
From nobody Tue May  6 08:39:45 2014
Return-Path: <farinacci@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C4FE1A038C for <lisp@ietfa.amsl.com>; Tue,  6 May 2014 08:39:32 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 4.613
X-Spam-Level: ****
X-Spam-Status: No, score=4.613 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, FILL_THIS_FORM=0.001, FREEMAIL_FROM=0.001, HTML_COMMENT_SAVED_URL=1.391, HTML_MESSAGE=0.001, MANGLED_LIPS=2.3, SPF_PASS=-0.001, T_DKIM_INVALID=0.01, T_HTML_ATTACH=0.01] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T_VXEcycssYc for <lisp@ietfa.amsl.com>; Tue,  6 May 2014 08:39:22 -0700 (PDT)
Received: from mail-pa0-x236.google.com (mail-pa0-x236.google.com [IPv6:2607:f8b0:400e:c03::236]) by ietfa.amsl.com (Postfix) with ESMTP id 28BE01A0859 for <lisp@ietf.org>; Tue,  6 May 2014 08:39:22 -0700 (PDT)
Received: by mail-pa0-f54.google.com with SMTP id lf10so11335787pab.41 for <lisp@ietf.org>; Tue, 06 May 2014 08:39:18 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=from:content-type:subject:date:message-id:cc:to:mime-version;  bh=UsyPk9JYDBeeuhFVRXoKAbSDK3bvI2hyFnXzD1OZlmw=; b=oWtn2f1akRzOJh2qa0UOLmOEuR5ALsCkfxquC8yHJSsktKksYRLsGKW0CuUYD9Lkhc QXZzra//Qvmrwqxuo2LkVD2qdQ0FPDOu7dQOfrLObPuF9+b3/7r8PVEm5fCzC+i6sykW BpZ7OUXYyDdlpPhNvHBldCTLYUjyGWMCTJB8K7swOWhaFAhLopvtV8mWbD9IZbeScYHE HjsBRjuArss6bd8+GfPBGP8twTZ+1dHXD2R2gGdA2OWEGPUe7yDLNCMGUyp2wowYsfAj Gu5TUO7ZkKQXWnc+hPIF+CvheU52o+KPmInmd3K/Y7ptrMWwGMzNHiCz1ogr9EjbZLma jrEQ==
X-Received: by 10.66.240.70 with SMTP id vy6mr7590229pac.80.1399390758035; Tue, 06 May 2014 08:39:18 -0700 (PDT)
Received: from [192.168.5.249] (ip-64-134-235-33.public.wayport.net. [64.134.235.33]) by mx.google.com with ESMTPSA id ba5sm1065476pbc.61.2014.05.06.08.39.05 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 06 May 2014 08:39:13 -0700 (PDT)
From: Dino Farinacci <farinacci@gmail.com>
Content-Type: multipart/mixed; boundary="Apple-Mail=_3BC4A146-4E67-4245-89D0-CEAF46C4FA3F"
Date: Tue, 6 May 2014 08:38:59 -0700
Message-Id: <19D545A3-99D4-4DA7-87DD-740A17E1BAA3@gmail.com>
To: LISP mailing list list <lisp@ietf.org>
Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\))
X-Mailer: Apple Mail (2.1874)
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/Mkts7uyGdOHHeaqaXIBrlxNcx10
Cc: David Meyer <dmm@1-4-5.net>
Subject: [lisp] New update to draft-ietf-lisp-lcaf
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 06 May 2014 15:39:32 -0000

--Apple-Mail=_3BC4A146-4E67-4245-89D0-CEAF46C4FA3F
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

The JSON advocates needed a length field to describe the JSON payload. =
See diffs attached.

Dino


--Apple-Mail=_3BC4A146-4E67-4245-89D0-CEAF46C4FA3F
Content-Disposition: attachment;
	filename=rfcdiff-lisp-lcaf-04-to-05.html
Content-Type: text/html;
	x-unix-mode=0644;
	name="rfcdiff-lisp-lcaf-04-to-05.html"
Content-Transfer-Encoding: quoted-printable


<!-- saved from url=3D(0029)http://tools.ietf.org/rfcdiff -->
<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3DISO-8859-1"><title>wdiff draft-ietf-lisp-lcaf-04.txt =
draft-ietf-lisp-lcaf-05.txt</title></head><body>
<pre>
Network Working Group                                       D. Farinacci
Internet-Draft                                               lispers.net
Intended status: Experimental                                   D. Meyer
Expires: <strike><font color=3D"red">July 31,</font></strike> =
<strong><font color=3D"green">November 7,</font></strong> 2014           =
                             Brocade
                                                             J. Snijders
                                                       Hibernia Networks
                                                        <strike><font =
color=3D"red">January 27,</font></strike>
                                                             =
<strong><font color=3D"green">May 6,</font></strong> 2014

                  LISP Canonical Address Format (LCAF)
                        <strike><font =
color=3D"red">draft-ietf-lisp-lcaf-04</font></strike>
                        <strong><font =
color=3D"green">draft-ietf-lisp-lcaf-05</font></strong>

Abstract

   This draft defines a canonical address format encoding used in LISP
   control messages and in the encoding of lookup keys for the LISP
   Mapping Database System.

Status of this Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on <strike><font color=3D"red">July =
31,</font></strike> <strong><font color=3D"green">November =
7,</font></strong> 2014.

Copyright Notice

   Copyright (c) 2014 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
   2.  Definition of Terms  . . . . . . . . . . . . . . . . . . . . .  4
   3.  LISP Canonical Address Format Encodings  . . . . . . . . . . .  5
   4.  LISP Canonical Address Applications  . . . . . . . . . . . . .  7
     4.1.  Segmentation using LISP  . . . . . . . . . . . . . . . . .  7
     4.2.  Carrying AS Numbers in the Mapping Database  . . . . . . .  8
     4.3.  Convey Application Specific Data . . . . . . . . . . . . .  9
     4.4.  Assigning Geo Coordinates to Locator Addresses . . . . . . 10
     4.5.  Generic Database Mapping Lookups . . . . . . . . . . . . . 12
     4.6.  NAT Traversal Scenarios  . . . . . . . . . . . . . . . . . 13
     4.7.  PETR Admission Control Functionality . . . . . . . . . . . 15
     4.8.  Multicast Group Membership Information . . . . . . . . . . 16
     4.9.  Traffic Engineering using Re-encapsulating Tunnels . . . . 18
     4.10. Storing Security Data in the Mapping Database  . . . . . . 19
     4.11. Source/Destination 2-Tuple Lookups . . . . . . . . . . . . 20
     4.12. Replication List Entries for Multicast Forwarding  . . . . 21
     4.13. Data Model Encoding  . . . . . . . . . . . . . . . . . . . 22
     4.14. Encoding Key/Value Address Pairs . . . . . . . . . . . . . 23
     4.15. Applications for AFI List Type . . . . . . . . . . . . . . 23
       4.15.1.  Binding IPv4 and IPv6 Addresses . . . . . . . . . . . 23
       4.15.2.  Layer-2 VPNs  . . . . . . . . . . . . . . . . . . . . 25
       4.15.3.  ASCII Names in the Mapping Database . . . . . . . . . 25
       4.15.4.  Using Recursive LISP Canonical Address Encodings  . . 26
       4.15.5.  Compatibility Mode Use Case . . . . . . . . . . . . . 27
   5.  Security Considerations  . . . . . . . . . . . . . . . . . . . 28
   6.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 29
   7.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 30
     7.1.  Normative References . . . . . . . . . . . . . . . . . . . 30
     7.2.  Informative References . . . . . . . . . . . . . . . . . . 30
   Appendix A.  Acknowledgments . . . . . . . . . . . . . . . . . . . 32
   Appendix B.  Document Change Log . . . . . . . . . . . . . . . . . 33
     B.1.  Changes to <strike><font =
color=3D"red">draft-ietf-lisp-lcaf-04.txt</font></strike> <strong><font =
color=3D"green">draft-ietf-lisp-lcaf-05.txt</font></strong> . . . . . . =
. . . . 33
     B.2.  Changes to <strike><font =
color=3D"red">draft-ietf-lisp-lcaf-03.txt</font></strike> <strong><font =
color=3D"green">draft-ietf-lisp-lcaf-04.txt</font></strong> . . . . . . =
. . . . 33
     B.3.  Changes to <strike><font =
color=3D"red">draft-ietf-lisp-lcaf-02.txt</font></strike> <strong><font =
color=3D"green">draft-ietf-lisp-lcaf-03.txt</font></strong> . . . . . . =
. . . . 33
     B.4.  Changes to <strike><font =
color=3D"red">draft-ietf-lisp-lcaf-01.txt</font></strike> <strong><font =
color=3D"green">draft-ietf-lisp-lcaf-02.txt</font></strong> . . . . . . =
. . . . 33
     B.5.  Changes to <strike><font =
color=3D"red">draft-ietf-lisp-lcaf-00.txt</font></strike> <strong><font =
color=3D"green">draft-ietf-lisp-lcaf-01.txt</font></strong> . . . . . . =
. . . . 33
     <strong><font color=3D"green">B.6.  Changes to =
draft-ietf-lisp-lcaf-00.txt . . . . . . . . . . 34</font></strong>
   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 35

1.  Introduction

   The LISP architecture and protocols [RFC6830] introduces two new
   numbering spaces, Endpoint Identifiers (EIDs) and Routing Locators
   (RLOCs) which are intended to replace most use of IP addresses on the
   Internet.  To provide flexibility for current and future
   applications, these values can be encoded in LISP control messages
   using a general syntax that includes Address Family Identifier (AFI),
   length, and value fields.

   Currently defined AFIs include IPv4 and IPv6 addresses, which are
   formatted according to code-points assigned in [AFI] as follows:

   IPv4 Encoded Address:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            AFI =3D 1            |       IPv4 Address ...        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     ...  IPv4 Address         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   IPv6 Encoded Address:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            AFI =3D 2            |       IPv6 Address ...        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                     ...  IPv6 Address  ...                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                     ...  IPv6 Address  ...                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                     ...  IPv6 Address  ...                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     ...  IPv6 Address         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   This document describes the currently-defined AFIs the LISP protocol
   uses along with their encodings and introduces the LISP Canonical
   Address Format (LCAF) that can be used to define the LISP-specific
   encodings for arbitrary AFI values.

2.  Definition of Terms

   Address Family Identifier (AFI):  a term used to describe an address
      encoding in a packet.  An address family currently defined for
      IPv4 or IPv6 addresses.  See [AFI] and [RFC1700] for details.  The
      reserved AFI value of 0 is used in this specification to indicate
      an unspecified encoded address where the the length of the address
      is 0 bytes following the 16-bit AFI value of 0.

   Unspecified Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            AFI =3D 0            |    &lt;nothing follows AFI=3D0&gt;=
    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Endpoint ID (EID):   a 32-bit (for IPv4) or 128-bit (for IPv6) value
      used in the source and destination address fields of the first
      (most inner) LISP header of a packet.  The host obtains a
      destination EID the same way it obtains a destination address
      today, for example through a DNS lookup or SIP exchange.  The
      source EID is obtained via existing mechanisms used to set a
      host's "local" IP address.  An EID is allocated to a host from an
      EID-prefix block associated with the site where the host is
      located.  An EID can be used by a host to refer to other hosts.

   Routing Locator (RLOC):   the IPv4 or IPv6 address of an egress
      tunnel router (ETR).  It is the output of a EID-to-RLOC mapping
      lookup.  An EID maps to one or more RLOCs.  Typically, RLOCs are
      numbered from topologically aggregatable blocks that are assigned
      to a site at each point to which it attaches to the global
      Internet; where the topology is defined by the connectivity of
      provider networks, RLOCs can be thought of as PA addresses.
      Multiple RLOCs can be assigned to the same ETR device or to
      multiple ETR devices at a site.

3.  LISP Canonical Address Format Encodings

   IANA has assigned AFI value 16387 (0x4003) to the LISP architecture
   and protocols.  This specification defines the encoding format of the
   LISP Canonical Address (LCA).

   The first 4 bytes of an LISP Canonical Address are followed by a
   variable length of fields:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |    Type       |     Rsvd2     |            Length             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Rsvd1:  this 8-bit field is reserved for future use and MUST be
      transmitted as 0 and ignored on receipt.

   Flags:  this 8-bit field is for future definition and use.  For now,
      set to zero on transmission and ignored on receipt.

   Type:  this 8-bit field is specific to the LISP Canonical Address
      formatted encodings, values are:

     Type 0:  Null Body Type

     Type 1:  AFI List Type

     Type 2:  Instance ID Type

     Type 3:  AS Number Type

     Type 4:  Application Data Type

     Type 5:  Geo Coordinates Type

     Type 6:  Opaque Key Type

     Type 7:  NAT-Traversal Type

     Type 8:  Nonce Locator Type

     Type 9:  Multicast Info Type
     Type 10:  Explicit Locator Path Type

     Type 11:  Security Key Type

     Type 12:  Source/Dest Key Type

     Type 13:  Replication List Entry Type

     Type 14:  JSON Data Model Type

     Type 15:  Key/Value Address Pair Type

   Rsvd2:  this 8-bit field is reserved for future use and MUST be
      transmitted as 0 and ignored on receipt.

   Length:  this 16-bit field is in units of bytes and covers all of the
      LISP Canonical Address payload, starting and including the byte
      after the Length field.  So any LCAF encoded address will have a
      minimum length of 8 bytes when the Length field is 0.  The 8 bytes
      include the AFI, Flags, Type, Reserved, and Length fields.  When
      the AFI is not next to encoded address in a control message, then
      the encoded address will have a minimum length of 6 bytes when the
      Length field is 0.  The 6 bytes include the Flags, Type, Reserved,
      and Length fields.

4.  LISP Canonical Address Applications

4.1.  Segmentation using LISP

   When multiple organizations inside of a LISP site are using private
   addresses [RFC1918] as EID-prefixes, their address spaces must remain
   segregated due to possible address duplication.  An Instance ID in
   the address encoding can aid in making the entire AFI based address
   unique.

   Another use for the Instance ID LISP Canonical Address Format is when
   creating multiple segmented VPNs inside of a LISP site where keeping
   EID-prefix based subnets is desirable.

   Instance ID LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 2    | IID mask-len  |             4 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                         Instance ID                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |         Address  ...          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   IID mask-len:  if the AFI is set to 0, then this format is not
      encoding an extended EID-prefix but rather an instance-ID range
      where the 'IID mask-len' indicates the number of high-order bits
      used in the Instance ID field for the range.

   Length value n:  length in bytes of the AFI address that follows the
      Instance ID field including the AFI field itself.

   Instance ID:  the low-order 24-bits that can go into a LISP data
      header when the I-bit is set.  See [RFC6830] for details.

   AFI =3D x:  x can be any AFI value from [AFI].

   This LISP Canonical Address Type can be used to encode either EID or
   RLOC addresses.

4.2.  Carrying AS Numbers in the Mapping Database

   When an AS number is stored in the LISP Mapping Database System for
   either policy or documentation reasons, it can be encoded in a LISP
   Canonical Address.

   AS Number LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 3    |     Rsvd2     |             4 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                           AS Number                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |         Address  ...          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of the AFI address that follows the
      AS Number field including the AFI field itself.

   AS Number:  the 32-bit AS number of the autonomous system that has
      been assigned either the EID or RLOC that follows.

   AFI =3D x:  x can be any AFI value from [AFI].

   The AS Number Canonical Address Type can be used to encode either EID
   or RLOC addresses.  The former is used to describe the LISP-ALT AS
   number the EID-prefix for the site is being carried for.  The latter
   is used to describe the AS that is carrying RLOC based prefixes in
   the underlying routing system.

4.3.  Convey Application Specific Data

   When a locator-set needs to be conveyed based on the type of
   application or the Per-Hop Behavior (PHB) of a packet, the
   Application Data Type can be used.

   Application Data LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 4    |     Rsvd2     |             8 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       IP TOS, IPv6 TC, or Flow Label          |    Protocol   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |    Local Port (lower-range)   |    Local Port (upper-range)   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Remote Port (lower-range)   |   Remote Port (upper-range)   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |         Address  ...          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of the AFI address that follows the
      8-byte Application Data fields including the AFI field itself.

   IP TOS, IPv6 TC, or Flow Label:  this field stores the 8-bit IPv4 TOS
      field used in an IPv4 header, the 8-bit IPv6 Traffic Class or Flow
      Label used in an IPv6 header.

   Local Port/Remote Port Ranges:  these fields are from the TCP, UDP,
      or SCTP transport header.  A range can be specified by using a
      lower value and an upper value.  When a single port is encoded,
      the lower and upper value fields are the same.

   AFI =3D x:  x can be any AFI value from [AFI].

   The Application Data Canonical Address Type is used for an EID
   encoding when an ITR wants a locator-set for a specific application.
   When used for an RLOC encoding, the ETR is supplying a locator-set
   for each specific application is has been configured to advertise.

4.4.  Assigning Geo Coordinates to Locator Addresses

   If an ETR desires to send a Map-Reply describing the Geo Coordinates
   for each locator in its locator-set, it can use the Geo Coordinate
   Type to convey physical location information.

   Coordinates are specified using the WGS-84 (World Geodetic System)
   reference coordinate system [WGS-84].

   Geo Coordinate LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 5    |     Rsvd2     |            12 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |N|     Latitude Degrees        |    Minutes    |    Seconds    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |E|     Longitude Degrees       |    Minutes    |    Seconds    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                            Altitude                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |         Address  ...          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of the AFI address that follows the
      8-byte Longitude and Latitude fields including the AFI field
      itself.

   N: When set to 1 means North, otherwise South.

   Latitude Degrees:  Valid values range from 0 to 90 degrees above or
      below the equator (northern or southern hemisphere, respectively).

   Latitude Minutes:  Valid values range from 0 to 59.

   Latitude Seconds:  Valid values range from 0 to 59.

   E: When set to 1 means East, otherwise West.

   Longitude Degrees:  Value values are from 0 to 180 degrees right or
      left of the Prime Meridian.

   Longitude Minutes:  Valid values range from 0 to 59.

   Longitude Seconds:  Valid values range from 0 to 59.

   Altitude:  Height relative to sea level in meters.  This is a signed
      integer meaning that the altitude could be below sea level.  A
      value of 0x7fffffff indicates no Altitude value is encoded.

