Subject: [lisp] Design discussion -06-(4) -> protecting against coarse Map-Replies: proposed text enclosed

From: Dino Farinacci <[email-masked]>
Date: Tue, 12 Jan 2010 14:31:43 -0800

Here is proposed text to deal with this issue. Darrel will be posting  
to the list an entire diff file as well as the ID shortly.

Thanks,
Dino and Darrel

On Dec 21, 2009, at 6:38 PM, Dino Farinacci wrote:

> A description of the design issue:
>
> (4) Add text in a new subsection of section 6.1.5 about dealing with
>   Map-Replies with coarse EID-prefixes.
>
> As mentioned in the Hiroshima IETF, an ETR could return a Map-Reply  
> with a coarse EID-prefix. One that is shorter in mask-length than  
> what was allocated to it. Even if it is registered properly with the  
> mapping system, there can be a bug, a compromise, or an inadvertent  
> configuration to cause the Map-Reply to have a shorter mask-length  
> then what was registered.
>
> To fix this, there can be two possible solutions, one is proxy Map- 
> Replying by a Map-Server on behalf of the ETRs for the registering  
> site and ITRs being configured to not accept EID-prefixes shorter  
> than a configured mask-length.
>
> Would anyone like to comment on this? We can propose text but there  
> may be other lightweight solutions to this. We would like to figure  
> a lightweight solution versus having a strong ITR-to-ETR  
> authentication mechanism which most probably would require third- 
> party systems.
>
> Thanks,
> Dino/Darrel
>