Subject: [savi] Adopting draft-bagnulo-savi-fcfs/send

From: Christian Vogt <[email-masked]>
Date: Wed, 7 Jan 2009 19:34:59 -0800

Folks -

We had a discussion regarding the adoption of individual Internet drafts
as official documents of the SAVI working group.  I would like to
conclude this discussion for the following two Internet drafts:

- draft-bagnulo-savi-fcfs
- draft-bagnulo-savi-send

The feedback we got at the SAVI meeting in Minneapolis and on this
mailing list shows that there is strong support for the FCFS principle,
which is the baseline of both of the above Internet drafts.  A couple of
issues have been identified, and these will have to be addressed.  But
the issues are no showstoppers in my opinion.  In fact, many of them
apply to specific instantiations of the FCFS principle rather than to
the FCFS principle itself.

I have therefore decided to adopt the above Internet drafts as SAVI
working group documents.  Draft-bagnulo-savi-fcfs will be continued
as draft-ietf-savi-fcfs with Erik Nordmark, Marcelo Bagnulo, and Fred
Baker as editors.  Draft-bagnulo-savi-send will be continued
as draft-ietf-savi-send with Ana Kukec, Marcelo Bagnulo, Jianping Wu,
and Jun Bi as editors.

Of course, the documents are far from completion; there is much work
ahead.  And part of this work will be to address the issues that were
raised during the foregoing discussion.  Those are in summary:

- Lack of support for pre-configured, static addresses (Frank Xia).

- Possible DoS attacks where an attacker tricks a SAVI device into
   blocking an address that a victim host is about to configure (Guang
   Yao).

- Possible loss of synchronizing between a host and the responsible SAVI
   device regarding the host's right to use an address (Guang Yao).

- Need to protect target addresses in Neighbor Discovery messages
   similarly to source addresses in regular packets (Guang Yao).

- Filtering load for switches (Lin Tao):  How much load do we impose on
   a switch by requiring it to filter out and monitoring certain
   packets.

- Strength of binding anchors (Dong Zhang):  SAVI will work with various
   binding anchors of different security strength.  SAVI specifications
   should provide guidance for selecting a binding anchor.  We already
   decided to provide such guidance in SAVI specifications.

As a starting point, I would like the current, unmodified versions of
above Internet drafts to be re-submitted with their new names
(draft-ietf-savi-*).  Editors, please go ahead and do so.

- Christian

---

From: "Frank Xia" <[email-masked]>
Date: Wed, 7 Jan 2009 21:50:55 -0600

Hi Christian

It seems to be a little bit rush :-).

I don't think people have enough
time to read your previous email.

For my understanding,  it is hard
to hard to say "STRONG" support
for the FCFS principle.
At least, I can not  find strong support
through this long discussions in the 
mailing list.

IMHO, the decision should be based
rough consensus by WG.  IETF is based
on mailing list. 

BR
Frank

----- Original Message ----- 
From: "Christian Vogt" <[email-masked]>
To: "SAVI Mailing List" <[email-masked]>
Cc: "Ana Kukec" <[email-masked]>
Sent: Wednesday, January 07, 2009 9:34 PM
Subject: [savi] Adopting draft-bagnulo-savi-fcfs/send

> _______________________________________________
> savi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/savi
>

---

From: Fred Baker <[email-masked]>
Date: Wed, 7 Jan 2009 20:19:40 -0800

Yes, and I thought Iheard read some dissenting reviews. Maybe those  
who wrote them could remind us of their concerns?

On Jan 7, 2009, at 7:50 PM, Frank Xia wrote:

> through this long discussions in the mailing list.
>
> ----- Original Message ----- From: "Christian Vogt" <[email-masked] 
> >

---

From: Christian Vogt <[email-masked]>
Date: Wed, 7 Jan 2009 20:21:42 -0800

Frank -

As I assured in my earlier email, those issues that have been raised are
valid and will certainly have to be addressed.  This includes your
comment regarding the support for pre-configured addresses, as well as
the question of whether binding establishment should be based on control
or data packets, which I summarized in the email you are referring to.
But the issues raised do not render the FCFS principle inappropriate for
working group adoption.  On the contrary, based on the feedback from the
working group and the discussions I had with working group participants,
I am very positive that there is in fact strong support for the FCFS
principle. Hence the adoption of draft-bagnulo-savi-fcfs/send.