   AFI =3D x:  x can be any AFI value from [AFI].

   The Geo Coordinates Canonical Address Type can be used to encode
   either EID or RLOC addresses.  When used for EID encodings, you can
   determine the physical location of an EID along with the topological
   location by observing the locator-set.

4.5.  Generic Database Mapping Lookups

   When the LISP Mapping Database system holds information accessed by a
   generic formatted key (where the key is not the usual IPv4 or IPv6
   address), an opaque key may be desirable.

   Opaque Key LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 6    |     Rsvd2     |               n               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    | Key Field Num |      Key Wildcard Fields      |   Key . . .   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                       . . . Key                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of the type's payload.  The value n
      is the number of bytes that follow this Length field.

   Key Field Num:  the number of fields (minus 1) the key can be broken
      up into.  The width of the fields are fixed length.  So for a key
      size of 8 bytes, with a Key Field Num of 4 allows 4 fields of 2
      bytes in length.  Valid values for this field range from 0 to 15
      supporting a maximum of 16 field separations.

   Key Wildcard Fields:  describes which fields in the key are not used
      as part of the key lookup.  This wildcard encoding is a bitfield.
      Each bit is a don't-care bit for a corresponding field in the key.
      Bit 0 (the low-order bit) in this bitfield corresponds the first
      field, right-justified in the key, bit 1 the second field, and so
      on.  When a bit is set in the bitfield it is a don't-care bit and
      should not be considered as part of the database lookup.  When the
      entire 16-bits is set to 0, then all bits of the key are used for
      the database lookup.

   Key:  the variable length key used to do a LISP Database Mapping
      lookup.  The length of the key is the value n (shown above) minus
      3.

4.6.  NAT Traversal Scenarios

   When a LISP system is conveying global address and mapped port
   information when traversing through a NAT device, the NAT-Traversal
   LCAF Type is used.  See [LISP-NATT] for details.

   NAT-Traversal Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 7    |     Rsvd2     |             4 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       MS UDP Port Number      |      ETR UDP Port Number      |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |  Global ETR RLOC Address  ... |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |       MS RLOC Address  ...    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          | Private ETR RLOC Address  ... |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |      RTR RLOC Address 1 ...   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |      RTR RLOC Address k ...   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of the AFI addresses that follows
      the UDP Port Number field including the AFI fields themselves.

   MS UDP Port Number:  this is the UDP port number of the Map-Server
      and is set to 4342.

   ETR UDP Port Number:  this is the port number returned to a LISP
      system which was copied from the source port from a packet that
      has flowed through a NAT device.

   AFI =3D x:  x can be any AFI value from [AFI].

   Global ETR RLOC Address:  this is an address known to be globally
      unique built by NAT-traversal functionality in a LISP router.

   MS RLOC Address:  this is the address of the Map-Server used in the
      destination RLOC of a packet that has flowed through a NAT device.

   Private ETR RLOC Address:  this is an address known to be a private
      address inserted in this LCAF format by a LISP router that resides
      on the private side of a NAT device.

   RTR RLOC Address:  this is an encapsulation address used by an ITR or
      PITR which resides behind a NAT device.  This address is known to
      have state in a NAT device so packets can flow from it to the LISP
      ETR behind the NAT.  There can be one or more NTR addresses
      supplied in these set of fields.  The number of NTRs encoded is
      determined by the LCAF length field.  When there are no NTRs
      supplied, the NTR fields can be omitted and reflected by the LCAF
      length field or an AFI of 0 can be used to indicate zero NTRs
      encoded.

4.7.  PETR Admission Control Functionality

   When a public PETR device wants to verify who is encapsulating to it,
   it can check for a specific nonce value in the LISP encapsulated
   packet.  To convey the nonce to admitted ITRs or PITRs, this LCAF
   format is used in a Map-Register or Map-Reply locator-record.

   Nonce Locator Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 8    |     Rsvd2     |             4 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Reserved    |                  Nonce                        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |         Address  ...          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of the AFI address that follows the
      Nonce field including the AFI field itself.

   Reserved:  must be set to zero and ignore on receipt.

   Nonce:  this is a nonce value returned by an ETR in a Map-Reply
      locator-record to be used by an ITR or PITR when encapsulating to
      the locator address encoded in the AFI field of this LCAF type.

   AFI =3D x:  x can be any AFI value from [AFI].

4.8.  Multicast Group Membership Information

   Multicast group information can be published in the mapping database
   so a lookup on an EID based group address can return a replication
   list of group addresses or a unicast addresses for single replication
   or multiple head-end replications.  The intent of this type of
   unicast replication is to deliver packets to multiple ETRs at
   receiver LISP multicast sites.  The locator-set encoding for this EID
   record type can be a list of ETRs when they each register with "Merge
   Semantics".  The encoding can be a typical AFI encoded locator
   address.  When an RTR list is being registered (with multiple levels
   according to [LISP-RE]), the Replication List Entry LCAF type is used
   for locator encoding.

   This LCAF encoding can be used to send broadcast packets to all
   members of a subnet when each EIDs are away from their home subnet
   location.

   Multicast Info Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 9    |  Rsvd2  |R|L|J|             8 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                         Instance-ID                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            Reserved           | Source MaskLen| Group MaskLen |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |   Source/Subnet Address  ...  |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |       Group Address  ...      |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of fields that follow.

   Reserved:  must be set to zero and ignore on receipt.

   R-bit:  this is the RP-bit that represents PIM (S,G,RP-bit) multicast
      state.  This bit can be set for Joins (when the J-bit is set) or
      for Leaves (when the L-bit is set).  See [LISP-MRSIG] for more
      usage details.

   L-bit:  this is the Leave-Request bit and is used when this LCAF type
      is present in the destination EID-prefix field of a Map-Request.
      See [LISP-MRSIG] for details.

   J-bit:  this is the Join-Request bit and is used when this LCAF type
      is present in the destination EID-prefix field of a Map-Request.
      See [LISP-MRSIG] for details.  The J-bit MUST not be set when the
      L-bit is also set in the same LCAF block.  A receiver should not
      take any specific Join or Leave action when both bits are set.

   Instance ID:  the low-order 24-bits that can go into a LISP data
      header when the I-bit is set.  See [RFC6830] for details.  The use
      of the Instance-ID in this LCAF type is to associate a multicast
      forwarding entry for a given VPN.  The instance-ID describes the
      VPN and is registered to the mapping database system as a 3-tuple
      of (Instance-ID, S-prefix, G-prefix).

   Source MaskLen:  the mask length of the source prefix that follows.

   Group MaskLen:  the mask length of the group prefix that follows.

   AFI =3D x:  x can be any AFI value from [AFI].  When a specific AFI =
has
      its own encoding of a multicast address, this field must be either
      a group address or a broadcast address.

4.9.  Traffic Engineering using Re-encapsulating Tunnels

   For a given EID lookup into the mapping database, this LCAF format
   can be returned to provide a list of locators in an explicit re-
   encapsulation path.  See [LISP-TE] for details.

   Explicit Locator Path (ELP) Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 10   |     Rsvd2     |               n               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Rsvd3         |L|P|S|           AFI =3D x             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                         Reencap Hop 1  ...                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Rsvd3         |L|P|S|           AFI =3D x             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                         Reencap Hop k  ...                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of fields that follow.

   Lookup bit (L):  this is the Lookup bit used to indicate to the user
      of the ELP to not use this address for encapsulation but to look
      it up in the mapping database system to obtain an encapsulating
      RLOC address.

   RLOC-Probe bit (P):  this is the RLOC-probe bit which means the
      Reencap Hop allows RLOC-probe messages to be sent to it.  When the
      R-bit is set to 0, RLOC-probes must not be sent.  When a Reencap
      Hop is an anycast address then multiple physical Reencap Hops are
      using the same RLOC address.  In this case, RLOC-probes are not
      needed because when the closest RLOC address is not reachable
      another RLOC address can reachable.

   Strict bit (S):  this the strict bit which means the associated
      Rencap Hop is required to be used.  If this bit is 0, the
      reencapsulator can skip this Reencap Hop and go to the next one in
      the list.

   AFI =3D x:  x can be any AFI value from [AFI].  When a specific AFI =
has
      its own encoding of a multicast address, this field must be either
      a group address or a broadcast address.

4.10.  Storing Security Data in the Mapping Database

   When a locator in a locator-set has a security key associated with
   it, this LCAF format will be used to encode key material.  See
   [LISP-DDT] for details.

   Security Key Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 11   |      Rsvd2    |             6 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Key Count   |      Rsvd3    | Key Algorithm |   Rsvd4     |R|
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Key Length          |       Key Material ...        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                        ... Key Material                       |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |       Locator Address ...     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of fields that start with the Key
      Material field.

   Key Count:  the Key Count field declares the number of Key sections
      included in this LCAF.

   Key Algorithm:  the Algorithm field identifies the key's
      cryptographic algorithm and specifies the format of the Public Key
      field.

   R bit:  this is the revoke bit and, if set, it specifies that this
      Key is being Revoked.

   Key Length:  this field determines the length in bytes of the Key
      Material field.

   Key Material:  the Key Material field stores the key material.  The
      format of the key material stored depends on the Key Algorithm
      field.

   AFI =3D x:  x can be any AFI value from [AFI].This is the locator
      address that owns the encoded security key.

4.11.  Source/Destination 2-Tuple Lookups

   When both a source and destination address of a flow needs
   consideration for different locator-sets, this 2-tuple key is used in
   EID fields in LISP control messages.  When the Source/Dest key is
   registered to the mapping database, it can be encoded as a source-
   prefix and destination-prefix.  When the Source/Dest is used as a key
   for a mapping database lookup the source and destination come from a
   data packet.

   Source/Dest Key Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 12   |     Rsvd2     |             4 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            Reserved           |   Source-ML   |    Dest-ML    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |         Source-Prefix ...     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |     Destination-Prefix ...    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of fields that follow.

   Reserved:  must be set to zero and ignore on receipt.

   Source-ML:  the mask length of the source prefix that follows.

   Dest-ML:  the mask length of the destination prefix that follows.

   AFI =3D x:  x can be any AFI value from [AFI].  When a specific AFI =
has
      its own encoding of a multicast address, this field must be either
      a group address or a broadcast address.

   Refer to [LISP-TE] for usage details.

4.12.  Replication List Entries for Multicast Forwarding

   The Replication List Entry LCAF type is an encoding for a locator
   being used for unicast replication according to the specification in
   [LISP-RE].  This locator encoding is pointed to by a Multicast Info
   LCAF Type and is registered by Re-encapsulating Tunnel Routers (RTRs)
   that are participating in an overlay distribution tree.  Each RTR
   will register its locator address and its configured level in the
   distribution tree.

   Replication List Entry Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 13   |    Rsvd2      |             4 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              Rsvd3            |     Rsvd4     |  Level Value  |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |           RTR/ETR #1 ...      |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              Rsvd3            |     Rsvd4     |  Level Value  |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |           RTR/ETR  #n ...     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of fields that follow.

   Rsvd{1,2,3,4}:  must be set to zero and ignore on receipt.

   Level Value:  this value is associated with the level within the
      overlay distribution tree hierarchy where the RTR resides.  The
      level numbers are ordered from lowest value being close to the ITR
      (meaning that ITRs replicate to level-0 RTRs) and higher levels
      are further downstream on the distribution tree closer to ETRs of
      multicast receiver sites.

   AFI =3D x:  x can be any AFI value from [AFI].  A specific AFI has =
its
      own encoding of either a unicast or multicast locator address.
      All RTR/ETR entries for the same level should be combined together
      by a Map-Server to avoid searching through the entire multi-level
      list of locator entries in a Map-Reply message.

4.13.  Data Model Encoding

   This type allows a JSON data model to be encoded either as an EID or
   RLOC.

   JSON Data Model Type Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 14   |    Rsvd2    |B|               n               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           JSON <strike><font color=3D"red">binary or =
text</font></strike> <strong><font color=3D"green">length         | JSON =
binary/text</font></strong> encoding ... |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |       Optional Address ...    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of fields that follow.

   Rsvd{1,2}:  must be set to zero and ignore on receipt.

   B bit:  indicates that the JSON field is binary encoded according to
      [JSON-BINARY] when the bit is set to 1.  Otherwise the encoding is
      based on text encoding according to [RFC4627].

   JSON <strong><font color=3D"green">length:  length in octets of the =
following 'JSON binary/text
      encoding' field.

   JSON binary/text encoding</font></strong> field:  a variable length =
field that
      contains either binary or text encodings.

   AFI =3D x:  x can be any AFI value from [AFI].  A specific AFI has =
its
      own encoding of either a unicast or multicast locator address.
      All RTR/ETR entries for the same level should be combined together
      by a Map-Server to avoid searching through the entire multi-level
      list of locator entries in a Map-Reply message.

4.14.  Encoding Key/Value Address Pairs

   The Key/Value pair is for example useful for attaching attributes to
   other elements of LISP packets, such as EIDs or RLOCs.  When
   attaching attributes to EIDs or RLOCs, it's necessary to distinguish
   between the element that should be used as EID or RLOC, and hence as
   key for lookups, and additional attributes.  This is especially the
   case when the difference cannot be determined from the types of the
   elements, such as when two IP addresses are being used.

   Key/Value Pair Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 15   |     Rsvd2     |               n               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |       Address as Key ...      |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |       Address as Value ...    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of fields that follow.

   Rsvd{1,2}:  must be set to zero and ignore on receipt.

   AFI =3D x:  x can be any AFI value from [AFI].  A specific AFI has =
its
      own encoding of either a unicast or multicast locator address.
      All RTR/ETR entries for the same level should be combined together
      by a Map-Server to avoid searching through the entire multi-level
      list of locator entries in a Map-Reply message.

   Address as Key:  this AFI encoded address will be attached with the
      attributes encoded in "Address as Value" which follows this field.

   Address as Value:  this AFI encoded address will be the attribute
      address that goes along with "Address as Key" which precedes this
      field.

4.15.  Applications for AFI List Type

4.15.1.  Binding IPv4 and IPv6 Addresses

   When header translation between IPv4 and IPv6 is desirable a LISP
   Canonical Address can use the AFI List Type to carry multiple AFIs in
   one LCAF AFI.

   Address Binding LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 1    |     Rsvd2     |         2 + 4 + 2 + 16        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            AFI =3D 1            |       IPv4 Address ...        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     ...  IPv4 Address         |            AFI =3D 2            |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                          IPv6 Address ...                     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                     ...  IPv6 Address  ...                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                     ...  IPv6 Address  ...                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                     ...  IPv6 Address                         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length:  length in bytes is fixed at 24 when IPv4 and IPv6 AFI
      encoded addresses are used.

   This type of address format can be included in a Map-Request when the
   address is being used as an EID, but the Mapping Database System
   lookup destination can use only the IPv4 address.  This is so a
   Mapping Database Service Transport System, such as LISP-ALT
   [RFC6836], can use the Map-Request destination address to route the
   control message to the desired LISP site.

4.15.2.  Layer-2 VPNs

   When MAC addresses are stored in the LISP Mapping Database System,
   the AFI List Type can be used to carry AFI 6.

   MAC Address LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 1    |     Rsvd2     |             2 + 6             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |             AFI =3D 6           |    Layer-2 MAC Address  ...   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                    ... Layer-2 MAC Address                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length:  length in bytes is fixed at 8 when MAC address AFI encoded
      addresses are used.

   This address format can be used to connect layer-2 domains together
   using LISP over an IPv4 or IPv6 core network to create a layer-2 VPN.
   In this use-case, a MAC address is being used as an EID, and the
   locator-set that this EID maps to can be an IPv4 or IPv6 RLOCs, or
   even another MAC address being used as an RLOC.

4.15.3.  ASCII Names in the Mapping Database

   If DNS names or URIs are stored in the LISP Mapping Database System,
   the AFI List Type can be used to carry an ASCII string where it is
   delimited by length 'n' of the LCAF Length encoding.

   ASCII LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 1    |     Rsvd2     |             2 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |             AFI =3D 17          |      DNS Name or URI  ...     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes AFI=3D17 field and the =
null-terminated
      ASCII string (the last byte of 0 is included).

4.15.4.  Using Recursive LISP Canonical Address Encodings

   When any combination of above is desirable, the AFI List Type value
   can be used to carry within the LCAF AFI another LCAF AFI.

   Recursive LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 1    |     Rsvd2     |         4 + 8 + 2 + 4         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 4    |     Rsvd2     |              12               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   IP TOS, IPv6 QQS or Flow Label              |    Protocol   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Local Port          |         Remote Port           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            AFI =3D 1            |       IPv4 Address ...        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     ...  IPv4 Address         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length:  length in bytes is fixed at 18 when an AFI=3D1 IPv4 address =
is
      included.

   This format could be used by a Mapping Database Transport System,
   such as LISP-ALT [RFC6836], where the AFI=3D1 IPv4 address is used as
   an EID and placed in the Map-Request destination address by the
   sending LISP system.  The ALT system can deliver the Map-Request to
   the LISP destination site independent of the Application Data Type
   AFI payload values.  When this AFI is processed by the destination
   LISP site, it can return different locator-sets based on the type of
   application or level of service that is being requested.

4.15.5.  Compatibility Mode Use Case

   A LISP system should use the AFI List Type format when sending to
   LISP systems that do not support a particular LCAF Type used to
   encode locators.  This allows the receiving system to be able to
   parse a locator address for encapsulation purposes.  The list of AFIs
   in an AFI List LCAF Type has no semantic ordering and a receiver
   should parse each AFI element no matter what the ordering.

   Compatibility Mode Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 1    |     Rsvd2     |            22 + 6             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 5    |     Rsvd2     |            12 + 2             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |N|     Latitude Degrees        |    Minutes    |    Seconds    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |E|     Longitude Degrees       |    Minutes    |    Seconds    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                            Altitude                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D 0          |           AFI =3D 1             =
|
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                          IPv4 Address                         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   If a system does not recognized the Geo Coordinate LCAF Type that is
   accompanying a locator address, an encoder can include the Geo
   Coordinate LCAF Type embedded in a AFI List LCAF Type where the AFI
   in the Geo Coordinate LCAF is set to 0 and the AFI encoded next in
   the list is encoded with a valid AFI value to identify the locator
   address.

