Subject: [GROW] Ben Campbell's Yes on draft-ietf-grow-bgp-gshut-12: (with COMMENT)

From: Ben Campbell <[email-masked]>
Date: Wed, 13 Dec 2017 20:28:24 -0800

Ben Campbell has entered the following ballot position for
draft-ietf-grow-bgp-gshut-12: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-grow-bgp-gshut/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I'm balloting "yes" because I think it's important to publish this. But, like
Alvaro,  I wonder why this is not standards track, BCP, or just about anything
but informational. So I support his DISCUSS, including his the comments on how
to resolve it.

-1, last paragraph: This references RFC 8174, but does not use the actual 8174
boilerplate. Is there a reason not to do so?

---

From: <[email-masked]>
Date: Thu, 14 Dec 2017 14:42:27 +0000

Ben,

Thanks for your review and comments.
More inline. [Bruno]

> From: Ben Campbell [mailto:[email-masked]]
> 
 
[Bruno] Well noted: we now have 3 AD asking for STD track.
If you don't mind, to avoid duplication, I'll follow up on Alvaro's email. (in short, STD track is ok for me)
 
 > boilerplate. Is there a reason not to do so?
 
[Bruno] My mistake: I had a comment to reference RFC 8174 rather than RFC 2119. I was not aware that this also implied changing the text.
My understanding is the following:
OLD:
	 <t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL",
	 "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY",
	 and "OPTIONAL" in this document are to be interpreted as
	 described in RFC 8174 <xref target="RFC8174"/>.</t>

NEW
	<t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
      NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED",
      "MAY", and "OPTIONAL" in this document are to be interpreted as
      described in [BCP14] <xref target="RFC2119"/> <xref target="RFC8174"/> when, and only when, they
      appear in all capitals, as shown here.</t>

That being said, the irony is that RFC 8174 does not use an upper case "should":
"Authors who follow these guidelines should incorporate this phrase near the beginning of their document:"
https://tools.ietf.org/html/rfc8174#section-2

--Bruno

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

---

From: "Smith, Donald" <[email-masked]>
Date: Thu, 14 Dec 2017 17:12:52 +0000

I don't see anything around MD5/TCPAO authentication.

>From https://tools.ietf.org/html/rfc6198

" Security considerations MUST be addressed by the proposed solutions.
   In particular, they SHOULD address the issues of bogus g-shut
   messages and how they would affect the network(s), as well as the
   impact of hiding a g-shut message so that g-shut is not performed."

I may have missed it somewhere?

if (initial_ttl!=255) then (rfc5082_compliant==0)
[email-masked]

________________________________________
From: GROW [[email-masked]] on behalf of [email-masked] [[email-masked]]
Sent: Thursday, December 14, 2017 7:42 AM
To: Ben Campbell
Cc: [email-masked]; [email-masked]; [email-masked]; The IESG
Subject: Re: [GROW] Ben Campbell's Yes on draft-ietf-grow-bgp-gshut-12: (with COMMENT)

Ben,

NEW

--Bruno

_______________________________________________
GROW mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/grow

This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

---

From: Job Snijders <[email-masked]>
Date: Thu, 14 Dec 2017 17:20:41 +0000

> I may have missed it somewhere?

I have trouble parsing this requirements text.

What makes a "bogus g-shut" a "bogus g-shut"?

How is 'hiding' (I interpret this as 'removing the gshut community) a
g-shut any different than the other BGP speaker not supporting g-shut?

How is any of this different than NO_EXPORT or NO_ADVERTISE?

Kind regards,

Job

---

From: <[email-masked]>
Date: Thu, 14 Dec 2017 18:03:42 +0000

> From: Smith, Donald [mailto:[email-masked]]
 > Sent: Thursday, December 14, 2017 6:13 PM
> 

This is correct, but this is really not specific to this document and the comment would apply to any information sent over BGP session, and probably to most of IDR document extending the protocol with additional field or usage.
If there is a need to discuss this all IETF document related to BGP, we can indeed add some text. Would the following text be ok with you?

"This document does not change any underlying security issues associated with any other BGP Communities mechanism.  Unless a transport that
   provides integrity is used for the BGP session, the GRACEFUL_SHUTDOWN community may be added or removed by a man in the middle. However, the harm would be lower than adding or removing an NLRI, or adding a NO_EXPORT or NO_ADVERTISE community. Hence this does not constitute a new attack vector. Protection of the TCP session used by BGP is discussed in section 5.1 of RFC 7454,  security section of [RFC4271] and [RFC4272]."

