Subject: [savi] [Fwd: I-D Action:draft-bagnulo-savi-send-00.txt]

From: marcelo bagnulo braun <[email-masked]>
Date: Sun, 26 Oct 2008 17:20:21 +0100

Hi,

I have submitted a draft describing how to build a SAVI solution using 
the SeND protocol without any change to the hosts nor to the SeND 
protocol. I think the resulting security level is pretty good.

Comments would be appreciated.

Regards, marcelo

-------- Mensaje original --------
Asunto: 	I-D Action:draft-bagnulo-savi-send-00.txt
Fecha: 	Sun, 26 Oct 2008 09:15:01 -0700 (PDT)
De: 	[email-masked]
Responder a: 	[email-masked]
Para: 	[email-masked]

A New Internet-Draft is available from the on-line Internet-Drafts directories.

	Title           : SeND-based Source-Address Validation Implementation
	Author(s)       : M. Bagnulo
	Filename        : draft-bagnulo-savi-send-00.txt
	Pages           : 10
	Date            : 2008-10-26

This memo describes SeND SAVI, a mechanism to provide source address
validation using the SeND protocol.  The proposed mechanism is
intended to complement ingress filtering techniques to provide a
higher granularity on the control of the source addresses used.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-bagnulo-savi-send-00.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

_______________________________________________
I-D-Announce mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: Christian Vogt <[email-masked]>
Date: Thu, 30 Oct 2008 23:43:09 +0200

> Comments would be appreciated.

Hi Marcelo,

thanks for your solution proposal for SeND-based SAVI.  I like this
because of its simplicity.  Also, it fully complies to the charter, so
no show-stopper in that regard.  I have three comments.  Of those, two
apply not just to SeND-based SAVI, but also to plain-ND SAVI:

- Your proposal binds IP addresses to layer-2 addresses and optionally
   to additional layer-2 properties such as a switch port.  Yet
   checking a layer-2 address may actually no longer be necessary once
   you check a switch port.  This leads to the more general question of
   which "lower-layer binding anchor" IP addresses should be bound to.
   Since this question applies to SAVI in general, not just the SeND-
   based variant, I will open a separate mailing list thread for this.

- You are using the terms "local traffic" and "transit traffic" to
   differentiate between, respectively, traffic that should be
   validated and traffic that should not be.  Introducing special terms
   for this is a very good idea.  But perhaps we should re-word to
   avoid misunderstandings.  A situation where the term "local traffic"
   could be misunderstood is this:  A host addresses a packet to a
   neighbor, but sends it to the local router instead of sending it
   directly to the neighbor.  One would intuitively consider this
   "local traffic", but SAVI should still not validate the packet when
   forwarded by the router.  How about "first-hop traffic" and
   "forwarded traffic"?  Or perhaps someone has a better idea?

- This brings me to another general question:  How does a SAVI device
   distinguish first-hop traffic from forwarded traffic.  I see two
   basic approaches:  (1) Based on whether or not a packet's source
   address is from an on-link subnet prefix; or (2) based on whether or
   not the sending node is an authorized router.  Your proposal uses
   both approaches simultaneously, and I think that is perfectly
   feasible if SeND is available.  With plain ND, however, approach (2)
   would be less elegant since it would require manual configuration.
   We should discuss which approach is best for plain-ND SAVI, and
   which is best for SeND-based SAVI.  I will open up another mailing
   list tread for this as well.

Cheers,
- Christian

---

From: marcelo bagnulo braun <[email-masked]>
Date: Fri, 31 Oct 2008 09:52:23 +0100

Hi Chrsitian,

thanks for the comments, see replies below...

Christian Vogt escribió:
>   you check a switch port.
right
but otoh, binding the the layer 2 address is what SAVI _does_ right?
So it would be a bit unnatural to simply use the MAC address information 
just as a random set of bits to be signed so that the CGA holder can 
prove his identify... more when the MAC address is somehow related to 
all the SAVI approach

So, i agree that you checking the mac address may not be needed, but 
also, it is the only think you are sure you can bind the IP address when 
you are using SeND in all the cases.