   A LISP system is required to support the AFI List LCAF Type to use
   this procedure.  It would skip over 10 bytes of the Geo Coordinate
   LCAF Type to get to the locator address encoding (an IPv4 locator
   address).  A LISP system that does support the Geo Coordinate LCAF
   Type can support parsing the locator address within the Geo
   Coordinate LCAF encoding or in the locator encoding that follows in
   the AFI List LCAF.

5.  Security Considerations

   There are no security considerations for this specification.  The
   security considerations are documented for the protocols that use
   LISP Canonical Addressing.  Refer to the those relevant
   specifications.

6.  IANA Considerations

   The Address Family AFI definitions from [AFI] only allocate code-
   points for the AFI value itself.  The length of the address or entity
   that follows is not defined and is implied based on conventional
   experience.  Where the LISP protocol uses LISP Canonical Addresses
   specifically, the address length definitions will be in this
   specification and take precedent over any other specification.

   An IANA Registry for LCAF Type values will be created.  The values
   that are considered for use by the main LISP specification [RFC6830]
   will be in the IANA Registry.  Other Type values used for
   experimentation will be defined and described in this document.

7.  References

7.1.  Normative References

   [RFC1700]  Reynolds, J. and J. Postel, "Assigned Numbers", RFC 1700,
              October 1994.

   [RFC1918]  Rekhter, Y., Moskowitz, R., Karrenberg, D., Groot, G., and
              E. Lear, "Address Allocation for Private Internets",
              BCP 5, RFC 1918, February 1996.

   [RFC4627]  Crockford, D., "The application/json Media Type for
              JavaScript Object Notation (JSON)", RFC 4627, July 2006.

   [RFC6830]  Farinacci, D., Fuller, V., Meyer, D., and D. Lewis, "The
              Locator/ID Separation Protocol (LISP)", RFC 6830,
              January 2013.

   [RFC6836]  Fuller, V., Farinacci, D., Meyer, D., and D. Lewis,
              "Locator/ID Separation Protocol Alternative Logical
              Topology (LISP+ALT)", RFC 6836, January 2013.

7.2.  Informative References

   [AFI]      IANA, "Address Family Identifier (AFIs)", ADDRESS FAMILY
              NUMBERS http://www.iana.org/numbers.html, Febuary 2007.

   [JSON-BINARY]
              "Universal Binary JSON Specification",
              URL http://ubjson.org.

   [LISP-DDT]
              Fuller, V., Lewis, D., and V. Ermagan, "LISP Delegated
              Database Tree", draft-ietf-lisp-ddt-01.txt (work in
              progress).

   [LISP-MRSIG]
              Farinacci, D. and M. Napierala, "LISP Control-Plane
              Multicast Signaling",
              draft-farinacci-lisp-mr-signaling-03.txt (work in
              progress).

   [LISP-NATT]
              Ermagan, V., Farinacci, D., Lewis, D., Skriver, J., Maino,
              F., and C. White, "NAT traversal for LISP",
              draft-ermagan-lisp-nat-traversal-03.txt (work in
              progress).

   [LISP-RE]  Coras, F., Cabellos-Aparicio, A., Domingo-Pascual, J.,
              Maino, F., and D. Farinacci, "LISP Replication
              Engineering", draft-coras-lisp-re-03.txt (work in
              progress).

   [LISP-TE]  Farinacci, D., Lahiri, P., and M. Kowal, "LISP Traffic
              Engineering Use-Cases", draft-farinacci-lisp-te-03.txt
              (work in progress).

   [WGS-84]   Geodesy and Geophysics Department, DoD., "World Geodetic
              System 1984", NIMA TR8350.2, January 2000, &lt;http://
              earth-info.nga.mil/GandG/publications/tr8350.2/
              wgs84fin.pdf&gt;.

Appendix A.  Acknowledgments

   The authors would like to thank Vince Fuller, Gregg Schudel, Jesper
   Skriver, Luigi Iannone, Isidor Kouvelas, and Sander Steffann for
   their technical and editorial commentary.

   The authors would like to thank Victor Moreno for discussions that
   lead to the definition of the Multicast Info LCAF type.

   The authors would like to thank Parantap Lahiri and Michael Kowal for
   discussions that lead to the definition of the Explicit Locator Path
   (ELP) LCAF type.

   The authors would like to thank Fabio Maino and Vina Ermagan for
   discussions that lead to the definition of the Security Key LCAF
   type.

   The authors would like to thank Albert Cabellos-Aparicio and Florin
   Coras for discussions that lead to the definition of the Replication
   List Entry LCAF type.

   Thanks goes to Michiel Blokzijl and Alberto Rodriguez-Natal for
   suggesting new LCAF types.

   Thanks also goes to Terry Manderson for assistance obtaining a LISP
   AFI value from IANA.

Appendix B.  Document Change Log

B.1.  Changes to <strong><font color=3D"green">draft-ietf-lisp-lcaf-05.txt=


   o  Submitted May 2014.

   o  Add a length field of the JSON payload that can be used for either
      binary or text encoding of JSON data.

B.2.  Changes to</font></strong> draft-ietf-lisp-lcaf-04.txt

   o  Submitted January 2014.

   o  Agreement among ELP implementors to have the AFI 16-bit field
      adjacent to the address.  This will make the encoding consistent
      with all other LCAF type address encodings.

<strike><font color=3D"red">B.2.</font></strike>

<strong><font color=3D"green">B.3.</font></strong>  Changes to =
draft-ietf-lisp-lcaf-03.txt

   o  Submitted September 2013.

   o  Updated references and author's affilations.

   o  Added Instance-ID to the Multicast Info Type so there is relative
      ease in parsing (S,G) entries within a VPN.

   o  Add port range encodings to the Application Data LCAF Type.

   o  Add a new JSON LCAF Type.

   o  Add Address Key/Value LCAF Type to allow attributes to be attached
      to an address.

<strike><font color=3D"red">B.3.</font></strike>

<strong><font color=3D"green">B.4.</font></strong>  Changes to =
draft-ietf-lisp-lcaf-02.txt

   o  Submitted March 2013.

   o  Added new LCAF Type "Replication List Entry" to support LISP
      replication engineering use-cases.

   o  Changed references to new LISP RFCs.

<strike><font color=3D"red">B.4.</font></strike>

<strong><font color=3D"green">B.5.</font></strong>  Changes to =
draft-ietf-lisp-lcaf-01.txt

   o  Submitted January 2013.

   o  Change longitude range from 0-90 to 0-180 in section 4.4.

   o  Added reference to WGS-84 in section 4.4.

<strike><font color=3D"red">B.5.</font></strike>

<strong><font color=3D"green">B.6.</font></strong>  Changes to =
draft-ietf-lisp-lcaf-00.txt

   o  Posted first working group draft August 2012.

   o  This draft was renamed from draft-farinacci-lisp-lcaf-10.txt.

Authors' Addresses

   Dino Farinacci
   lispers.net
   San Jose, CA
   USA

   Email: farinacci@gmail.com

   Dave Meyer
   Brocade
   San Jose, CA
   USA

   Email: dmm@1-4-5.net

   Job Snijders
   Hibernia Networks
   Tupolevlaan 103a
   Schiphol-Rijk,   1119 PA
   NL

