sid - security considerations 

Hi Sue, John, 

Thanks,

Acee 

Hi Sue, et al, 

Thanks,

Acee

Hi Sue, 

Acee:

Thanks,

Acee 

Sue 

Sue, 

Acee:

have about SR-Routing.  

Thanks,

Acee 

Sue

Hi Sue, 

Thanks,

Acee 

You state in -19.txt 

   The internal

Susan Hares