Subject: [netlmm] FW: TLV header in the GRE Keys draft

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 19 May 2009 16:46:25 -0700

Hello folks,

I had an offline discussion with the Ads on restricting the possible valid
values for the 'Next Header' field in the TLV header in
draft-ietf-netlmm-grekey-option-09.txt. See below. Jari suggested making
this change during the AUTH48 stage. Here is the suggested text change for
this

OLD:

  Next Header

      8-bit unsigned integer which indicates the protocol number of the
      payload header following this TLV header.  It is set to the
      protocol number as assigned by IANA at the following
      http://www.iana.org/assignments/protocol-numbers. e.g., if an IPv6
      header follows, it should be '41'; '47' if it is a GRE header that
      follows.

NEW:

  Next Header

      8-bit unsigned integer which indicates the protocol number of the
      payload header following this TLV header.  The valid values for this
      field are '4' (IPv4), '41' (IPv6), '47' (GRE), and '50' (ESP).
      The values are taken from the protocol numbers as assigned by IANA at
      the http://www.iana.org/assignments/protocol-numbers. All others
      values are not permitted. If the MAG or the LMA node receives a packet
      with the TLV header where the 'Next Header' field is set to anything
      other than the above mentioned four protocols, it SHOULD silently
      discard the packet.

Feel free to modify the text.

Vijay

------ Forwarded Message
From: Jari Arkko <[email-masked]>
Date: Tue, 05 May 2009 19:44:28 +0300
To: Vijay Devarapalli <[email-masked]>
Cc: Pasi Eronen <[email-masked]>
Subject: Re: TLV header in the GRE Keys draft

I think that sounds reasonable. Bring it up in AUTH48.

Jari

Vijay Devarapalli wrote:
> Hi Jari, Pasi,
>
> I think we need to restrict the values for the "Next Header" field in the
> TLV header in draft-ietf-netlmm-grekey-option to just IPv4, IPv6 or GRE.
>
> A typical MAG or LMA implementation would turn off most of the ports, allow
> a certain number of ports and only process a limited number of control plane
> packets. The TLV header causes issues. Basically on top of the DS-MIPv6 port
> (since the UDP header is always there before the TLV header), you can carry
> pretty much any protocol. All the 140 protocols described on the IANA page
> can carried inside the TLV header.
> http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
>
> An implementation can address this by dropping anything other the relevant
> protocols after the TLV header. But I am not sure if all implementers will
> do this. So it would better if we specify in draft-ietf-netlmm-grekey-option
> that only IPv4, IPv6 or GRE can follow the TLV header. If there is anything
> else, the MAG or the LMA should drop the packet.
>
> I just noticed that this document got approved. So can we add this
> restriction in the AUTH48 stage?
>
> Vijay

---

From: "Ahmad Muhanna" <[email-masked]>
Date: Wed, 20 May 2009 00:43:32 -0500

Hello Vijay,

Text looks fine. 
Will take care of it during AUTH48.

Cheers!

Regards,
Ahmad

> -----Original Message-----
> From: Vijay Devarapalli [mailto:[email-masked]] 
> Sent: Tuesday, May 19, 2009 6:46 PM
> To: NETLMM Mailing List; Muhanna, Ahmad (RICH1:2H10)
> Cc: Jari Arkko
> Subject: FW: TLV header in the GRE Keys draft
> 
> Hello folks,
> 
> I had an offline discussion with the Ads on restricting the 
> possible valid values for the 'Next Header' field in the TLV 
> header in draft-ietf-netlmm-grekey-option-09.txt. See below. 
> Jari suggested making this change during the AUTH48 stage. 
> Here is the suggested text change for this
> 
> OLD:
> 
>   Next Header
> 
> > I think we need to restrict the values for the "Next 
> Header" field in 
> > the TLV header in draft-ietf-netlmm-grekey-option to just 
> IPv4, IPv6 or GRE.
> >
> > A typical MAG or LMA implementation would turn off most of 
> the ports, 
> > allow a certain number of ports and only process a limited 
> number of 
> > control plane packets. The TLV header causes issues. 
> Basically on top 
> > of the DS-MIPv6 port (since the UDP header is always there 
> before the 
> > TLV header), you can carry pretty much any protocol. All the 140 
> > protocols described on the IANA page can carried inside the 
> TLV header.
> > 
> > An implementation can address this by dropping anything other the 
> > relevant protocols after the TLV header. But I am not sure if all 
> > implementers will do this. So it would better if we specify in 
> > draft-ietf-netlmm-grekey-option that only IPv4, IPv6 or GRE 
> can follow 
> > the TLV header. If there is anything else, the MAG or the 
> LMA should drop the packet.
> >