   Email: job.snijders@hibernianetworks.com
</pre>

X-Generator: pyht 0.35

<!-- args: {'--oldcolour': 'red', '--width': '', 'difftype': '--hwdiff', =
'filename2': '\n\n\nNetwork Working Group                                =
       D. Farinacci\nInternet-Draft                                      =
         lispers.net\nIntended status: Experimental                      =
             D. Meyer\nExpires: November 7, 2014                         =
               Brocade\n                                                 =
            J. Snijders\n                                                =
       Hibernia Networks\n                                               =
              May 6, 2014\n\n\n                  LISP Canonical Address =
Format (LCAF)\n                        =
draft-ietf-lisp-lcaf-05\n\nAbstract\n\n   This draft defines a canonical =
address format encoding used in LISP\n   control messages and in the =
encoding of lookup keys for the LISP\n   Mapping Database =
System.\n\nStatus of this Memo\n\n   This Internet-Draft is submitted in =
full conformance with the\n   provisions of BCP 78 and BCP 79.\n\n   =
Internet-Drafts are working documents of the Internet Engineering\n   =
Task Force (IETF).  Note that other groups may also distribute\n   =
working documents as Internet-Drafts.  The list of current Internet-\n   =
Drafts is at http://datatracker.ietf.org/drafts/current/.\n\n   =
Internet-Drafts are draft documents valid for a maximum of six months\n  =
 and may be updated, replaced, or obsoleted by other documents at any\n  =
 time.  It is inappropriate to use Internet-Drafts as reference\n   =
material or to cite them other than as "work in progress."\n\n   This =
Internet-Draft will expire on November 7, 2014.\n\nCopyright Notice\n\n  =
 Copyright (c) 2014 IETF Trust and the persons identified as the\n   =
document authors.  All rights reserved.\n\n   This document is subject =
to BCP 78 and the IETF Trust\'s Legal\n   Provisions Relating to IETF =
Documents\n   (http://trustee.ietf.org/license-info) in effect on the =
date of\n   publication of this document.  Please review these =
documents\n   carefully, as they describe your rights and restrictions =
with respect\n   to this document.  Code Components extracted from this =
document must\n   include Simplified BSD License text as described in =
Section 4.e of\n   the Trust Legal Provisions and are provided without =
warranty as\n\n\n\nFarinacci, et al.       Expires November 7, 2014      =
          [Page 1]\n_\nInternet-Draft    LISP Canonical Address Format =
(LCAF)          May 2014\n\n\n   described in the Simplified BSD =
License.\n\n\nTable of Contents\n\n   1.  Introduction . . . . . . . . . =
. . . . . . . . . . . . . . . .  3\n   2.  Definition of Terms  . . . . =
. . . . . . . . . . . . . . . . .  4\n   3.  LISP Canonical Address =
Format Encodings  . . . . . . . . . . .  5\n   4.  LISP Canonical =
Address Applications  . . . . . . . . . . . . .  7\n     4.1.  =
Segmentation using LISP  . . . . . . . . . . . . . . . . .  7\n     4.2. =
 Carrying AS Numbers in the Mapping Database  . . . . . . .  8\n     =
4.3.  Convey Application Specific Data . . . . . . . . . . . . .  9\n    =
 4.4.  Assigning Geo Coordinates to Locator Addresses . . . . . . 10\n   =
  4.5.  Generic Database Mapping Lookups . . . . . . . . . . . . . 12\n  =
   4.6.  NAT Traversal Scenarios  . . . . . . . . . . . . . . . . . 13\n =
    4.7.  PETR Admission Control Functionality . . . . . . . . . . . =
15\n     4.8.  Multicast Group Membership Information . . . . . . . . . =
. 16\n     4.9.  Traffic Engineering using Re-encapsulating Tunnels . . =
. . 18\n     4.10. Storing Security Data in the Mapping Database  . . . =
. . . 19\n     4.11. Source/Destination 2-Tuple Lookups . . . . . . . . =
. . . . 20\n     4.12. Replication List Entries for Multicast Forwarding =
 . . . . 21\n     4.13. Data Model Encoding  . . . . . . . . . . . . . . =
. . . . . 22\n     4.14. Encoding Key/Value Address Pairs . . . . . . . =
. . . . . . 23\n     4.15. Applications for AFI List Type . . . . . . . =
. . . . . . . 23\n       4.15.1.  Binding IPv4 and IPv6 Addresses . . . =
. . . . . . . . 23\n       4.15.2.  Layer-2 VPNs  . . . . . . . . . . . =
. . . . . . . . . 25\n       4.15.3.  ASCII Names in the Mapping =
Database . . . . . . . . . 25\n       4.15.4.  Using Recursive LISP =
Canonical Address Encodings  . . 26\n       4.15.5.  Compatibility Mode =
Use Case . . . . . . . . . . . . . 27\n   5.  Security Considerations  . =
. . . . . . . . . . . . . . . . . . 28\n   6.  IANA Considerations  . . =
. . . . . . . . . . . . . . . . . . . 29\n   7.  References . . . . . . =
. . . . . . . . . . . . . . . . . . . . 30\n     7.1.  Normative =
References . . . . . . . . . . . . . . . . . . . 30\n     7.2.  =
Informative References . . . . . . . . . . . . . . . . . . 30\n   =
Appendix A.  Acknowledgments . . . . . . . . . . . . . . . . . . . 32\n  =
 Appendix B.  Document Change Log . . . . . . . . . . . . . . . . . 33\n =
    B.1.  Changes to draft-ietf-lisp-lcaf-05.txt . . . . . . . . . . =
33\n     B.2.  Changes to draft-ietf-lisp-lcaf-04.txt . . . . . . . . . =
. 33\n     B.3.  Changes to draft-ietf-lisp-lcaf-03.txt . . . . . . . . =
. . 33\n     B.4.  Changes to draft-ietf-lisp-lcaf-02.txt . . . . . . . =
. . . 33\n     B.5.  Changes to draft-ietf-lisp-lcaf-01.txt . . . . . . =
. . . . 33\n     B.6.  Changes to draft-ietf-lisp-lcaf-00.txt . . . . . =
. . . . . 34\n   Authors\' Addresses . . . . . . . . . . . . . . . . . . =
. . . . . . 35\n\n\n\n\n\n\n\n\nFarinacci, et al.       Expires November =
7, 2014                [Page 2]\n_\nInternet-Draft    LISP Canonical =
Address Format (LCAF)          May 2014\n\n\n1.  Introduction\n\n   The =
LISP architecture and protocols [RFC6830] introduces two new\n   =
numbering spaces, Endpoint Identifiers (EIDs) and Routing Locators\n   =
(RLOCs) which are intended to replace most use of IP addresses on the\n  =
 Internet.  To provide flexibility for current and future\n   =
applications, these values can be encoded in LISP control messages\n   =
using a general syntax that includes Address Family Identifier (AFI),\n  =
 length, and value fields.\n\n   Currently defined AFIs include IPv4 and =
IPv6 addresses, which are\n   formatted according to code-points =
assigned in [AFI] as follows:\n\n   IPv4 Encoded Address:\n\n     0      =
             1                   2                   3\n     0 1 2 3 4 5 =
6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
           AFI =3D 1            _       IPv4 Address ...        _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
    ...  IPv4 Address         _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   IPv6 Encoded Address:\n\n     0  =
                 1                   2                   3\n     0 1 2 3 =
4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
           AFI =3D 2            _       IPv6 Address ...        _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                    ...  IPv6 Address  ...                    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                    ...  IPv6 Address  ...                    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                    ...  IPv6 Address  ...                    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
    ...  IPv6 Address         _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   This document describes the =
currently-defined AFIs the LISP protocol\n   uses along with their =
encodings and introduces the LISP Canonical\n   Address Format (LCAF) =
that can be used to define the LISP-specific\n   encodings for arbitrary =
AFI values.\n\n\n\n\n\n\n\n\nFarinacci, et al.       Expires November 7, =
2014                [Page 3]\n_\nInternet-Draft    LISP Canonical =
Address Format (LCAF)          May 2014\n\n\n2.  Definition of Terms\n\n =
  Address Family Identifier (AFI):  a term used to describe an address\n =
     encoding in a packet.  An address family currently defined for\n    =
  IPv4 or IPv6 addresses.  See [AFI] and [RFC1700] for details.  The\n   =
   reserved AFI value of 0 is used in this specification to indicate\n   =
   an unspecified encoded address where the the length of the address\n  =
    is 0 bytes following the 16-bit AFI value of 0.\n\n   Unspecified =
Address Format:\n\n     0                   1                   2        =
           3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 =
7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
           AFI =3D 0            _    _nothing follows AFI=3D0_    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Endpoint ID (EID):   a 32-bit (for IPv4) or 128-bit (for IPv6) value\n   =
   used in the source and destination address fields of the first\n      =
(most inner) LISP header of a packet.  The host obtains a\n      =
destination EID the same way it obtains a destination address\n      =
today, for example through a DNS lookup or SIP exchange.  The\n      =
source EID is obtained via existing mechanisms used to set a\n      =
host\'s "local" IP address.  An EID is allocated to a host from an\n     =
 EID-prefix block associated with the site where the host is\n      =
located.  An EID can be used by a host to refer to other hosts.\n\n   =
Routing Locator (RLOC):   the IPv4 or IPv6 address of an egress\n      =
tunnel router (ETR).  It is the output of a EID-to-RLOC mapping\n      =
lookup.  An EID maps to one or more RLOCs.  Typically, RLOCs are\n      =
numbered from topologically aggregatable blocks that are assigned\n      =
to a site at each point to which it attaches to the global\n      =
Internet; where the topology is defined by the connectivity of\n      =
provider networks, RLOCs can be thought of as PA addresses.\n      =
Multiple RLOCs can be assigned to the same ETR device or to\n      =
multiple ETR devices at a =
site.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nFarinacci, et al.       Expires =
November 7, 2014                [Page 4]\n_\nInternet-Draft    LISP =
Canonical Address Format (LCAF)          May 2014\n\n\n3.  LISP =
Canonical Address Format Encodings\n\n   IANA has assigned AFI value =
16387 (0x4003) to the LISP architecture\n   and protocols.  This =
specification defines the encoding format of the\n   LISP Canonical =
Address (LCA).\n\n   The first 4 bytes of an LISP Canonical Address are =
followed by a\n   variable length of fields:\n\n     0                   =
1                   2                   3\n     0 1 2 3 4 5 6 7 8 9 0 1 =
2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
   Type       _     Rsvd2     _            Length             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Rsvd1:  this 8-bit field is reserved for future use and MUST be\n      =
transmitted as 0 and ignored on receipt.\n\n   Flags:  this 8-bit field =
is for future definition and use.  For now,\n      set to zero on =
transmission and ignored on receipt.\n\n   Type:  this 8-bit field is =
specific to the LISP Canonical Address\n      formatted encodings, =
values are:\n\n     Type 0:  Null Body Type\n\n     Type 1:  AFI List =
Type\n\n     Type 2:  Instance ID Type\n\n     Type 3:  AS Number =
Type\n\n     Type 4:  Application Data Type\n\n     Type 5:  Geo =
Coordinates Type\n\n     Type 6:  Opaque Key Type\n\n     Type 7:  =
NAT-Traversal Type\n\n     Type 8:  Nonce Locator Type\n\n     Type 9:  =
Multicast Info Type\n\n\n\n\n\n\nFarinacci, et al.       Expires =
November 7, 2014                [Page 5]\n_\nInternet-Draft    LISP =
Canonical Address Format (LCAF)          May 2014\n\n\n     Type 10:  =
Explicit Locator Path Type\n\n     Type 11:  Security Key Type\n\n     =
Type 12:  Source/Dest Key Type\n\n     Type 13:  Replication List Entry =
Type\n\n     Type 14:  JSON Data Model Type\n\n     Type 15:  Key/Value =
Address Pair Type\n\n   Rsvd2:  this 8-bit field is reserved for future =
use and MUST be\n      transmitted as 0 and ignored on receipt.\n\n   =
Length:  this 16-bit field is in units of bytes and covers all of the\n  =
    LISP Canonical Address payload, starting and including the byte\n    =
  after the Length field.  So any LCAF encoded address will have a\n     =
 minimum length of 8 bytes when the Length field is 0.  The 8 bytes\n    =
  include the AFI, Flags, Type, Reserved, and Length fields.  When\n     =
 the AFI is not next to encoded address in a control message, then\n     =
 the encoded address will have a minimum length of 6 bytes when the\n    =
  Length field is 0.  The 6 bytes include the Flags, Type, Reserved,\n   =
   and Length =
fields.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nFarinacci, =
et al.       Expires November 7, 2014                [Page =
6]\n_\nInternet-Draft    LISP Canonical Address Format (LCAF)          =
May 2014\n\n\n4.  LISP Canonical Address Applications\n\n4.1.  =
Segmentation using LISP\n\n   When multiple organizations inside of a =
LISP site are using private\n   addresses [RFC1918] as EID-prefixes, =
their address spaces must remain\n   segregated due to possible address =
duplication.  An Instance ID in\n   the address encoding can aid in =
making the entire AFI based address\n   unique.\n\n   Another use for =
the Instance ID LISP Canonical Address Format is when\n   creating =
multiple segmented VPNs inside of a LISP site where keeping\n   =
EID-prefix based subnets is desirable.\n\n   Instance ID LISP Canonical =
Address Format:\n\n     0                   1                   2        =
           3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 =
7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 2    _ IID mask-len  _             4 + n             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                        Instance ID                           _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _         Address  ...          _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
IID mask-len:  if the AFI is set to 0, then this format is not\n      =
encoding an extended EID-prefix but rather an instance-ID range\n      =
where the \'IID mask-len\' indicates the number of high-order bits\n     =
 used in the Instance ID field for the range.\n\n   Length value n:  =
length in bytes of the AFI address that follows the\n      Instance ID =
field including the AFI field itself.\n\n   Instance ID:  the low-order =
24-bits that can go into a LISP data\n      header when the I-bit is =
set.  See [RFC6830] for details.\n\n   AFI =3D x:  x can be any AFI =
value from [AFI].\n\n   This LISP Canonical Address Type can be used to =
encode either EID or\n   RLOC addresses.\n\n\n\n\n\n\n\n\nFarinacci, et =
al.       Expires November 7, 2014                [Page =
7]\n_\nInternet-Draft    LISP Canonical Address Format (LCAF)          =
May 2014\n\n\n4.2.  Carrying AS Numbers in the Mapping Database\n\n   =
When an AS number is stored in the LISP Mapping Database System for\n   =
either policy or documentation reasons, it can be encoded in a LISP\n   =
Canonical Address.\n\n   AS Number LISP Canonical Address Format:\n\n    =
 0                   1                   2                   3\n     0 1 =
2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 3    _     Rsvd2     _             4 + n             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                          AS Number                           _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _         Address  ...          _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of the AFI address that follows the\n   =
   AS Number field including the AFI field itself.\n\n   AS Number:  the =
32-bit AS number of the autonomous system that has\n      been assigned =
either the EID or RLOC that follows.\n\n   AFI =3D x:  x can be any AFI =
value from [AFI].\n\n   The AS Number Canonical Address Type can be used =
to encode either EID\n   or RLOC addresses.  The former is used to =
describe the LISP-ALT AS\n   number the EID-prefix for the site is being =
carried for.  The latter\n   is used to describe the AS that is carrying =
RLOC based prefixes in\n   the underlying routing =
system.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nFarinacci, et al.       =
Expires November 7, 2014                [Page 8]\n_\nInternet-Draft    =
LISP Canonical Address Format (LCAF)          May 2014\n\n\n4.3.  Convey =
Application Specific Data\n\n   When a locator-set needs to be conveyed =
based on the type of\n   application or the Per-Hop Behavior (PHB) of a =
packet, the\n   Application Data Type can be used.\n\n   Application =
Data LISP Canonical Address Format:\n\n     0                   1        =
           2                   3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 =
7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 4    _     Rsvd2     _             8 + n             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
      IP TOS, IPv6 TC, or Flow Label          _    Protocol   _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
   Local Port (lower-range)   _    Local Port (upper-range)   _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Remote Port (lower-range)   _   Remote Port (upper-range)   _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _         Address  ...          _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of the AFI address that follows the\n   =
   8-byte Application Data fields including the AFI field itself.\n\n   =
IP TOS, IPv6 TC, or Flow Label:  this field stores the 8-bit IPv4 TOS\n  =
    field used in an IPv4 header, the 8-bit IPv6 Traffic Class or Flow\n =
     Label used in an IPv6 header.\n\n   Local Port/Remote Port Ranges:  =
these fields are from the TCP, UDP,\n      or SCTP transport header.  A =
range can be specified by using a\n      lower value and an upper value. =
 When a single port is encoded,\n      the lower and upper value fields =
are the same.\n\n   AFI =3D x:  x can be any AFI value from [AFI].\n\n   =
The Application Data Canonical Address Type is used for an EID\n   =
encoding when an ITR wants a locator-set for a specific application.\n   =
When used for an RLOC encoding, the ETR is supplying a locator-set\n   =
for each specific application is has been configured to =
advertise.\n\n\n\n\n\n\n\n\n\nFarinacci, et al.       Expires November =
7, 2014                [Page 9]\n_\nInternet-Draft    LISP Canonical =
Address Format (LCAF)          May 2014\n\n\n4.4.  Assigning Geo =
Coordinates to Locator Addresses\n\n   If an ETR desires to send a =
Map-Reply describing the Geo Coordinates\n   for each locator in its =
locator-set, it can use the Geo Coordinate\n   Type to convey physical =
location information.\n\n   Coordinates are specified using the WGS-84 =
(World Geodetic System)\n   reference coordinate system [WGS-84].\n\n   =
Geo Coordinate LISP Canonical Address Format:\n\n     0                  =
 1                   2                   3\n     0 1 2 3 4 5 6 7 8 9 0 1 =
2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 5    _     Rsvd2     _            12 + n             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    =
_N_     Latitude Degrees        _    Minutes    _    Seconds    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    =
_E_     Longitude Degrees       _    Minutes    _    Seconds    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                           Altitude                           _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _         Address  ...          _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of the AFI address that follows the\n   =
   8-byte Longitude and Latitude fields including the AFI field\n      =
itself.\n\n   N: When set to 1 means North, otherwise South.\n\n   =
Latitude Degrees:  Valid values range from 0 to 90 degrees above or\n    =
  below the equator (northern or southern hemisphere, respectively).\n\n =
  Latitude Minutes:  Valid values range from 0 to 59.\n\n   Latitude =
Seconds:  Valid values range from 0 to 59.\n\n   E: When set to 1 means =
East, otherwise West.\n\n   Longitude Degrees:  Value values are from 0 =
to 180 degrees right or\n      left of the Prime =
Meridian.\n\n\n\n\n\n\n\nFarinacci, et al.       Expires November 7, =
2014               [Page 10]\n_\nInternet-Draft    LISP Canonical =
Address Format (LCAF)          May 2014\n\n\n   Longitude Minutes:  =
Valid values range from 0 to 59.\n\n   Longitude Seconds:  Valid values =
range from 0 to 59.\n\n   Altitude:  Height relative to sea level in =
meters.  This is a signed\n      integer meaning that the altitude could =
be below sea level.  A\n      value of 0x7fffffff indicates no Altitude =
value is encoded.\n\n   AFI =3D x:  x can be any AFI value from =
[AFI].\n\n   The Geo Coordinates Canonical Address Type can be used to =
encode\n   either EID or RLOC addresses.  When used for EID encodings, =
you can\n   determine the physical location of an EID along with the =
topological\n   location by observing the =
locator-set.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n=
\n\n\n\n\n\n\nFarinacci, et al.       Expires November 7, 2014           =
    [Page 11]\n_\nInternet-Draft    LISP Canonical Address Format (LCAF) =
         May 2014\n\n\n4.5.  Generic Database Mapping Lookups\n\n   When =
the LISP Mapping Database system holds information accessed by a\n   =
generic formatted key (where the key is not the usual IPv4 or IPv6\n   =
address), an opaque key may be desirable.\n\n   Opaque Key LISP =
Canonical Address Format:\n\n     0                   1                  =
 2                   3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 =
2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 6    _     Rsvd2     _               n               _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
Key Field Num _      Key Wildcard Fields      _   Key . . .   _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                      . . . Key                               _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of the type\'s payload.  The value n\n  =
    is the number of bytes that follow this Length field.\n\n   Key =
Field Num:  the number of fields (minus 1) the key can be broken\n      =
up into.  The width of the fields are fixed length.  So for a key\n      =
size of 8 bytes, with a Key Field Num of 4 allows 4 fields of 2\n      =
bytes in length.  Valid values for this field range from 0 to 15\n      =
supporting a maximum of 16 field separations.\n\n   Key Wildcard Fields: =
 describes which fields in the key are not used\n      as part of the =
key lookup.  This wildcard encoding is a bitfield.\n      Each bit is a =
don\'t-care bit for a corresponding field in the key.\n      Bit 0 (the =
low-order bit) in this bitfield corresponds the first\n      field, =
right-justified in the key, bit 1 the second field, and so\n      on.  =
When a bit is set in the bitfield it is a don\'t-care bit and\n      =
should not be considered as part of the database lookup.  When the\n     =
 entire 16-bits is set to 0, then all bits of the key are used for\n     =