Regards,
--Bruno

 > [Bruno] My mistake: I had a comment to reference RFC 8174 rather than RFC 2119. I was not
 > aware that this also implied changing the text.
 > _____________________________________________________________________________
 > ____________________________________________
 > 
 > This communication is the property of CenturyLink and may contain confidential or privileged
 > information. Unauthorized use of this communication is strictly prohibited and may be unlawful.
 > If you have received this communication in error, please immediately notify the sender by reply e-
 > mail and destroy all copies of the communication and any attachments.
 >

---

From: Job Snijders <[email-masked]>
Date: Thu, 14 Dec 2017 19:38:19 +0000

On Thu, Dec 14, 2017 at 06:03:42PM +0000, [email-masked] wrote:
> This is correct, but this is really not specific to this document and
> the comment would apply to any information sent over BGP session, and
> probably to most of IDR document extending the protocol with
> additional field or usage.  If there is a need to discuss this all
> IETF document related to BGP, we can indeed add some text. Would the
> following text be ok with you?
> 
> "This document does not change any underlying security issues
> associated with any other BGP Communities mechanism.  Unless a
> transport that provides integrity is used for the BGP session, the
> GRACEFUL_SHUTDOWN community may be added or removed by a man in the
> middle. However, the harm would be lower than adding or removing an
> NLRI, or adding a NO_EXPORT or NO_ADVERTISE community. Hence this does
> not constitute a new attack vector. Protection of the TCP session used
> by BGP is discussed in section 5.1 of RFC 7454,  security section of
> [RFC4271] and [RFC4272]."

I think the above is mostly good, but can be trimmed a little bit. The
following is on point and covers aspects relevant to GRACEFUL_SHUTDOWN.

    "This document does not change any underlying security issues
    associated with any other BGP Communities mechanism. Unless a
    transport that provides integrity is used for the BGP session, the
    GRACEFUL_SHUTDOWN community may be added or removed by a man in the
    middle."

Kind regards,

Job

---

From: "Smith, Donald" <[email-masked]>
Date: Thu, 14 Dec 2017 20:55:15 +0000

>       From: Job Snijders [[email-masked]]
>       Sent: Thursday, December 14, 2017 12:38 PM
>       To: [email-masked]
>       Cc: Smith, Donald; [email-masked]; Ben Campbell; [email-masked]; [email-masked]; The IESG

Since in theory you could do this blindly (tcp slipping in the window), I would remove the MITM and say by "unauthorized 3rd parties" or something like that.

Otherwise this is better than putting all the other security recommendations from other rfcs [4271, 4272] so I support referencing them instead.

---

From: "Smith, Donald" <[email-masked]>
Date: Thu, 14 Dec 2017 22:15:26 +0000

I read bogus as spoofed or forged.

________________________________________
From: Job Snijders [[email-masked]]
Sent: Thursday, December 14, 2017 10:20 AM
To: Smith, Donald
Cc: [email-masked]; Ben Campbell; [email-masked]; [email-masked]; [email-masked]; The IESG
Subject: Re: [GROW] Ben Campbell's Yes on draft-ietf-grow-bgp-gshut-12: (with COMMENT)

Kind regards,

Job

---

From: Ben Campbell <[email-masked]>
Date: Thu, 14 Dec 2017 17:04:21 -0600

> On Dec 14, 2017, at 8:42 AM, [email-masked] wrote:
> 
> Ben,
> 

Thanks, I will follow the discussion there.

>      appear in all capitals, as shown here.</t>

Works for me.

> https://tools.ietf.org/html/rfc8174#section-2

I think that was carefully chosen, since the 2119/8174 keywords are intended to be about interoperability among protocol implementations more than requirements for the standards process. OTOH, RFC 2119 has an all-caps MUST in the sentence that states that, making it a self-violating requirement:

"In particular, they MUST only be used where it is actually required for interoperation or to limit behavior which has potential for causing harm."

So, go figure :-)

Thanks!

Ben.

---

From: <[email-masked]>
Date: Fri, 15 Dec 2017 09:29:23 +0000

> >           GRACEFUL_SHUTDOWN community may be added or removed by a man in the

OK.
Personally, I feel that the precision that this does not constitute a new attack vector was useful, but I can live without; at least while waiting for the security review. 

 > >       Kind regards,
 > >
 > >       Job
 > 
 > Since in theory you could do this blindly (tcp slipping in the window), I would remove the MITM
 > and say by "unauthorized 3rd parties" or something like that.

Ok.
 
 > Otherwise this is better than putting all the other security recommendations from other rfcs [4271,
 > 4272] so I support referencing them instead.
 
Sorry, I'm not sure to follow. Are you fine with the text proposed by Job or would you prefer adding references to the RFCs (i.e.  section 5.1 of RFC 7454,  security section of [RFC4271] and [RFC4272].)

As draft -12 has just been IETF Last Called (again), in order to not create a mess, I'll wait for the end of the last call before uploading a -13.

Thanks
--Bruno