Subject: [lisp] Versioning, I don't think we need to disable source versioning when we have no destination version.

From: Jesper Skriver <[email-masked]>
Date: Wed, 30 Mar 2011 14:41:50 +0300

Luigi,

draft-ietf-lisp-map-versioning-01 section 4.1 reads

   The other use of the Null Map-Version number is in the Map Records,
   which are part of the Map-Request, Map-Reply and Map-Register
   messages (defined in [I-D.ietf-lisp]).  Map Records that have a Null
   Map-Version number indicate that there is no Map-Version number
   associated with the mapping.  This means that LISP encapsulated
   packets, destined to the EID-Prefix the Map Record refers to, MUST
   NOT contain Map-Version numbers (i.e., V bit MUST always be 0).  In
   other words, the Null Map-Version number signals to the ITR using the
   mapping that the Map-Versioning is not supported, or even if
   supported it MUST NOT be used for that specific EID-Prefix.  Any
   value different from zero means that Map-Versioning is supported and
   MAY be used.

I think that the use of "MUST NOT" is too strict here, even if an ETR returned a Null Map-Version number in a Map Record to an ITR, there is still value in using source versioning for traffic from the ITR to the ETR. The ETR may be able to check the source version number, and use versioning to update the reverse mapping.

So I suggest changing this text to

   The other use of the Null Map-Version number is in the Map Records,
   which are part of the Map-Request, Map-Reply and Map-Register
   messages (defined in [I-D.ietf-lisp]).  Map Records that have a Null
   Map-Version number indicate that there is no Map-Version number
   associated with the mapping.  This means that LISP encapsulated
   packets, destined to the EID-Prefix the Map Record refers to, MUST
   either not contain any Map-Version numbers (V bit set to 0), or if
   it contains Map-Version numbers (V bit set to 1) then the destination
   Map-Version number MUST be set to the Null Map-Version number.

/Jesper

---

From: Damien Saucez <[email-masked]>
Date: Wed, 30 Mar 2011 13:49:52 +0200

Hello,

>   Map-Version number MUST be set to the Null Map-Version number.

Ok, but before we have to check what it means for security

Damien Saucez

> /Jesper
> 
> 
> 
> 
> _______________________________________________
> lisp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/lisp

---

From: Jesper Skriver <[email-masked]>
Date: Thu, 31 Mar 2011 10:32:01 +0300

Hi Damien,

> Ok, but before we have to check what it means for security

I don't think it should have any effect on security.

If the ETR doesn't support versioning, it will ignore the version in the LISP header regardless if the V bit is set or not.

If the ETR does support versioning, it MAY verify that it has an up to date reverse mapping by checking the source version number in the LISP header against what it got cached.

/Jesper

/Jesper

---

From: Luigi Iannone <[email-masked]>
Date: Thu, 31 Mar 2011 11:13:38 +0200

Hi Jesper,

As I said during the presentation, we ourselves were suspecting  of being too restrictive. 

On the security side, I do not think there is any issue.  If the ETR does not support versioning there is no attack that can be mounted with allowing to send the source map version. If the ETR does support versioning and decides to verify the source map version, then we are in normal map-version use case and existing security consideration apply.

Thanks you very much for proposing text.

Luigi