 the database lookup.\n\n   Key:  the variable length key used to do a =
LISP Database Mapping\n      lookup.  The length of the key is the value =
n (shown above) minus\n      3.\n\n\n\n\n\n\n\n\n\nFarinacci, et al.     =
  Expires November 7, 2014               [Page 12]\n_\nInternet-Draft    =
LISP Canonical Address Format (LCAF)          May 2014\n\n\n4.6.  NAT =
Traversal Scenarios\n\n   When a LISP system is conveying global address =
and mapped port\n   information when traversing through a NAT device, =
the NAT-Traversal\n   LCAF Type is used.  See [LISP-NATT] for =
details.\n\n   NAT-Traversal Canonical Address Format:\n\n     0         =
          1                   2                   3\n     0 1 2 3 4 5 6 =
7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 7    _     Rsvd2     _             4 + n             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
      MS UDP Port Number      _      ETR UDP Port Number      _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _  Global ETR RLOC Address  ... _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _       MS RLOC Address  ...    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _ Private ETR RLOC Address  ... _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _      RTR RLOC Address 1 ...   _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _      RTR RLOC Address k ...   _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of the AFI addresses that follows\n     =
 the UDP Port Number field including the AFI fields themselves.\n\n   MS =
UDP Port Number:  this is the UDP port number of the Map-Server\n      =
and is set to 4342.\n\n   ETR UDP Port Number:  this is the port number =
returned to a LISP\n      system which was copied from the source port =
from a packet that\n      has flowed through a NAT device.\n\n   AFI =3D =
x:  x can be any AFI value from [AFI].\n\n   Global ETR RLOC Address:  =
this is an address known to be globally\n      unique built by =
NAT-traversal functionality in a LISP router.\n\n   MS RLOC Address:  =
this is the address of the Map-Server used in the\n      destination =
RLOC of a packet that has flowed through a NAT =
device.\n\n\n\n\n\n\nFarinacci, et al.       Expires November 7, 2014    =
           [Page 13]\n_\nInternet-Draft    LISP Canonical Address Format =
(LCAF)          May 2014\n\n\n   Private ETR RLOC Address:  this is an =
address known to be a private\n      address inserted in this LCAF =
format by a LISP router that resides\n      on the private side of a NAT =
device.\n\n   RTR RLOC Address:  this is an encapsulation address used =
by an ITR or\n      PITR which resides behind a NAT device.  This =
address is known to\n      have state in a NAT device so packets can =
flow from it to the LISP\n      ETR behind the NAT.  There can be one or =
more NTR addresses\n      supplied in these set of fields.  The number =
of NTRs encoded is\n      determined by the LCAF length field.  When =
there are no NTRs\n      supplied, the NTR fields can be omitted and =
reflected by the LCAF\n      length field or an AFI of 0 can be used to =
indicate zero NTRs\n      =
encoded.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n=
\n\n\n\n\n\nFarinacci, et al.       Expires November 7, 2014             =
  [Page 14]\n_\nInternet-Draft    LISP Canonical Address Format (LCAF)   =
       May 2014\n\n\n4.7.  PETR Admission Control Functionality\n\n   =
When a public PETR device wants to verify who is encapsulating to it,\n  =
 it can check for a specific nonce value in the LISP encapsulated\n   =
packet.  To convey the nonce to admitted ITRs or PITRs, this LCAF\n   =
format is used in a Map-Register or Map-Reply locator-record.\n\n   =
Nonce Locator Canonical Address Format:\n\n     0                   1    =
               2                   3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 =
5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 8    _     Rsvd2     _             4 + n             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Reserved    _                  Nonce                        _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _         Address  ...          _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of the AFI address that follows the\n   =
   Nonce field including the AFI field itself.\n\n   Reserved:  must be =
set to zero and ignore on receipt.\n\n   Nonce:  this is a nonce value =
returned by an ETR in a Map-Reply\n      locator-record to be used by an =
ITR or PITR when encapsulating to\n      the locator address encoded in =
the AFI field of this LCAF type.\n\n   AFI =3D x:  x can be any AFI =
value from [AFI].\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nFarinacci, et =
al.       Expires November 7, 2014               [Page =
15]\n_\nInternet-Draft    LISP Canonical Address Format (LCAF)          =
May 2014\n\n\n4.8.  Multicast Group Membership Information\n\n   =
Multicast group information can be published in the mapping database\n   =
so a lookup on an EID based group address can return a replication\n   =
list of group addresses or a unicast addresses for single replication\n  =
 or multiple head-end replications.  The intent of this type of\n   =
unicast replication is to deliver packets to multiple ETRs at\n   =
receiver LISP multicast sites.  The locator-set encoding for this EID\n  =
 record type can be a list of ETRs when they each register with "Merge\n =
  Semantics".  The encoding can be a typical AFI encoded locator\n   =
address.  When an RTR list is being registered (with multiple levels\n   =
according to [LISP-RE]), the Replication List Entry LCAF type is used\n  =
 for locator encoding.\n\n   This LCAF encoding can be used to send =
broadcast packets to all\n   members of a subnet when each EIDs are away =
from their home subnet\n   location.\n\n   Multicast Info Canonical =
Address Format:\n\n     0                   1                   2        =
           3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 =
7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 9    _  Rsvd2  _R_L_J_             8 + n             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                        Instance-ID                           _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
           Reserved           _ Source MaskLen_ Group MaskLen _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _   Source/Subnet Address  ...  _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _       Group Address  ...      _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of fields that follow.\n\n   Reserved:  =
must be set to zero and ignore on receipt.\n\n   R-bit:  this is the =
RP-bit that represents PIM (S,G,RP-bit) multicast\n      state.  This =
bit can be set for Joins (when the J-bit is set) or\n      for Leaves =
(when the L-bit is set).  See [LISP-MRSIG] for more\n      usage =
details.\n\n\n\n\n\n\n\nFarinacci, et al.       Expires November 7, 2014 =
              [Page 16]\n_\nInternet-Draft    LISP Canonical Address =
Format (LCAF)          May 2014\n\n\n   L-bit:  this is the =
Leave-Request bit and is used when this LCAF type\n      is present in =
the destination EID-prefix field of a Map-Request.\n      See =
[LISP-MRSIG] for details.\n\n   J-bit:  this is the Join-Request bit and =
is used when this LCAF type\n      is present in the destination =
EID-prefix field of a Map-Request.\n      See [LISP-MRSIG] for details.  =
The J-bit MUST not be set when the\n      L-bit is also set in the same =
LCAF block.  A receiver should not\n      take any specific Join or =
Leave action when both bits are set.\n\n   Instance ID:  the low-order =
24-bits that can go into a LISP data\n      header when the I-bit is =
set.  See [RFC6830] for details.  The use\n      of the Instance-ID in =
this LCAF type is to associate a multicast\n      forwarding entry for a =
given VPN.  The instance-ID describes the\n      VPN and is registered =
to the mapping database system as a 3-tuple\n      of (Instance-ID, =
S-prefix, G-prefix).\n\n   Source MaskLen:  the mask length of the =
source prefix that follows.\n\n   Group MaskLen:  the mask length of the =
group prefix that follows.\n\n   AFI =3D x:  x can be any AFI value from =
[AFI].  When a specific AFI has\n      its own encoding of a multicast =
address, this field must be either\n      a group address or a broadcast =
address.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nFarinacci,=
 et al.       Expires November 7, 2014               [Page =
17]\n_\nInternet-Draft    LISP Canonical Address Format (LCAF)          =
May 2014\n\n\n4.9.  Traffic Engineering using Re-encapsulating =
Tunnels\n\n   For a given EID lookup into the mapping database, this =
LCAF format\n   can be returned to provide a list of locators in an =
explicit re-\n   encapsulation path.  See [LISP-TE] for details.\n\n   =
Explicit Locator Path (ELP) Canonical Address Format:\n\n     0          =
         1                   2                   3\n     0 1 2 3 4 5 6 7 =
8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 10   _     Rsvd2     _               n               _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          Rsvd3         _L_P_S_           AFI =3D x             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                        Reencap Hop 1  ...                    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          Rsvd3         _L_P_S_           AFI =3D x             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                        Reencap Hop k  ...                    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of fields that follow.\n\n   Lookup bit =
(L):  this is the Lookup bit used to indicate to the user\n      of the =
ELP to not use this address for encapsulation but to look\n      it up =
in the mapping database system to obtain an encapsulating\n      RLOC =
address.\n\n   RLOC-Probe bit (P):  this is the RLOC-probe bit which =
means the\n      Reencap Hop allows RLOC-probe messages to be sent to =
it.  When the\n      R-bit is set to 0, RLOC-probes must not be sent.  =
When a Reencap\n      Hop is an anycast address then multiple physical =
Reencap Hops are\n      using the same RLOC address.  In this case, =
RLOC-probes are not\n      needed because when the closest RLOC address =
is not reachable\n      another RLOC address can reachable.\n\n   Strict =
bit (S):  this the strict bit which means the associated\n      Rencap =
Hop is required to be used.  If this bit is 0, the\n      reencapsulator =
can skip this Reencap Hop and go to the next one in\n      the list.\n\n =
  AFI =3D x:  x can be any AFI value from [AFI].  When a specific AFI =
has\n      its own encoding of a multicast address, this field must be =
either\n      a group address or a broadcast =
address.\n\n\n\n\nFarinacci, et al.       Expires November 7, 2014       =
        [Page 18]\n_\nInternet-Draft    LISP Canonical Address Format =
(LCAF)          May 2014\n\n\n4.10.  Storing Security Data in the =
Mapping Database\n\n   When a locator in a locator-set has a security =
key associated with\n   it, this LCAF format will be used to encode key =
material.  See\n   [LISP-DDT] for details.\n\n   Security Key Canonical =
Address Format:\n\n     0                   1                   2        =
           3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 =
7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 11   _      Rsvd2    _             6 + n             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Key Count   _      Rsvd3    _ Key Algorithm _   Rsvd4     _R_\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          Key Length          _       Key Material ...        _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                       ... Key Material                       _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _       Locator Address ...     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of fields that start with the Key\n     =
 Material field.\n\n   Key Count:  the Key Count field declares the =
number of Key sections\n      included in this LCAF.\n\n   Key =
Algorithm:  the Algorithm field identifies the key\'s\n      =
cryptographic algorithm and specifies the format of the Public Key\n     =
 field.\n\n   R bit:  this is the revoke bit and, if set, it specifies =
that this\n      Key is being Revoked.\n\n   Key Length:  this field =
determines the length in bytes of the Key\n      Material field.\n\n   =
Key Material:  the Key Material field stores the key material.  The\n    =
  format of the key material stored depends on the Key Algorithm\n      =
field.\n\n   AFI =3D x:  x can be any AFI value from [AFI].This is the =
locator\n      address that owns the encoded security =
key.\n\n\n\n\n\nFarinacci, et al.       Expires November 7, 2014         =
      [Page 19]\n_\nInternet-Draft    LISP Canonical Address Format =
(LCAF)          May 2014\n\n\n4.11.  Source/Destination 2-Tuple =
Lookups\n\n   When both a source and destination address of a flow =
needs\n   consideration for different locator-sets, this 2-tuple key is =
used in\n   EID fields in LISP control messages.  When the Source/Dest =
key is\n   registered to the mapping database, it can be encoded as a =
source-\n   prefix and destination-prefix.  When the Source/Dest is used =
as a key\n   for a mapping database lookup the source and destination =
come from a\n   data packet.\n\n   Source/Dest Key Canonical Address =
Format:\n\n     0                   1                   2                =
   3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 =
1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 12   _     Rsvd2     _             4 + n             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
           Reserved           _   Source-ML   _    Dest-ML    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _         Source-Prefix ...     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _     Destination-Prefix ...    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of fields that follow.\n\n   Reserved:  =
must be set to zero and ignore on receipt.\n\n   Source-ML:  the mask =
length of the source prefix that follows.\n\n   Dest-ML:  the mask =
length of the destination prefix that follows.\n\n   AFI =3D x:  x can =
be any AFI value from [AFI].  When a specific AFI has\n      its own =
encoding of a multicast address, this field must be either\n      a =
group address or a broadcast address.\n\n   Refer to [LISP-TE] for usage =
details.\n\n\n\n\n\n\n\n\n\n\n\n\nFarinacci, et al.       Expires =
November 7, 2014               [Page 20]\n_\nInternet-Draft    LISP =
Canonical Address Format (LCAF)          May 2014\n\n\n4.12.  =
Replication List Entries for Multicast Forwarding\n\n   The Replication =
List Entry LCAF type is an encoding for a locator\n   being used for =
unicast replication according to the specification in\n   [LISP-RE].  =
This locator encoding is pointed to by a Multicast Info\n   LCAF Type =
and is registered by Re-encapsulating Tunnel Routers (RTRs)\n   that are =
participating in an overlay distribution tree.  Each RTR\n   will =
register its locator address and its configured level in the\n   =
distribution tree.\n\n   Replication List Entry Address Format:\n\n     =
0                   1                   2                   3\n     0 1 =
2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 13   _    Rsvd2      _             4 + n             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             Rsvd3            _     Rsvd4     _  Level Value  _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _           RTR/ETR #1 ...      _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             Rsvd3            _     Rsvd4     _  Level Value  _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _           RTR/ETR  #n ...     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of fields that follow.\n\n   =
Rsvd{1,2,3,4}:  must be set to zero and ignore on receipt.\n\n   Level =
Value:  this value is associated with the level within the\n      =
overlay distribution tree hierarchy where the RTR resides.  The\n      =
level numbers are ordered from lowest value being close to the ITR\n     =
 (meaning that ITRs replicate to level-0 RTRs) and higher levels\n      =
are further downstream on the distribution tree closer to ETRs of\n      =
multicast receiver sites.\n\n   AFI =3D x:  x can be any AFI value from =
[AFI].  A specific AFI has its\n      own encoding of either a unicast =
or multicast locator address.\n      All RTR/ETR entries for the same =
level should be combined together\n      by a Map-Server to avoid =
searching through the entire multi-level\n      list of locator entries =
in a Map-Reply message.\n\n\n\n\n\n\n\nFarinacci, et al.       Expires =
November 7, 2014               [Page 21]\n_\nInternet-Draft    LISP =
Canonical Address Format (LCAF)          May 2014\n\n\n4.13.  Data Model =
Encoding\n\n   This type allows a JSON data model to be encoded either =
as an EID or\n   RLOC.\n\n   JSON Data Model Type Address Format:\n\n    =
 0                   1                   2                   3\n     0 1 =
2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 14   _    Rsvd2    _B_               n               _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          JSON length         _ JSON binary/text encoding ... _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _       Optional Address ...    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of fields that follow.\n\n   Rsvd{1,2}: =
 must be set to zero and ignore on receipt.\n\n   B bit:  indicates that =
the JSON field is binary encoded according to\n      [JSON-BINARY] when =
the bit is set to 1.  Otherwise the encoding is\n      based on text =
encoding according to [RFC4627].\n\n   JSON length:  length in octets of =
the following \'JSON binary/text\n      encoding\' field.\n\n   JSON =
binary/text encoding field:  a variable length field that\n      =
contains either binary or text encodings.\n\n   AFI =3D x:  x can be any =
AFI value from [AFI].  A specific AFI has its\n      own encoding of =
either a unicast or multicast locator address.\n      All RTR/ETR =
entries for the same level should be combined together\n      by a =
Map-Server to avoid searching through the entire multi-level\n      list =
of locator entries in a Map-Reply =
message.\n\n\n\n\n\n\n\n\n\n\n\n\n\nFarinacci, et al.       Expires =
November 7, 2014               [Page 22]\n_\nInternet-Draft    LISP =
Canonical Address Format (LCAF)          May 2014\n\n\n4.14.  Encoding =
Key/Value Address Pairs\n\n   The Key/Value pair is for example useful =
for attaching attributes to\n   other elements of LISP packets, such as =
EIDs or RLOCs.  When\n   attaching attributes to EIDs or RLOCs, it\'s =
necessary to distinguish\n   between the element that should be used as =
EID or RLOC, and hence as\n   key for lookups, and additional =
attributes.  This is especially the\n   case when the difference cannot =
be determined from the types of the\n   elements, such as when two IP =
addresses are being used.\n\n   Key/Value Pair Address Format:\n\n     0 =
                  1                   2                   3\n     0 1 2 =
3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 15   _     Rsvd2     _               n               _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _       Address as Key ...      _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _       Address as Value ...    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of fields that follow.\n\n   Rsvd{1,2}: =
 must be set to zero and ignore on receipt.\n\n   AFI =3D x:  x can be =
any AFI value from [AFI].  A specific AFI has its\n      own encoding of =
either a unicast or multicast locator address.\n      All RTR/ETR =
entries for the same level should be combined together\n      by a =
Map-Server to avoid searching through the entire multi-level\n      list =
of locator entries in a Map-Reply message.\n\n   Address as Key:  this =
AFI encoded address will be attached with the\n      attributes encoded =
in "Address as Value" which follows this field.\n\n   Address as Value:  =
this AFI encoded address will be the attribute\n      address that goes =
along with "Address as Key" which precedes this\n      field.\n\n4.15.  =
Applications for AFI List Type\n\n4.15.1.  Binding IPv4 and IPv6 =
Addresses\n\n   When header translation between IPv4 and IPv6 is =
desirable a LISP\n   Canonical Address can use the AFI List Type to =
carry multiple AFIs in\n   one LCAF AFI.\n\n\n\nFarinacci, et al.       =
Expires November 7, 2014               [Page 23]\n_\nInternet-Draft    =
LISP Canonical Address Format (LCAF)          May 2014\n\n\n   Address =
Binding LISP Canonical Address Format:\n\n     0                   1     =
              2                   3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 =
5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 1    _     Rsvd2     _         2 + 4 + 2 + 16        _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
           AFI =3D 1            _       IPv4 Address ...        _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
    ...  IPv4 Address         _            AFI =3D 2            _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                         IPv6 Address ...                     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                    ...  IPv6 Address  ...                    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                    ...  IPv6 Address  ...                    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                    ...  IPv6 Address                         _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length:  length in bytes is fixed at 24 when IPv4 and IPv6 AFI\n      =
encoded addresses are used.\n\n   This type of address format can be =
included in a Map-Request when the\n   address is being used as an EID, =
but the Mapping Database System\n   lookup destination can use only the =
IPv4 address.  This is so a\n   Mapping Database Service Transport =
System, such as LISP-ALT\n   [RFC6836], can use the Map-Request =
destination address to route the\n   control message to the desired LISP =
site.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nFarinacci, et al.       =
Expires November 7, 2014               [Page 24]\n_\nInternet-Draft    =
LISP Canonical Address Format (LCAF)          May 2014\n\n\n4.15.2.  =
Layer-2 VPNs\n\n   When MAC addresses are stored in the LISP Mapping =
Database System,\n   the AFI List Type can be used to carry AFI 6.\n\n   =
MAC Address LISP Canonical Address Format:\n\n     0                   1 =
                  2                   3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 =
3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 1    _     Rsvd2     _             2 + 6             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
