Subject: [Int-area] Eric Rescorla's No Objection on draft-ietf-intarea-probe-09: (with COMMENT)

From: Eric Rescorla <[email-masked]>
Date: Tue, 12 Dec 2017 16:20:52 -0800

Eric Rescorla has entered the following ballot position for
draft-ietf-intarea-probe-09: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-intarea-probe/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I share Yaron Sheffer's concern about the incoming ACL. Do you really mean to
list all the probe-capable nodes?

   or IPv6 Neighbor Cache [RFC4861].  Otherwise, it reports that the
   interface does not exist.
Hmm... So you don't try to ping it yourself? That's interesting.

      the probed node.  The L-bit is clear if the probed interface is
      directly connected to the probed node.
Maybe I'm missing something here, but how does the probing node know?
I.e., can it address by IP address and set L=0?

View Inlinedraft-ietf-intarea-probe.txt:365
      Ethernet is running on the probed interface.  Otherwise, the E-bit
      is clear.
This seems pretty limited. Does "WiFi" count for instance?

---

From: Ron Bonica <[email-masked]>
Date: Wed, 13 Dec 2017 21:43:20 +0000

Hi Eric,

Thanks for the review. Responses inline......

                        Ron

> -----Original Message-----
> From: Eric Rescorla [mailto:[email-masked]]
> Sent: Tuesday, December 12, 2017 7:21 PM
> To: The IESG <[email-masked]>
> Cc: [email-masked]; Luigi Iannone <[email-masked]>;
> [email-masked]; [email-masked]; [email-masked]
> Subject: Eric Rescorla's No Objection on draft-ietf-intarea-probe-09: (with
> COMMENT)
> 
[RB ] 
[snip]
> I share Yaron Sheffer's concern about the incoming ACL. Do you really mean
> to list all the probe-capable nodes?
[RB ] 
The ACL doesn't list all probe-capable nodes. It is configure on a probe-capable node and it enumerates the prefixes from which it will accept an ICMP Extended Echo Request.

For example, assume that an ISP deploys PROBE capable software on its routers. By default, these routers won't accept an ICMP Extended Echo Request from anybody. The ISP will probably want to enable PROBE, but only if the ICMP Extended Echo Request comes from the NOC or from a few other trusted prefixes. So, the ISP will put those prefixes into the ACL.

I am thinking that the number of prefixes will typically be very small (e.g., the NOC).

> Hmm... So you don't try to ping it yourself? That's interesting.
[RB ] 
The proxy node could ping the probed interface, but that would require the router to main state. We don't want to go there for scaling and security reasons.

Rather than doing that, PROBE looks for an entry in the ARP Table and Neighbor Cache. Prior version 08 of this draft, the proxy node assumed that the probed interface does not exist if it is not in the ARP Table and Neighbor Cache. IETF LC reviewers pointed out that this assumption is not safe. So now, the proxy node reports that the table entry does not exist. In no longer reports that the interface does not exist.

> I.e., can it address by IP address and set L=0?
[RB ] 
This is a parameter to the Probe application. See the appendix.
> This seems pretty limited. Does "WiFi" count for instance?
[RB ] 
The E-bit was removed in response to last call comments

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 13 Dec 2017 14:15:56 -0800

On Wed, Dec 13, 2017 at 1:43 PM, Ron Bonica <[email-masked]> wrote:

> The ACL doesn't list all probe-capable nodes. It is configure on a
> probe-capable node and it enumerates the prefixes from which it will accept
> an ICMP Extended Echo Request.
>
> For example, assume that an ISP deploys PROBE capable software on its
> routers. By default, these routers won't accept an ICMP Extended Echo
> Request from anybody. The ISP will probably want to enable PROBE, but only
> if the ICMP Extended Echo Request comes from the NOC or from a few other
> trusted prefixes. So, the ISP will put those prefixes into the ACL.
>

Thanks.

> The proxy node could ping the probed interface, but that would require the
> router to main state. We don't want to go there for scaling and security
> reasons.
>
> Rather than doing that, PROBE looks for an entry in the ARP Table and
> Neighbor Cache. Prior version 08 of this draft, the proxy node assumed that
> the probed interface does not exist if it is not in the ARP Table and
> Neighbor Cache. IETF LC reviewers pointed out that this assumption is not
> safe. So now, the proxy node reports that the table entry does not exist.
> In no longer reports that the interface does not exist.
>

OK.

> This is a parameter to the Probe application. See the appendix.

I did note that. It seems kind of limited, but it's your choice, obviously
-Ekr