- Christian

---

From: Christian Vogt <[email-masked]>
Date: Wed, 7 Jan 2009 20:31:36 -0800

Christian Vogt wrote:

> Baker as editors.  [...]

This requires some clarification given that the SAVI working group was
chartered to produce separate documents for IPv4 and IPv6 solutions:
For the sake of simplicity, I suggest to start with a joint IPv4/IPv6
solution document, and to split this into two, IP-version-specific
documents once we consider this useful.  At this point, the IPv4 and
IPv6 solutions are sufficiently similar to justify a joint document.

- Christian

---

From: "Frank Xia" <[email-masked]>
Date: Wed, 7 Jan 2009 22:49:20 -0600

Hi Christian and Fred

Thank Christian did a very good job!

Just as Christian's email  listed, there are 6 
issues need to be discussed and studied.  
IMHO, some solutions of these issues probably 
are beyond capability of  FCFS.
I think it is not necessary to have a conclusion
before initiating any discussion.

I would also like to quote the email which says 
"Marcelo and Guang had an interesting 
discussion on whether FCFS SAVI
should establish bindings based on data
packets or based on control packets"
I think this is disagreement on some principles.
From my technical perspective, data plan
learning and control plan snooping are totally
different methods.

BR
Frank

---

From: "Frank Xia" <[email-masked]>
Date: Wed, 7 Jan 2009 22:57:35 -0600

Hi Christian

A little bit curious :).

Why are you VERY POSITIVE?
Have you any proof beyond SAVI mailing list?

Probably, you can just do a simple poll,
and  IMO  it looks more convincing :-).

BR
Frank

----- Original Message ----- 
From: "Christian Vogt" <[email-masked]>
To: "Frank Xia" <[email-masked]>
Cc: "Fred Baker" <[email-masked]>; "Erik Nordmark" <[email-masked]>; 
"Marcelo Bagnulo Braun" <[email-masked]>; "Jianping Wu" 
<[email-masked]>; "Jun Bi" <[email-masked]>; "Ana Kukec" 
<[email-masked]>; "Bill Fenner" <[email-masked]>; "SAVI Mailing List" 
<[email-masked]>
Sent: Wednesday, January 07, 2009 10:21 PM
Subject: Re: [savi] Adopting draft-bagnulo-savi-fcfs/send

---

From: marcelo bagnulo braun <[email-masked]>
Date: Thu, 08 Jan 2009 13:36:22 +0100

Hi Frank,

I am a bit puzzled by you mail.

During consensus call for adopting the FCFS draft as a WG item, you 
explicitly stated that you were not against FCFS as well.
You raised a set of issues in your mail from 18 of dec, namely:

 >It seems to be hard to deal with the following scenarios:
 >1)A host is authorized to use a static address, while
 > the host does not connect the network
 >2)A IPv6 host periodically changes it's  interface ID
 >  from privacy consideration.
 >3)In dynamic address configuration,  an IP address
 >  can be reused by other hosts.

I answer to each of these points in a follow up email in the same date 
answering some of the issues and asking for calrification on others, but 
you never answered back

So either you agree with me and you feel the issues can be solved as i 
suggested or you should anser soemthing back. IETF work on rough 
consensus, which is build on disucssions. Saying that you don't like 
something and not describing why this is so it is hardly a good way to 
make progress. I don't think it is ok not to reply for weeks and then 
simply restate that you don't like something with no arguments.

Regards, marcelo

Frank Xia escribió:
> ----- Original Message ----- From: "Christian Vogt" 
> <[email-masked]>

---

From: marcelo bagnulo braun <[email-masked]>
Date: Thu, 08 Jan 2009 14:18:49 +0100

Frank,

could you please point out who disagreed with the FCFS principle for 
creating SAVI state?
The disucssion so far was whether we use data packets and/or control 
packets for this, but it is always FCFS.

My understanding of the situation is that the current draft only uses 
data packets and Guang has raised the issue (that i understnad actually 
was Fred who brought this up) that some attacks can be launched between 
the DAD and the first data packet

I agreed and i am ok with using ND packets as well to create state (at 
least for IPv6, not clear about IPv4 though).