            AFI =3D 6           _    Layer-2 MAC Address  ...   _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                   ... Layer-2 MAC Address                    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length:  length in bytes is fixed at 8 when MAC address AFI encoded\n    =
  addresses are used.\n\n   This address format can be used to connect =
layer-2 domains together\n   using LISP over an IPv4 or IPv6 core =
network to create a layer-2 VPN.\n   In this use-case, a MAC address is =
being used as an EID, and the\n   locator-set that this EID maps to can =
be an IPv4 or IPv6 RLOCs, or\n   even another MAC address being used as =
an RLOC.\n\n4.15.3.  ASCII Names in the Mapping Database\n\n   If DNS =
names or URIs are stored in the LISP Mapping Database System,\n   the =
AFI List Type can be used to carry an ASCII string where it is\n   =
delimited by length \'n\' of the LCAF Length encoding.\n\n   ASCII LISP =
Canonical Address Format:\n\n     0                   1                  =
 2                   3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 =
2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 1    _     Rsvd2     _             2 + n             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
            AFI =3D 17          _      DNS Name or URI  ...     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n\n\n\=
n\n\nFarinacci, et al.       Expires November 7, 2014               =
[Page 25]\n_\nInternet-Draft    LISP Canonical Address Format (LCAF)     =
     May 2014\n\n\n   Length value n:  length in bytes AFI=3D17 field =
and the null-terminated\n      ASCII string (the last byte of 0 is =
included).\n\n4.15.4.  Using Recursive LISP Canonical Address =
Encodings\n\n   When any combination of above is desirable, the AFI List =
Type value\n   can be used to carry within the LCAF AFI another LCAF =
AFI.\n\n   Recursive LISP Canonical Address Format:\n\n     0            =
       1                   2                   3\n     0 1 2 3 4 5 6 7 8 =
9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 1    _     Rsvd2     _         4 + 8 + 2 + 4         _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 4    _     Rsvd2     _              12               _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  IP TOS, IPv6 QQS or Flow Label              _    Protocol   _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          Local Port          _         Remote Port           _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
           AFI =3D 1            _       IPv4 Address ...        _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
    ...  IPv4 Address         _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   Length:  length in bytes is =
fixed at 18 when an AFI=3D1 IPv4 address is\n      included.\n\n   This =
format could be used by a Mapping Database Transport System,\n   such as =
LISP-ALT [RFC6836], where the AFI=3D1 IPv4 address is used as\n   an EID =
and placed in the Map-Request destination address by the\n   sending =
LISP system.  The ALT system can deliver the Map-Request to\n   the LISP =
destination site independent of the Application Data Type\n   AFI =
payload values.  When this AFI is processed by the destination\n   LISP =
site, it can return different locator-sets based on the type of\n   =
application or level of service that is being =
requested.\n\n\n\n\n\n\n\n\n\n\nFarinacci, et al.       Expires November =
7, 2014               [Page 26]\n_\nInternet-Draft    LISP Canonical =
Address Format (LCAF)          May 2014\n\n\n4.15.5.  Compatibility Mode =
Use Case\n\n   A LISP system should use the AFI List Type format when =
sending to\n   LISP systems that do not support a particular LCAF Type =
used to\n   encode locators.  This allows the receiving system to be =
able to\n   parse a locator address for encapsulation purposes.  The =
list of AFIs\n   in an AFI List LCAF Type has no semantic ordering and a =
receiver\n   should parse each AFI element no matter what the =
ordering.\n\n   Compatibility Mode Address Format:\n\n     0             =
      1                   2                   3\n     0 1 2 3 4 5 6 7 8 =
9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 1    _     Rsvd2     _            22 + 6             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 5    _     Rsvd2     _            12 + 2             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    =
_N_     Latitude Degrees        _    Minutes    _    Seconds    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    =
_E_     Longitude Degrees       _    Minutes    _    Seconds    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                           Altitude                           _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D 0          _           AFI =3D 1             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                         IPv4 Address                         _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
If a system does not recognized the Geo Coordinate LCAF Type that is\n   =
accompanying a locator address, an encoder can include the Geo\n   =
Coordinate LCAF Type embedded in a AFI List LCAF Type where the AFI\n   =
in the Geo Coordinate LCAF is set to 0 and the AFI encoded next in\n   =
the list is encoded with a valid AFI value to identify the locator\n   =
address.\n\n   A LISP system is required to support the AFI List LCAF =
Type to use\n   this procedure.  It would skip over 10 bytes of the Geo =
Coordinate\n   LCAF Type to get to the locator address encoding (an IPv4 =
locator\n   address).  A LISP system that does support the Geo =
Coordinate LCAF\n   Type can support parsing the locator address within =
the Geo\n   Coordinate LCAF encoding or in the locator encoding that =
follows in\n   the AFI List LCAF.\n\n\n\n\nFarinacci, et al.       =
Expires November 7, 2014               [Page 27]\n_\nInternet-Draft    =
LISP Canonical Address Format (LCAF)          May 2014\n\n\n5.  Security =
Considerations\n\n   There are no security considerations for this =
specification.  The\n   security considerations are documented for the =
protocols that use\n   LISP Canonical Addressing.  Refer to the those =
relevant\n   =
specifications.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\=
n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nFarinacci, et al.       Expires =
November 7, 2014               [Page 28]\n_\nInternet-Draft    LISP =
Canonical Address Format (LCAF)          May 2014\n\n\n6.  IANA =
Considerations\n\n   The Address Family AFI definitions from [AFI] only =
allocate code-\n   points for the AFI value itself.  The length of the =
address or entity\n   that follows is not defined and is implied based =
on conventional\n   experience.  Where the LISP protocol uses LISP =
Canonical Addresses\n   specifically, the address length definitions =
will be in this\n   specification and take precedent over any other =
specification.\n\n   An IANA Registry for LCAF Type values will be =
created.  The values\n   that are considered for use by the main LISP =
specification [RFC6830]\n   will be in the IANA Registry.  Other Type =
values used for\n   experimentation will be defined and described in =
this =
document.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\=
n\n\n\n\n\n\nFarinacci, et al.       Expires November 7, 2014            =
   [Page 29]\n_\nInternet-Draft    LISP Canonical Address Format (LCAF)  =
        May 2014\n\n\n7.  References\n\n7.1.  Normative References\n\n   =
[RFC1700]  Reynolds, J. and J. Postel, "Assigned Numbers", RFC 1700,\n   =
           October 1994.\n\n   [RFC1918]  Rekhter, Y., Moskowitz, R., =
Karrenberg, D., Groot, G., and\n              E. Lear, "Address =
Allocation for Private Internets",\n              BCP 5, RFC 1918, =
February 1996.\n\n   [RFC4627]  Crockford, D., "The application/json =
Media Type for\n              JavaScript Object Notation (JSON)", RFC =
4627, July 2006.\n\n   [RFC6830]  Farinacci, D., Fuller, V., Meyer, D., =
and D. Lewis, "The\n              Locator/ID Separation Protocol =
(LISP)", RFC 6830,\n              January 2013.\n\n   [RFC6836]  Fuller, =
V., Farinacci, D., Meyer, D., and D. Lewis,\n              "Locator/ID =
Separation Protocol Alternative Logical\n              Topology =
(LISP+ALT)", RFC 6836, January 2013.\n\n7.2.  Informative References\n\n =
  [AFI]      IANA, "Address Family Identifier (AFIs)", ADDRESS FAMILY\n  =
            NUMBERS http://www.iana.org/numbers.html, Febuary 2007.\n\n  =
 [JSON-BINARY]\n              "Universal Binary JSON Specification",\n   =
           URL http://ubjson.org.\n\n   [LISP-DDT]\n              =
Fuller, V., Lewis, D., and V. Ermagan, "LISP Delegated\n              =
Database Tree", draft-ietf-lisp-ddt-01.txt (work in\n              =
progress).\n\n   [LISP-MRSIG]\n              Farinacci, D. and M. =
Napierala, "LISP Control-Plane\n              Multicast Signaling",\n    =
          draft-farinacci-lisp-mr-signaling-03.txt (work in\n            =
  progress).\n\n   [LISP-NATT]\n              Ermagan, V., Farinacci, =
D., Lewis, D., Skriver, J., Maino,\n              F., and C. White, "NAT =
traversal for LISP",\n              =
draft-ermagan-lisp-nat-traversal-03.txt (work in\n              =
progress).\n\n\n\n\nFarinacci, et al.       Expires November 7, 2014     =
          [Page 30]\n_\nInternet-Draft    LISP Canonical Address Format =
(LCAF)          May 2014\n\n\n   [LISP-RE]  Coras, F., =
Cabellos-Aparicio, A., Domingo-Pascual, J.,\n              Maino, F., =
and D. Farinacci, "LISP Replication\n              Engineering", =
draft-coras-lisp-re-03.txt (work in\n              progress).\n\n   =
[LISP-TE]  Farinacci, D., Lahiri, P., and M. Kowal, "LISP Traffic\n      =
        Engineering Use-Cases", draft-farinacci-lisp-te-03.txt\n         =
     (work in progress).\n\n   [WGS-84]   Geodesy and Geophysics =
Department, DoD., "World Geodetic\n              System 1984", NIMA =
TR8350.2, January 2000, _http://\n              =
earth-info.nga.mil/GandG/publications/tr8350.2/\n              =
wgs84fin.pdf_.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n=
\n\n\n\n\n\n\n\n\nFarinacci, et al.       Expires November 7, 2014       =
        [Page 31]\n_\nInternet-Draft    LISP Canonical Address Format =
(LCAF)          May 2014\n\n\nAppendix A.  Acknowledgments\n\n   The =
authors would like to thank Vince Fuller, Gregg Schudel, Jesper\n   =
Skriver, Luigi Iannone, Isidor Kouvelas, and Sander Steffann for\n   =
their technical and editorial commentary.\n\n   The authors would like =
to thank Victor Moreno for discussions that\n   lead to the definition =
of the Multicast Info LCAF type.\n\n   The authors would like to thank =
Parantap Lahiri and Michael Kowal for\n   discussions that lead to the =
definition of the Explicit Locator Path\n   (ELP) LCAF type.\n\n   The =
authors would like to thank Fabio Maino and Vina Ermagan for\n   =
discussions that lead to the definition of the Security Key LCAF\n   =
type.\n\n   The authors would like to thank Albert Cabellos-Aparicio and =
Florin\n   Coras for discussions that lead to the definition of the =
Replication\n   List Entry LCAF type.\n\n   Thanks goes to Michiel =
Blokzijl and Alberto Rodriguez-Natal for\n   suggesting new LCAF =
types.\n\n   Thanks also goes to Terry Manderson for assistance =
obtaining a LISP\n   AFI value from =
IANA.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nFarinacci, et =
al.       Expires November 7, 2014               [Page =
32]\n_\nInternet-Draft    LISP Canonical Address Format (LCAF)          =
May 2014\n\n\nAppendix B.  Document Change Log\n\nB.1.  Changes to =
draft-ietf-lisp-lcaf-05.txt\n\n   o  Submitted May 2014.\n\n   o  Add a =
length field of the JSON payload that can be used for either\n      =
binary or text encoding of JSON data.\n\nB.2.  Changes to =
draft-ietf-lisp-lcaf-04.txt\n\n   o  Submitted January 2014.\n\n   o  =
Agreement among ELP implementors to have the AFI 16-bit field\n      =
adjacent to the address.  This will make the encoding consistent\n      =
with all other LCAF type address encodings.\n\nB.3.  Changes to =
draft-ietf-lisp-lcaf-03.txt\n\n   o  Submitted September 2013.\n\n   o  =
Updated references and author\'s affilations.\n\n   o  Added Instance-ID =
to the Multicast Info Type so there is relative\n      ease in parsing =
(S,G) entries within a VPN.\n\n   o  Add port range encodings to the =
Application Data LCAF Type.\n\n   o  Add a new JSON LCAF Type.\n\n   o  =
Add Address Key/Value LCAF Type to allow attributes to be attached\n     =
 to an address.\n\nB.4.  Changes to draft-ietf-lisp-lcaf-02.txt\n\n   o  =
Submitted March 2013.\n\n   o  Added new LCAF Type "Replication List =
Entry" to support LISP\n      replication engineering use-cases.\n\n   o =
 Changed references to new LISP RFCs.\n\nB.5.  Changes to =
draft-ietf-lisp-lcaf-01.txt\n\n   o  Submitted January 2013.\n\n   o  =
Change longitude range from 0-90 to 0-180 in section =
4.4.\n\n\n\n\nFarinacci, et al.       Expires November 7, 2014           =
    [Page 33]\n_\nInternet-Draft    LISP Canonical Address Format (LCAF) =
         May 2014\n\n\n   o  Added reference to WGS-84 in section =
4.4.\n\nB.6.  Changes to draft-ietf-lisp-lcaf-00.txt\n\n   o  Posted =
first working group draft August 2012.\n\n   o  This draft was renamed =
from =
draft-farinacci-lisp-lcaf-10.txt.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\=
n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nFarinacci, et al.       =
Expires November 7, 2014               [Page 34]\n_\nInternet-Draft    =
LISP Canonical Address Format (LCAF)          May 2014\n\n\nAuthors\' =
Addresses\n\n   Dino Farinacci\n   lispers.net\n   San Jose, CA\n   =
USA\n\n   Email: farinacci@gmail.com\n\n\n   Dave Meyer\n   Brocade\n   =
San Jose, CA\n   USA\n\n   Email: dmm@1-4-5.net\n\n\n   Job Snijders\n   =
Hibernia Networks\n   Tupolevlaan 103a\n   Schiphol-Rijk,   1119 PA\n   =
NL\n\n   Email: =
job.snijders@hibernianetworks.com\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\=
n\n\n\n\n\n\nFarinacci, et al.       Expires November 7, 2014            =
   [Page 35]\n_\n', 'filename1': '\n\n\nNetwork Working Group            =
                           D. Farinacci\nInternet-Draft                  =
                             lispers.net\nIntended status: Experimental  =
                                 D. Meyer\nExpires: July 31, 2014        =
                                   Brocade\n                             =
                                J. Snijders\n                            =
                           Hibernia Networks\n                           =
                             January 27, 2014\n\n\n                  =
LISP Canonical Address Format (LCAF)\n                        =
draft-ietf-lisp-lcaf-04\n\nAbstract\n\n   This draft defines a canonical =
address format encoding used in LISP\n   control messages and in the =
encoding of lookup keys for the LISP\n   Mapping Database =
System.\n\nStatus of this Memo\n\n   This Internet-Draft is submitted in =
full conformance with the\n   provisions of BCP 78 and BCP 79.\n\n   =
Internet-Drafts are working documents of the Internet Engineering\n   =
Task Force (IETF).  Note that other groups may also distribute\n   =
working documents as Internet-Drafts.  The list of current Internet-\n   =
Drafts is at http://datatracker.ietf.org/drafts/current/.\n\n   =
Internet-Drafts are draft documents valid for a maximum of six months\n  =
 and may be updated, replaced, or obsoleted by other documents at any\n  =
 time.  It is inappropriate to use Internet-Drafts as reference\n   =
material or to cite them other than as "work in progress."\n\n   This =
Internet-Draft will expire on July 31, 2014.\n\nCopyright Notice\n\n   =
Copyright (c) 2014 IETF Trust and the persons identified as the\n   =
document authors.  All rights reserved.\n\n   This document is subject =
to BCP 78 and the IETF Trust\'s Legal\n   Provisions Relating to IETF =
Documents\n   (http://trustee.ietf.org/license-info) in effect on the =
date of\n   publication of this document.  Please review these =
documents\n   carefully, as they describe your rights and restrictions =
with respect\n   to this document.  Code Components extracted from this =
document must\n   include Simplified BSD License text as described in =
Section 4.e of\n   the Trust Legal Provisions and are provided without =
warranty as\n\n\n\nFarinacci, et al.         Expires July 31, 2014       =
          [Page 1]\n_\nInternet-Draft    LISP Canonical Address Format =
(LCAF)      January 2014\n\n\n   described in the Simplified BSD =
License.\n\n\nTable of Contents\n\n   1.  Introduction . . . . . . . . . =
. . . . . . . . . . . . . . . .  3\n   2.  Definition of Terms  . . . . =
. . . . . . . . . . . . . . . . .  4\n   3.  LISP Canonical Address =
Format Encodings  . . . . . . . . . . .  5\n   4.  LISP Canonical =
Address Applications  . . . . . . . . . . . . .  7\n     4.1.  =
Segmentation using LISP  . . . . . . . . . . . . . . . . .  7\n     4.2. =
 Carrying AS Numbers in the Mapping Database  . . . . . . .  8\n     =
4.3.  Convey Application Specific Data . . . . . . . . . . . . .  9\n    =
 4.4.  Assigning Geo Coordinates to Locator Addresses . . . . . . 10\n   =
  4.5.  Generic Database Mapping Lookups . . . . . . . . . . . . . 12\n  =
   4.6.  NAT Traversal Scenarios  . . . . . . . . . . . . . . . . . 13\n =
    4.7.  PETR Admission Control Functionality . . . . . . . . . . . =
15\n     4.8.  Multicast Group Membership Information . . . . . . . . . =
. 16\n     4.9.  Traffic Engineering using Re-encapsulating Tunnels . . =
. . 18\n     4.10. Storing Security Data in the Mapping Database  . . . =
. . . 19\n     4.11. Source/Destination 2-Tuple Lookups . . . . . . . . =
. . . . 20\n     4.12. Replication List Entries for Multicast Forwarding =
 . . . . 21\n     4.13. Data Model Encoding  . . . . . . . . . . . . . . =
. . . . . 22\n     4.14. Encoding Key/Value Address Pairs . . . . . . . =
. . . . . . 23\n     4.15. Applications for AFI List Type . . . . . . . =
. . . . . . . 23\n       4.15.1.  Binding IPv4 and IPv6 Addresses . . . =
. . . . . . . . 23\n       4.15.2.  Layer-2 VPNs  . . . . . . . . . . . =
. . . . . . . . . 25\n       4.15.3.  ASCII Names in the Mapping =
Database . . . . . . . . . 25\n       4.15.4.  Using Recursive LISP =
Canonical Address Encodings  . . 26\n       4.15.5.  Compatibility Mode =
Use Case . . . . . . . . . . . . . 27\n   5.  Security Considerations  . =
. . . . . . . . . . . . . . . . . . 28\n   6.  IANA Considerations  . . =
. . . . . . . . . . . . . . . . . . . 29\n   7.  References . . . . . . =
. . . . . . . . . . . . . . . . . . . . 30\n     7.1.  Normative =
References . . . . . . . . . . . . . . . . . . . 30\n     7.2.  =
Informative References . . . . . . . . . . . . . . . . . . 30\n   =
Appendix A.  Acknowledgments . . . . . . . . . . . . . . . . . . . 32\n  =
 Appendix B.  Document Change Log . . . . . . . . . . . . . . . . . 33\n =
    B.1.  Changes to draft-ietf-lisp-lcaf-04.txt . . . . . . . . . . =
33\n     B.2.  Changes to draft-ietf-lisp-lcaf-03.txt . . . . . . . . . =
. 33\n     B.3.  Changes to draft-ietf-lisp-lcaf-02.txt . . . . . . . . =
. . 33\n     B.4.  Changes to draft-ietf-lisp-lcaf-01.txt . . . . . . . =
. . . 33\n     B.5.  Changes to draft-ietf-lisp-lcaf-00.txt . . . . . . =
. . . . 33\n   Authors\' Addresses . . . . . . . . . . . . . . . . . . . =
. . . . . 35\n\n\n\n\n\n\n\n\n\nFarinacci, et al.         Expires July =
31, 2014                 [Page 2]\n_\nInternet-Draft    LISP Canonical =
Address Format (LCAF)      January 2014\n\n\n1.  Introduction\n\n   The =
LISP architecture and protocols [RFC6830] introduces two new\n   =
numbering spaces, Endpoint Identifiers (EIDs) and Routing Locators\n   =
(RLOCs) which are intended to replace most use of IP addresses on the\n  =
 Internet.  To provide flexibility for current and future\n   =
applications, these values can be encoded in LISP control messages\n   =
using a general syntax that includes Address Family Identifier (AFI),\n  =
 length, and value fields.\n\n   Currently defined AFIs include IPv4 and =
IPv6 addresses, which are\n   formatted according to code-points =
assigned in [AFI] as follows:\n\n   IPv4 Encoded Address:\n\n     0      =
             1                   2                   3\n     0 1 2 3 4 5 =
6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
           AFI =3D 1            _       IPv4 Address ...        _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
    ...  IPv4 Address         _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   IPv6 Encoded Address:\n\n     0  =
                 1                   2                   3\n     0 1 2 3 =
4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
           AFI =3D 2            _       IPv6 Address ...        _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                    ...  IPv6 Address  ...                    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                    ...  IPv6 Address  ...                    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                    ...  IPv6 Address  ...                    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
    ...  IPv6 Address         _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   This document describes the =
currently-defined AFIs the LISP protocol\n   uses along with their =
encodings and introduces the LISP Canonical\n   Address Format (LCAF) =
that can be used to define the LISP-specific\n   encodings for arbitrary =
AFI values.\n\n\n\n\n\n\n\n\nFarinacci, et al.         Expires July 31, =
2014                 [Page 3]\n_\nInternet-Draft    LISP Canonical =
Address Format (LCAF)      January 2014\n\n\n2.  Definition of Terms\n\n =
  Address Family Identifier (AFI):  a term used to describe an address\n =
     encoding in a packet.  An address family currently defined for\n    =
  IPv4 or IPv6 addresses.  See [AFI] and [RFC1700] for details.  The\n   =
   reserved AFI value of 0 is used in this specification to indicate\n   =
   an unspecified encoded address where the the length of the address\n  =
    is 0 bytes following the 16-bit AFI value of 0.\n\n   Unspecified =
Address Format:\n\n     0                   1                   2        =
           3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 =
7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
           AFI =3D 0            _    _nothing follows AFI=3D0_    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Endpoint ID (EID):   a 32-bit (for IPv4) or 128-bit (for IPv6) value\n   =
   used in the source and destination address fields of the first\n      =
(most inner) LISP header of a packet.  The host obtains a\n      =
destination EID the same way it obtains a destination address\n      =
today, for example through a DNS lookup or SIP exchange.  The\n      =
source EID is obtained via existing mechanisms used to set a\n      =
host\'s "local" IP address.  An EID is allocated to a host from an\n     =