So, in any case, you must always check the signature to verify CGA 
ownership.
Once you have made this verification, if you don't have any other more 
relevant layer-2 information to bind the IP address to, you need to use 
the layer 2 address.
If you do have, you can ignore it (once you have verified it)

> This leads to the more general question of
>   forwarded by the router.

right
but it is a bit corner case, right?
>   How about "first-hop traffic" and
well, the traffic that a host sends to a router is forwarded traffic, 
since the router needs to forward it.
the problem with short names is that you can always read to much into 
them :-)
I am ok with any name we choose, cause the good thing about short names 
is that most of the times you can interpret them correctly also

regards, marcelo

---

From: ZhangDong <[email-masked]>
Date: Wed, 12 Nov 2008 15:50:42 +0800

Hi Marcelo,

I have gone through the draft. Firstly, I want to ask a question about two concept. What are on-link and off-link? Do you mean on-link is local traffic and off-link is transit traffic?

Then for I am a non-native English speaker, so I will point out several language problems that affect my reading.

>2.3.  Address ownership proof
>
>  The main function performed by SeND SAVI is to verify that the source
>   address used in data packets actually belongs to the originator of
>   the packet.  Since SeND SAVI scope is limited to the local-link, the
>   originator of the packet is attached to the local-link.  In order to
>   to define any source address validation solution, we need to define
There is redundant word "to". 
>   some address ownership proof concept i.e. what it means to be able to
>   proof that a given host owns a given address in the sense that the
>   host is entitled to send packet with that source address.
>
>   Since no hast changes are acceptable, we need to find the means to
What does "hast" mean?   have or has?
>   proof address ownership without requiring a new protocol.  In SeND
>   SAVI the address ownership proof is based in the tools used by SeND,
>   namely CGAs and certificates.  CGAs are used to verify that the
>   generator of a packet containing an on-link source address is
>   actually the owner of the address.  Certificates are used to verify
>   that a node sending packets with off-link source address is an
>   authorized router.  By using these two tools, we can verify the
>   source address used in any packet flowing through the local-link is
>   either generated by the host owner of the on-link source address or
>   is generated by an authorized router.
>
>   In both cases, the verification performed applies to the layer-2
>   address used in the data packets.  In the case of the CGA
>   verification, we use CGas and the SeND protocol to verify the
>   Neighbor Advertisement message which contains the binding between the
>   CGA source address and the layer-2 address which will later be used
>   in data packets.  By this mean we can verify that is the owner of the
>   CGA source address the one that is claiming to be willing to use the
>   layer-2 address in data packets.  We assume that data packets
"By this mean we can verify that is the owner of the CGA source address the one that is claiming to be willing to use the layer-2 address in data packets."
I assume that this sentence is not very clear, one clause in another caluse.
>   containing this layer-2 information are valid.  In the case of the
>   certificate validation, we use the certificate to validate that a
>   given node is an authorized router.  Then we use the CGA of that
>   router to verify the binding between the address of the authorized
>   router and the layer-2 information for that router.  After these two
>   checks, we assume that packets containing off-link addresses coming
>   from that layer-2 address are valid, since they come from the layer-2
>   address of an authorized router.
>
>3.1.  SeND SAVI Data structures
>   SeND SAVI function relies on state information binding the source
>   address used in data packets to the layer-2 information that
>   contained the first packet that used that source IP address.  Such
Perhaps making the first sentence is more better.

Thank you.

Dong Zhang

----- 原始邮件 -----
发件人: marcelo bagnulo braun <[email-masked]>
日期: 2008年 10月 27日, 星期一,  上午12:20
主题: [savi] [Fwd: I-D Action:draft-bagnulo-savi-send-00.txt]
收件人: SAVI Mailing List <[email-masked]>

>  savi mailing list
>  [email-masked]
>  https://www.ietf.org/mailman/listinfo/savi
>