Moreover, i also think we should use dhcp messages

So, i don't see too much controversy here, but that we are converging to 
something.

Regards, marcelo

Frank Xia escribió:
> Cc: "Fred Baker" <[email-masked]>; "Erik Nordmark" 
> <[email-masked]>; "Marcelo Bagnulo Braun" <[email-masked]>; 
> "Jianping Wu" <[email-masked]>; "Jun Bi" 
> <[email-masked]>; "Ana Kukec" <[email-masked]>; "Bill Fenner" 
> <[email-masked]>; "SAVI Mailing List" <[email-masked]>

---

From: "Frank Xia" <[email-masked]>
Date: Thu, 8 Jan 2009 08:22:36 -0600

Hi Marcelo

I am sorry for the ignorance because
of my absence of SAVI work recently.

Anyway, these days are holiday :-)

I would like to prioritize SAVI work in
next few days.

BR
Frank

----- Original Message ----- 
From: "marcelo bagnulo braun" <[email-masked]>
To: "Frank Xia" <[email-masked]>
Cc: "Christian Vogt" <[email-masked]>; "SAVI Mailing List" 
<[email-masked]>; "Ana Kukec" <[email-masked]>
Sent: Thursday, January 08, 2009 6:36 AM
Subject: Re: [savi] Adopting draft-bagnulo-savi-fcfs/send

---

From: Frank Xia <[email-masked]>
Date: Thu, 08 Jan 2009 09:22:51 -0600

Hi Marcelo

Please see my inline reply.

BR
Frank

----- Original Message ----- 
From: "marcelo bagnulo braun" <[email-masked]>
To: "Frank Xia" <[email-masked]>
Cc: "SAVI Mailing List" <[email-masked]>; "Christian Vogt"
<[email-masked]>; "Ana Kukec" <[email-masked]>
Sent: Thursday, January 08, 2009 7:18 AM
Subject: Re: [savi] Adopting draft-bagnulo-savi-fcfs/send

Frank,

could you please point out who disagreed with the FCFS principle for
creating SAVI state?
Frank=>What I learn about SAVI is from
http://tools.ietf.org/id/draft-bagnulo-savi-fcfs-00.txt.
As to this draft, my friends sent me a simulation report,
and the conclusion is not very optimistic.
I am not 100% agreeing on the conclusion which
says"We can see that FCFS is a very simple mechanism and
this is the main advantage. But FCFS mechanism is regardless of

Address Allocation Method and introduces a new stateless method,

so it is not compatible with DHCP or manual method. Also,

FCFS mechanism only bind IP to MAC or port,

so it can not handle some special cases such as MMAC,

MIF or LLM. At last, FCFS mechanism is vulnerable

and is weak against DOS attacks."

I think it does not matter who disagree with the FCFS, and
it does matter if FCFS can deal with current issues.

The disucssion so far was whether we use data packets and/or control
packets for this, but it is always FCFS.
Frank=>Good!  From my understanding, using control packets

are very important improvements.  Of course, We can also call it FCFS.

My understanding of the situation is that the current draft only uses
data packets and Guang has raised the issue (that i understnad actually
was Fred who brought this up) that some attacks can be launched between
the DAD and the first data packet
Frank=> We are always for  SAVI state population based on control plane.
Please check our draft
http://www-etud.iro.umontreal.ca/~sarikaya/drafts/draft-kaippallimalil-savi-ipv6-bbnet-00.txt

I agreed and i am ok with using ND packets as well to create state (at
least for IPv6, not clear about IPv4 though).
Frank=>Have you consider PPPoX scenario?

Moreover, i also think we should use dhcp messages
Frank=>Sure.  Please see our draft.

So, i don't see too much controversy here, but that we are converging to
something.
Frank=>Good. I am very open with converging and evolution.

Regards, marcelo

Frank Xia escribió:
> "Jianping Wu" <[email-masked]>; "Jun Bi" <[email-masked]>;
> "Ana Kukec" <[email-masked]>; "Bill Fenner" <[email-masked]>; "SAVI
> Mailing List" <[email-masked]>