 EID-prefix block associated with the site where the host is\n      =
located.  An EID can be used by a host to refer to other hosts.\n\n   =
Routing Locator (RLOC):   the IPv4 or IPv6 address of an egress\n      =
tunnel router (ETR).  It is the output of a EID-to-RLOC mapping\n      =
lookup.  An EID maps to one or more RLOCs.  Typically, RLOCs are\n      =
numbered from topologically aggregatable blocks that are assigned\n      =
to a site at each point to which it attaches to the global\n      =
Internet; where the topology is defined by the connectivity of\n      =
provider networks, RLOCs can be thought of as PA addresses.\n      =
Multiple RLOCs can be assigned to the same ETR device or to\n      =
multiple ETR devices at a =
site.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nFarinacci, et al.         Expires =
July 31, 2014                 [Page 4]\n_\nInternet-Draft    LISP =
Canonical Address Format (LCAF)      January 2014\n\n\n3.  LISP =
Canonical Address Format Encodings\n\n   IANA has assigned AFI value =
16387 (0x4003) to the LISP architecture\n   and protocols.  This =
specification defines the encoding format of the\n   LISP Canonical =
Address (LCA).\n\n   The first 4 bytes of an LISP Canonical Address are =
followed by a\n   variable length of fields:\n\n     0                   =
1                   2                   3\n     0 1 2 3 4 5 6 7 8 9 0 1 =
2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
   Type       _     Rsvd2     _            Length             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Rsvd1:  this 8-bit field is reserved for future use and MUST be\n      =
transmitted as 0 and ignored on receipt.\n\n   Flags:  this 8-bit field =
is for future definition and use.  For now,\n      set to zero on =
transmission and ignored on receipt.\n\n   Type:  this 8-bit field is =
specific to the LISP Canonical Address\n      formatted encodings, =
values are:\n\n     Type 0:  Null Body Type\n\n     Type 1:  AFI List =
Type\n\n     Type 2:  Instance ID Type\n\n     Type 3:  AS Number =
Type\n\n     Type 4:  Application Data Type\n\n     Type 5:  Geo =
Coordinates Type\n\n     Type 6:  Opaque Key Type\n\n     Type 7:  =
NAT-Traversal Type\n\n     Type 8:  Nonce Locator Type\n\n     Type 9:  =
Multicast Info Type\n\n\n\n\n\n\nFarinacci, et al.         Expires July =
31, 2014                 [Page 5]\n_\nInternet-Draft    LISP Canonical =
Address Format (LCAF)      January 2014\n\n\n     Type 10:  Explicit =
Locator Path Type\n\n     Type 11:  Security Key Type\n\n     Type 12:  =
Source/Dest Key Type\n\n     Type 13:  Replication List Entry Type\n\n   =
  Type 14:  JSON Data Model Type\n\n     Type 15:  Key/Value Address =
Pair Type\n\n   Rsvd2:  this 8-bit field is reserved for future use and =
MUST be\n      transmitted as 0 and ignored on receipt.\n\n   Length:  =
this 16-bit field is in units of bytes and covers all of the\n      LISP =
Canonical Address payload, starting and including the byte\n      after =
the Length field.  So any LCAF encoded address will have a\n      =
minimum length of 8 bytes when the Length field is 0.  The 8 bytes\n     =
 include the AFI, Flags, Type, Reserved, and Length fields.  When\n      =
the AFI is not next to encoded address in a control message, then\n      =
the encoded address will have a minimum length of 6 bytes when the\n     =
 Length field is 0.  The 6 bytes include the Flags, Type, Reserved,\n    =
  and Length =
fields.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nFarinacci, =
et al.         Expires July 31, 2014                 [Page =
6]\n_\nInternet-Draft    LISP Canonical Address Format (LCAF)      =
January 2014\n\n\n4.  LISP Canonical Address Applications\n\n4.1.  =
Segmentation using LISP\n\n   When multiple organizations inside of a =
LISP site are using private\n   addresses [RFC1918] as EID-prefixes, =
their address spaces must remain\n   segregated due to possible address =
duplication.  An Instance ID in\n   the address encoding can aid in =
making the entire AFI based address\n   unique.\n\n   Another use for =
the Instance ID LISP Canonical Address Format is when\n   creating =
multiple segmented VPNs inside of a LISP site where keeping\n   =
EID-prefix based subnets is desirable.\n\n   Instance ID LISP Canonical =
Address Format:\n\n     0                   1                   2        =
           3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 =
7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 2    _ IID mask-len  _             4 + n             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                        Instance ID                           _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _         Address  ...          _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
IID mask-len:  if the AFI is set to 0, then this format is not\n      =
encoding an extended EID-prefix but rather an instance-ID range\n      =
where the \'IID mask-len\' indicates the number of high-order bits\n     =
 used in the Instance ID field for the range.\n\n   Length value n:  =
length in bytes of the AFI address that follows the\n      Instance ID =
field including the AFI field itself.\n\n   Instance ID:  the low-order =
24-bits that can go into a LISP data\n      header when the I-bit is =
set.  See [RFC6830] for details.\n\n   AFI =3D x:  x can be any AFI =
value from [AFI].\n\n   This LISP Canonical Address Type can be used to =
encode either EID or\n   RLOC addresses.\n\n\n\n\n\n\n\n\nFarinacci, et =
al.         Expires July 31, 2014                 [Page =
7]\n_\nInternet-Draft    LISP Canonical Address Format (LCAF)      =
January 2014\n\n\n4.2.  Carrying AS Numbers in the Mapping Database\n\n  =
 When an AS number is stored in the LISP Mapping Database System for\n   =
either policy or documentation reasons, it can be encoded in a LISP\n   =
Canonical Address.\n\n   AS Number LISP Canonical Address Format:\n\n    =
 0                   1                   2                   3\n     0 1 =
2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 3    _     Rsvd2     _             4 + n             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                          AS Number                           _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _         Address  ...          _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of the AFI address that follows the\n   =
   AS Number field including the AFI field itself.\n\n   AS Number:  the =
32-bit AS number of the autonomous system that has\n      been assigned =
either the EID or RLOC that follows.\n\n   AFI =3D x:  x can be any AFI =
value from [AFI].\n\n   The AS Number Canonical Address Type can be used =
to encode either EID\n   or RLOC addresses.  The former is used to =
describe the LISP-ALT AS\n   number the EID-prefix for the site is being =
carried for.  The latter\n   is used to describe the AS that is carrying =
RLOC based prefixes in\n   the underlying routing =
system.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nFarinacci, et al.         =
Expires July 31, 2014                 [Page 8]\n_\nInternet-Draft    =
LISP Canonical Address Format (LCAF)      January 2014\n\n\n4.3.  Convey =
Application Specific Data\n\n   When a locator-set needs to be conveyed =
based on the type of\n   application or the Per-Hop Behavior (PHB) of a =
packet, the\n   Application Data Type can be used.\n\n   Application =
Data LISP Canonical Address Format:\n\n     0                   1        =
           2                   3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 =
7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 4    _     Rsvd2     _             8 + n             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
      IP TOS, IPv6 TC, or Flow Label          _    Protocol   _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
   Local Port (lower-range)   _    Local Port (upper-range)   _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Remote Port (lower-range)   _   Remote Port (upper-range)   _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _         Address  ...          _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of the AFI address that follows the\n   =
   8-byte Application Data fields including the AFI field itself.\n\n   =
IP TOS, IPv6 TC, or Flow Label:  this field stores the 8-bit IPv4 TOS\n  =
    field used in an IPv4 header, the 8-bit IPv6 Traffic Class or Flow\n =
     Label used in an IPv6 header.\n\n   Local Port/Remote Port Ranges:  =
these fields are from the TCP, UDP,\n      or SCTP transport header.  A =
range can be specified by using a\n      lower value and an upper value. =
 When a single port is encoded,\n      the lower and upper value fields =
are the same.\n\n   AFI =3D x:  x can be any AFI value from [AFI].\n\n   =
The Application Data Canonical Address Type is used for an EID\n   =
encoding when an ITR wants a locator-set for a specific application.\n   =
When used for an RLOC encoding, the ETR is supplying a locator-set\n   =
for each specific application is has been configured to =
advertise.\n\n\n\n\n\n\n\n\n\nFarinacci, et al.         Expires July 31, =
2014                 [Page 9]\n_\nInternet-Draft    LISP Canonical =
Address Format (LCAF)      January 2014\n\n\n4.4.  Assigning Geo =
Coordinates to Locator Addresses\n\n   If an ETR desires to send a =
Map-Reply describing the Geo Coordinates\n   for each locator in its =
locator-set, it can use the Geo Coordinate\n   Type to convey physical =
location information.\n\n   Coordinates are specified using the WGS-84 =
(World Geodetic System)\n   reference coordinate system [WGS-84].\n\n   =
Geo Coordinate LISP Canonical Address Format:\n\n     0                  =
 1                   2                   3\n     0 1 2 3 4 5 6 7 8 9 0 1 =
2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 5    _     Rsvd2     _            12 + n             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    =
_N_     Latitude Degrees        _    Minutes    _    Seconds    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    =
_E_     Longitude Degrees       _    Minutes    _    Seconds    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                           Altitude                           _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _         Address  ...          _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of the AFI address that follows the\n   =
   8-byte Longitude and Latitude fields including the AFI field\n      =
itself.\n\n   N: When set to 1 means North, otherwise South.\n\n   =
Latitude Degrees:  Valid values range from 0 to 90 degrees above or\n    =
  below the equator (northern or southern hemisphere, respectively).\n\n =
  Latitude Minutes:  Valid values range from 0 to 59.\n\n   Latitude =
Seconds:  Valid values range from 0 to 59.\n\n   E: When set to 1 means =
East, otherwise West.\n\n   Longitude Degrees:  Value values are from 0 =
to 180 degrees right or\n      left of the Prime =
Meridian.\n\n\n\n\n\n\n\nFarinacci, et al.         Expires July 31, 2014 =
               [Page 10]\n_\nInternet-Draft    LISP Canonical Address =
Format (LCAF)      January 2014\n\n\n   Longitude Minutes:  Valid values =
range from 0 to 59.\n\n   Longitude Seconds:  Valid values range from 0 =
to 59.\n\n   Altitude:  Height relative to sea level in meters.  This is =
a signed\n      integer meaning that the altitude could be below sea =
level.  A\n      value of 0x7fffffff indicates no Altitude value is =
encoded.\n\n   AFI =3D x:  x can be any AFI value from [AFI].\n\n   The =
Geo Coordinates Canonical Address Type can be used to encode\n   either =
EID or RLOC addresses.  When used for EID encodings, you can\n   =
determine the physical location of an EID along with the topological\n   =
location by observing the =
locator-set.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n=
\n\n\n\n\n\n\nFarinacci, et al.         Expires July 31, 2014            =
    [Page 11]\n_\nInternet-Draft    LISP Canonical Address Format (LCAF) =
     January 2014\n\n\n4.5.  Generic Database Mapping Lookups\n\n   When =
the LISP Mapping Database system holds information accessed by a\n   =
generic formatted key (where the key is not the usual IPv4 or IPv6\n   =
address), an opaque key may be desirable.\n\n   Opaque Key LISP =
Canonical Address Format:\n\n     0                   1                  =
 2                   3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 =
2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 6    _     Rsvd2     _               n               _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
Key Field Num _      Key Wildcard Fields      _   Key . . .   _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                      . . . Key                               _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of the type\'s payload.  The value n\n  =
    is the number of bytes that follow this Length field.\n\n   Key =
Field Num:  the number of fields (minus 1) the key can be broken\n      =
up into.  The width of the fields are fixed length.  So for a key\n      =
size of 8 bytes, with a Key Field Num of 4 allows 4 fields of 2\n      =
bytes in length.  Valid values for this field range from 0 to 15\n      =
supporting a maximum of 16 field separations.\n\n   Key Wildcard Fields: =
 describes which fields in the key are not used\n      as part of the =
key lookup.  This wildcard encoding is a bitfield.\n      Each bit is a =
don\'t-care bit for a corresponding field in the key.\n      Bit 0 (the =
low-order bit) in this bitfield corresponds the first\n      field, =
right-justified in the key, bit 1 the second field, and so\n      on.  =
When a bit is set in the bitfield it is a don\'t-care bit and\n      =
should not be considered as part of the database lookup.  When the\n     =
 entire 16-bits is set to 0, then all bits of the key are used for\n     =
 the database lookup.\n\n   Key:  the variable length key used to do a =
LISP Database Mapping\n      lookup.  The length of the key is the value =
n (shown above) minus\n      3.\n\n\n\n\n\n\n\n\n\nFarinacci, et al.     =
    Expires July 31, 2014                [Page 12]\n_\nInternet-Draft    =
LISP Canonical Address Format (LCAF)      January 2014\n\n\n4.6.  NAT =
Traversal Scenarios\n\n   When a LISP system is conveying global address =
and mapped port\n   information when traversing through a NAT device, =
the NAT-Traversal\n   LCAF Type is used.  See [LISP-NATT] for =
details.\n\n   NAT-Traversal Canonical Address Format:\n\n     0         =
          1                   2                   3\n     0 1 2 3 4 5 6 =
7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 7    _     Rsvd2     _             4 + n             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
      MS UDP Port Number      _      ETR UDP Port Number      _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _  Global ETR RLOC Address  ... _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _       MS RLOC Address  ...    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _ Private ETR RLOC Address  ... _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _      RTR RLOC Address 1 ...   _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _      RTR RLOC Address k ...   _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of the AFI addresses that follows\n     =
 the UDP Port Number field including the AFI fields themselves.\n\n   MS =
UDP Port Number:  this is the UDP port number of the Map-Server\n      =
and is set to 4342.\n\n   ETR UDP Port Number:  this is the port number =
returned to a LISP\n      system which was copied from the source port =
from a packet that\n      has flowed through a NAT device.\n\n   AFI =3D =
x:  x can be any AFI value from [AFI].\n\n   Global ETR RLOC Address:  =
this is an address known to be globally\n      unique built by =
NAT-traversal functionality in a LISP router.\n\n   MS RLOC Address:  =
this is the address of the Map-Server used in the\n      destination =
RLOC of a packet that has flowed through a NAT =
device.\n\n\n\n\n\n\nFarinacci, et al.         Expires July 31, 2014     =
           [Page 13]\n_\nInternet-Draft    LISP Canonical Address Format =
(LCAF)      January 2014\n\n\n   Private ETR RLOC Address:  this is an =
address known to be a private\n      address inserted in this LCAF =
format by a LISP router that resides\n      on the private side of a NAT =
device.\n\n   RTR RLOC Address:  this is an encapsulation address used =
by an ITR or\n      PITR which resides behind a NAT device.  This =
address is known to\n      have state in a NAT device so packets can =
flow from it to the LISP\n      ETR behind the NAT.  There can be one or =
more NTR addresses\n      supplied in these set of fields.  The number =
of NTRs encoded is\n      determined by the LCAF length field.  When =
there are no NTRs\n      supplied, the NTR fields can be omitted and =
reflected by the LCAF\n      length field or an AFI of 0 can be used to =
indicate zero NTRs\n      =
encoded.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n=
\n\n\n\n\n\nFarinacci, et al.         Expires July 31, 2014              =
  [Page 14]\n_\nInternet-Draft    LISP Canonical Address Format (LCAF)   =
   January 2014\n\n\n4.7.  PETR Admission Control Functionality\n\n   =
When a public PETR device wants to verify who is encapsulating to it,\n  =
 it can check for a specific nonce value in the LISP encapsulated\n   =
packet.  To convey the nonce to admitted ITRs or PITRs, this LCAF\n   =
format is used in a Map-Register or Map-Reply locator-record.\n\n   =
Nonce Locator Canonical Address Format:\n\n     0                   1    =
               2                   3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 =
5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 8    _     Rsvd2     _             4 + n             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Reserved    _                  Nonce                        _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _         Address  ...          _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of the AFI address that follows the\n   =
   Nonce field including the AFI field itself.\n\n   Reserved:  must be =
set to zero and ignore on receipt.\n\n   Nonce:  this is a nonce value =
returned by an ETR in a Map-Reply\n      locator-record to be used by an =
ITR or PITR when encapsulating to\n      the locator address encoded in =
the AFI field of this LCAF type.\n\n   AFI =3D x:  x can be any AFI =
value from [AFI].\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nFarinacci, et =
al.         Expires July 31, 2014                [Page =
15]\n_\nInternet-Draft    LISP Canonical Address Format (LCAF)      =
January 2014\n\n\n4.8.  Multicast Group Membership Information\n\n   =
Multicast group information can be published in the mapping database\n   =
so a lookup on an EID based group address can return a replication\n   =
list of group addresses or a unicast addresses for single replication\n  =
 or multiple head-end replications.  The intent of this type of\n   =
unicast replication is to deliver packets to multiple ETRs at\n   =
receiver LISP multicast sites.  The locator-set encoding for this EID\n  =
 record type can be a list of ETRs when they each register with "Merge\n =
  Semantics".  The encoding can be a typical AFI encoded locator\n   =
address.  When an RTR list is being registered (with multiple levels\n   =
according to [LISP-RE]), the Replication List Entry LCAF type is used\n  =
 for locator encoding.\n\n   This LCAF encoding can be used to send =
broadcast packets to all\n   members of a subnet when each EIDs are away =
from their home subnet\n   location.\n\n   Multicast Info Canonical =
Address Format:\n\n     0                   1                   2        =
           3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 =
7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 9    _  Rsvd2  _R_L_J_             8 + n             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                        Instance-ID                           _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
           Reserved           _ Source MaskLen_ Group MaskLen _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _   Source/Subnet Address  ...  _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _       Group Address  ...      _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of fields that follow.\n\n   Reserved:  =
must be set to zero and ignore on receipt.\n\n   R-bit:  this is the =
RP-bit that represents PIM (S,G,RP-bit) multicast\n      state.  This =
bit can be set for Joins (when the J-bit is set) or\n      for Leaves =
(when the L-bit is set).  See [LISP-MRSIG] for more\n      usage =
details.\n\n\n\n\n\n\n\nFarinacci, et al.         Expires July 31, 2014  =
              [Page 16]\n_\nInternet-Draft    LISP Canonical Address =
Format (LCAF)      January 2014\n\n\n   L-bit:  this is the =
Leave-Request bit and is used when this LCAF type\n      is present in =
the destination EID-prefix field of a Map-Request.\n      See =
[LISP-MRSIG] for details.\n\n   J-bit:  this is the Join-Request bit and =
is used when this LCAF type\n      is present in the destination =
EID-prefix field of a Map-Request.\n      See [LISP-MRSIG] for details.  =
The J-bit MUST not be set when the\n      L-bit is also set in the same =
LCAF block.  A receiver should not\n      take any specific Join or =
Leave action when both bits are set.\n\n   Instance ID:  the low-order =
24-bits that can go into a LISP data\n      header when the I-bit is =
set.  See [RFC6830] for details.  The use\n      of the Instance-ID in =
this LCAF type is to associate a multicast\n      forwarding entry for a =
given VPN.  The instance-ID describes the\n      VPN and is registered =
to the mapping database system as a 3-tuple\n      of (Instance-ID, =
S-prefix, G-prefix).\n\n   Source MaskLen:  the mask length of the =
source prefix that follows.\n\n   Group MaskLen:  the mask length of the =
group prefix that follows.\n\n   AFI =3D x:  x can be any AFI value from =
[AFI].  When a specific AFI has\n      its own encoding of a multicast =
address, this field must be either\n      a group address or a broadcast =
address.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nFarinacci,=
 et al.         Expires July 31, 2014                [Page =
17]\n_\nInternet-Draft    LISP Canonical Address Format (LCAF)      =
January 2014\n\n\n4.9.  Traffic Engineering using Re-encapsulating =
Tunnels\n\n   For a given EID lookup into the mapping database, this =
LCAF format\n   can be returned to provide a list of locators in an =
explicit re-\n   encapsulation path.  See [LISP-TE] for details.\n\n   =
Explicit Locator Path (ELP) Canonical Address Format:\n\n     0          =
         1                   2                   3\n     0 1 2 3 4 5 6 7 =
8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 10   _     Rsvd2     _               n               _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          Rsvd3         _L_P_S_           AFI =3D x             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                        Reencap Hop 1  ...                    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          Rsvd3         _L_P_S_           AFI =3D x             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                        Reencap Hop k  ...                    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of fields that follow.\n\n   Lookup bit =
(L):  this is the Lookup bit used to indicate to the user\n      of the =
ELP to not use this address for encapsulation but to look\n      it up =
in the mapping database system to obtain an encapsulating\n      RLOC =
address.\n\n   RLOC-Probe bit (P):  this is the RLOC-probe bit which =
means the\n      Reencap Hop allows RLOC-probe messages to be sent to =
it.  When the\n      R-bit is set to 0, RLOC-probes must not be sent.  =
When a Reencap\n      Hop is an anycast address then multiple physical =
Reencap Hops are\n      using the same RLOC address.  In this case, =
RLOC-probes are not\n      needed because when the closest RLOC address =
is not reachable\n      another RLOC address can reachable.\n\n   Strict =
bit (S):  this the strict bit which means the associated\n      Rencap =
Hop is required to be used.  If this bit is 0, the\n      reencapsulator =
can skip this Reencap Hop and go to the next one in\n      the list.\n\n =
  AFI =3D x:  x can be any AFI value from [AFI].  When a specific AFI =
has\n      its own encoding of a multicast address, this field must be =
either\n      a group address or a broadcast =
address.\n\n\n\n\nFarinacci, et al.         Expires July 31, 2014        =
        [Page 18]\n_\nInternet-Draft    LISP Canonical Address Format =
(LCAF)      January 2014\n\n\n4.10.  Storing Security Data in the =
Mapping Database\n\n   When a locator in a locator-set has a security =
key associated with\n   it, this LCAF format will be used to encode key =
material.  See\n   [LISP-DDT] for details.\n\n   Security Key Canonical =
Address Format:\n\n     0                   1                   2        =
           3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 =
7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 11   _      Rsvd2    _             6 + n             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Key Count   _      Rsvd3    _ Key Algorithm _   Rsvd4     _R_\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          Key Length          _       Key Material ...        _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                       ... Key Material                       _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _       Locator Address ...     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of fields that start with the Key\n     =
 Material field.\n\n   Key Count:  the Key Count field declares the =
number of Key sections\n      included in this LCAF.\n\n   Key =
Algorithm:  the Algorithm field identifies the key\'s\n      =
cryptographic algorithm and specifies the format of the Public Key\n     =
 field.\n\n   R bit:  this is the revoke bit and, if set, it specifies =
that this\n      Key is being Revoked.\n\n   Key Length:  this field =
determines the length in bytes of the Key\n      Material field.\n\n   =
Key Material:  the Key Material field stores the key material.  The\n    =
  format of the key material stored depends on the Key Algorithm\n      =
field.\n\n   AFI =3D x:  x can be any AFI value from [AFI].This is the =
locator\n      address that owns the encoded security =
key.\n\n\n\n\n\nFarinacci, et al.         Expires July 31, 2014          =
      [Page 19]\n_\nInternet-Draft    LISP Canonical Address Format =
(LCAF)      January 2014\n\n\n4.11.  Source/Destination 2-Tuple =
Lookups\n\n   When both a source and destination address of a flow =
needs\n   consideration for different locator-sets, this 2-tuple key is =
used in\n   EID fields in LISP control messages.  When the Source/Dest =
key is\n   registered to the mapping database, it can be encoded as a =
source-\n   prefix and destination-prefix.  When the Source/Dest is used =
as a key\n   for a mapping database lookup the source and destination =
come from a\n   data packet.\n\n   Source/Dest Key Canonical Address =
Format:\n\n     0                   1                   2                =
   3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 =
1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 12   _     Rsvd2     _             4 + n             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
           Reserved           _   Source-ML   _    Dest-ML    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _         Source-Prefix ...     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _     Destination-Prefix ...    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of fields that follow.\n\n   Reserved:  =
must be set to zero and ignore on receipt.\n\n   Source-ML:  the mask =
length of the source prefix that follows.\n\n   Dest-ML:  the mask =
length of the destination prefix that follows.\n\n   AFI =3D x:  x can =
be any AFI value from [AFI].  When a specific AFI has\n      its own =
encoding of a multicast address, this field must be either\n      a =
group address or a broadcast address.\n\n   Refer to [LISP-TE] for usage =
details.\n\n\n\n\n\n\n\n\n\n\n\n\nFarinacci, et al.         Expires July =
31, 2014                [Page 20]\n_\nInternet-Draft    LISP Canonical =
Address Format (LCAF)      January 2014\n\n\n4.12.  Replication List =
Entries for Multicast Forwarding\n\n   The Replication List Entry LCAF =
type is an encoding for a locator\n   being used for unicast replication =
according to the specification in\n   [LISP-RE].  This locator encoding =
is pointed to by a Multicast Info\n   LCAF Type and is registered by =
Re-encapsulating Tunnel Routers (RTRs)\n   that are participating in an =
overlay distribution tree.  Each RTR\n   will register its locator =
address and its configured level in the\n   distribution tree.\n\n   =
Replication List Entry Address Format:\n\n     0                   1     =
              2                   3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 =
5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 13   _    Rsvd2      _             4 + n             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             Rsvd3            _     Rsvd4     _  Level Value  _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _           RTR/ETR #1 ...      _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             Rsvd3            _     Rsvd4     _  Level Value  _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _           RTR/ETR  #n ...     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of fields that follow.\n\n   =
Rsvd{1,2,3,4}:  must be set to zero and ignore on receipt.\n\n   Level =
Value:  this value is associated with the level within the\n      =
overlay distribution tree hierarchy where the RTR resides.  The\n      =
level numbers are ordered from lowest value being close to the ITR\n     =
 (meaning that ITRs replicate to level-0 RTRs) and higher levels\n      =
are further downstream on the distribution tree closer to ETRs of\n      =
multicast receiver sites.\n\n   AFI =3D x:  x can be any AFI value from =
[AFI].  A specific AFI has its\n      own encoding of either a unicast =
or multicast locator address.\n      All RTR/ETR entries for the same =
level should be combined together\n      by a Map-Server to avoid =
searching through the entire multi-level\n      list of locator entries =
in a Map-Reply message.\n\n\n\n\n\n\n\nFarinacci, et al.         Expires =
July 31, 2014                [Page 21]\n_\nInternet-Draft    LISP =
Canonical Address Format (LCAF)      January 2014\n\n\n4.13.  Data Model =
Encoding\n\n   This type allows a JSON data model to be encoded either =
as an EID or\n   RLOC.\n\n   JSON Data Model Type Address Format:\n\n    =
 0                   1                   2                   3\n     0 1 =
2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 14   _    Rsvd2    _B_               n               _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
               JSON binary or text encoding ...               _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _       Optional Address ...    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of fields that follow.\n\n   Rsvd{1,2}: =
 must be set to zero and ignore on receipt.\n\n   B bit:  indicates that =
the JSON field is binary encoded according to\n      [JSON-BINARY] when =
the bit is set to 1.  Otherwise the encoding is\n      based on text =
encoding according to [RFC4627].\n\n   JSON field:  a variable length =
field that contains either binary or\n      text encodings.\n\n   AFI =3D =
x:  x can be any AFI value from [AFI].  A specific AFI has its\n      =
own encoding of either a unicast or multicast locator address.\n      =
All RTR/ETR entries for the same level should be combined together\n     =
 by a Map-Server to avoid searching through the entire multi-level\n     =
 list of locator entries in a Map-Reply =
message.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nFarinacci, et al.         =
Expires July 31, 2014                [Page 22]\n_\nInternet-Draft    =
LISP Canonical Address Format (LCAF)      January 2014\n\n\n4.14.  =
Encoding Key/Value Address Pairs\n\n   The Key/Value pair is for example =
useful for attaching attributes to\n   other elements of LISP packets, =
such as EIDs or RLOCs.  When\n   attaching attributes to EIDs or RLOCs, =
it\'s necessary to distinguish\n   between the element that should be =
used as EID or RLOC, and hence as\n   key for lookups, and additional =
attributes.  This is especially the\n   case when the difference cannot =
be determined from the types of the\n   elements, such as when two IP =
addresses are being used.\n\n   Key/Value Pair Address Format:\n\n     0 =
                  1                   2                   3\n     0 1 2 =
3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 15   _     Rsvd2     _               n               _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _       Address as Key ...      _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D x          _       Address as Value ...    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length value n:  length in bytes of fields that follow.\n\n   Rsvd{1,2}: =
 must be set to zero and ignore on receipt.\n\n   AFI =3D x:  x can be =
any AFI value from [AFI].  A specific AFI has its\n      own encoding of =
either a unicast or multicast locator address.\n      All RTR/ETR =
entries for the same level should be combined together\n      by a =
Map-Server to avoid searching through the entire multi-level\n      list =
of locator entries in a Map-Reply message.\n\n   Address as Key:  this =
AFI encoded address will be attached with the\n      attributes encoded =
in "Address as Value" which follows this field.\n\n   Address as Value:  =
this AFI encoded address will be the attribute\n      address that goes =
along with "Address as Key" which precedes this\n      field.\n\n4.15.  =
Applications for AFI List Type\n\n4.15.1.  Binding IPv4 and IPv6 =
Addresses\n\n   When header translation between IPv4 and IPv6 is =
desirable a LISP\n   Canonical Address can use the AFI List Type to =
carry multiple AFIs in\n   one LCAF AFI.\n\n\n\nFarinacci, et al.        =
 Expires July 31, 2014                [Page 23]\n_\nInternet-Draft    =
LISP Canonical Address Format (LCAF)      January 2014\n\n\n   Address =
Binding LISP Canonical Address Format:\n\n     0                   1     =
              2                   3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 =
5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 1    _     Rsvd2     _         2 + 4 + 2 + 16        _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
           AFI =3D 1            _       IPv4 Address ...        _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
    ...  IPv4 Address         _            AFI =3D 2            _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                         IPv6 Address ...                     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                    ...  IPv6 Address  ...                    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                    ...  IPv6 Address  ...                    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                    ...  IPv6 Address                         _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length:  length in bytes is fixed at 24 when IPv4 and IPv6 AFI\n      =
encoded addresses are used.\n\n   This type of address format can be =
included in a Map-Request when the\n   address is being used as an EID, =
but the Mapping Database System\n   lookup destination can use only the =
IPv4 address.  This is so a\n   Mapping Database Service Transport =
System, such as LISP-ALT\n   [RFC6836], can use the Map-Request =
destination address to route the\n   control message to the desired LISP =
site.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nFarinacci, et al.         =
Expires July 31, 2014                [Page 24]\n_\nInternet-Draft    =
LISP Canonical Address Format (LCAF)      January 2014\n\n\n4.15.2.  =
Layer-2 VPNs\n\n   When MAC addresses are stored in the LISP Mapping =
Database System,\n   the AFI List Type can be used to carry AFI 6.\n\n   =
MAC Address LISP Canonical Address Format:\n\n     0                   1 =
                  2                   3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 =
3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 1    _     Rsvd2     _             2 + 6             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
            AFI =3D 6           _    Layer-2 MAC Address  ...   _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                   ... Layer-2 MAC Address                    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
Length:  length in bytes is fixed at 8 when MAC address AFI encoded\n    =
  addresses are used.\n\n   This address format can be used to connect =
layer-2 domains together\n   using LISP over an IPv4 or IPv6 core =
network to create a layer-2 VPN.\n   In this use-case, a MAC address is =
being used as an EID, and the\n   locator-set that this EID maps to can =
be an IPv4 or IPv6 RLOCs, or\n   even another MAC address being used as =
an RLOC.\n\n4.15.3.  ASCII Names in the Mapping Database\n\n   If DNS =
names or URIs are stored in the LISP Mapping Database System,\n   the =
AFI List Type can be used to carry an ASCII string where it is\n   =
delimited by length \'n\' of the LCAF Length encoding.\n\n   ASCII LISP =
Canonical Address Format:\n\n     0                   1                  =
 2                   3\n     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 =
2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 1    _     Rsvd2     _             2 + n             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
            AFI =3D 17          _      DNS Name or URI  ...     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n\n\n\=
n\n\nFarinacci, et al.         Expires July 31, 2014                =
[Page 25]\n_\nInternet-Draft    LISP Canonical Address Format (LCAF)     =
 January 2014\n\n\n   Length value n:  length in bytes AFI=3D17 field =
and the null-terminated\n      ASCII string (the last byte of 0 is =
included).\n\n4.15.4.  Using Recursive LISP Canonical Address =
Encodings\n\n   When any combination of above is desirable, the AFI List =
Type value\n   can be used to carry within the LCAF AFI another LCAF =
AFI.\n\n   Recursive LISP Canonical Address Format:\n\n     0            =
       1                   2                   3\n     0 1 2 3 4 5 6 7 8 =
9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 1    _     Rsvd2     _         4 + 8 + 2 + 4         _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 4    _     Rsvd2     _              12               _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  IP TOS, IPv6 QQS or Flow Label              _    Protocol   _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          Local Port          _         Remote Port           _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
           AFI =3D 1            _       IPv4 Address ...        _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
    ...  IPv4 Address         _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   Length:  length in bytes is =
fixed at 18 when an AFI=3D1 IPv4 address is\n      included.\n\n   This =
format could be used by a Mapping Database Transport System,\n   such as =
LISP-ALT [RFC6836], where the AFI=3D1 IPv4 address is used as\n   an EID =
and placed in the Map-Request destination address by the\n   sending =
LISP system.  The ALT system can deliver the Map-Request to\n   the LISP =
destination site independent of the Application Data Type\n   AFI =
payload values.  When this AFI is processed by the destination\n   LISP =
site, it can return different locator-sets based on the type of\n   =
application or level of service that is being =
requested.\n\n\n\n\n\n\n\n\n\n\nFarinacci, et al.         Expires July =
31, 2014                [Page 26]\n_\nInternet-Draft    LISP Canonical =
Address Format (LCAF)      January 2014\n\n\n4.15.5.  Compatibility Mode =
Use Case\n\n   A LISP system should use the AFI List Type format when =
sending to\n   LISP systems that do not support a particular LCAF Type =
used to\n   encode locators.  This allows the receiving system to be =
able to\n   parse a locator address for encapsulation purposes.  The =
list of AFIs\n   in an AFI List LCAF Type has no semantic ordering and a =
receiver\n   should parse each AFI element no matter what the =
ordering.\n\n   Compatibility Mode Address Format:\n\n     0             =
      1                   2                   3\n     0 1 2 3 4 5 6 7 8 =
9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 1    _     Rsvd2     _            22 + 6             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
          AFI =3D 16387         _     Rsvd1     _     Flags     _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
  Type =3D 5    _     Rsvd2     _            12 + 2             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    =
_N_     Latitude Degrees        _    Minutes    _    Seconds    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    =
_E_     Longitude Degrees       _    Minutes    _    Seconds    _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                           Altitude                           _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
             AFI =3D 0          _           AFI =3D 1             _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n    _ =
                         IPv4 Address                         _\n    =
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n   =
If a system does not recognized the Geo Coordinate LCAF Type that is\n   =
accompanying a locator address, an encoder can include the Geo\n   =
Coordinate LCAF Type embedded in a AFI List LCAF Type where the AFI\n   =
in the Geo Coordinate LCAF is set to 0 and the AFI encoded next in\n   =
the list is encoded with a valid AFI value to identify the locator\n   =
address.\n\n   A LISP system is required to support the AFI List LCAF =
Type to use\n   this procedure.  It would skip over 10 bytes of the Geo =
Coordinate\n   LCAF Type to get to the locator address encoding (an IPv4 =
locator\n   address).  A LISP system that does support the Geo =
Coordinate LCAF\n   Type can support parsing the locator address within =
the Geo\n   Coordinate LCAF encoding or in the locator encoding that =
follows in\n   the AFI List LCAF.\n\n\n\n\nFarinacci, et al.         =
Expires July 31, 2014                [Page 27]\n_\nInternet-Draft    =
LISP Canonical Address Format (LCAF)      January 2014\n\n\n5.  Security =
Considerations\n\n   There are no security considerations for this =
specification.  The\n   security considerations are documented for the =
protocols that use\n   LISP Canonical Addressing.  Refer to the those =
relevant\n   =
specifications.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\=
n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nFarinacci, et al.         Expires July =
31, 2014                [Page 28]\n_\nInternet-Draft    LISP Canonical =
Address Format (LCAF)      January 2014\n\n\n6.  IANA Considerations\n\n =
  The Address Family AFI definitions from [AFI] only allocate code-\n   =
points for the AFI value itself.  The length of the address or entity\n  =
 that follows is not defined and is implied based on conventional\n   =
experience.  Where the LISP protocol uses LISP Canonical Addresses\n   =
specifically, the address length definitions will be in this\n   =
specification and take precedent over any other specification.\n\n   An =
IANA Registry for LCAF Type values will be created.  The values\n   that =
are considered for use by the main LISP specification [RFC6830]\n   will =
be in the IANA Registry.  Other Type values used for\n   experimentation =
will be defined and described in this =
document.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\=
n\n\n\n\n\n\nFarinacci, et al.         Expires July 31, 2014             =
   [Page 29]\n_\nInternet-Draft    LISP Canonical Address Format (LCAF)  =
    January 2014\n\n\n7.  References\n\n7.1.  Normative References\n\n   =
[RFC1700]  Reynolds, J. and J. Postel, "Assigned Numbers", RFC 1700,\n   =
           October 1994.\n\n   [RFC1918]  Rekhter, Y., Moskowitz, R., =
Karrenberg, D., Groot, G., and\n              E. Lear, "Address =
Allocation for Private Internets",\n              BCP 5, RFC 1918, =
February 1996.\n\n   [RFC4627]  Crockford, D., "The application/json =
Media Type for\n              JavaScript Object Notation (JSON)", RFC =
4627, July 2006.\n\n   [RFC6830]  Farinacci, D., Fuller, V., Meyer, D., =
and D. Lewis, "The\n              Locator/ID Separation Protocol =
(LISP)", RFC 6830,\n              January 2013.\n\n   [RFC6836]  Fuller, =
V., Farinacci, D., Meyer, D., and D. Lewis,\n              "Locator/ID =
Separation Protocol Alternative Logical\n              Topology =
(LISP+ALT)", RFC 6836, January 2013.\n\n7.2.  Informative References\n\n =
  [AFI]      IANA, "Address Family Identifier (AFIs)", ADDRESS FAMILY\n  =
            NUMBERS http://www.iana.org/numbers.html, Febuary 2007.\n\n  =
 [JSON-BINARY]\n              "Universal Binary JSON Specification",\n   =
           URL http://ubjson.org.\n\n   [LISP-DDT]\n              =
Fuller, V., Lewis, D., and V. Ermagan, "LISP Delegated\n              =
Database Tree", draft-ietf-lisp-ddt-01.txt (work in\n              =
progress).\n\n   [LISP-MRSIG]\n              Farinacci, D. and M. =
Napierala, "LISP Control-Plane\n              Multicast Signaling",\n    =
          draft-farinacci-lisp-mr-signaling-03.txt (work in\n            =
  progress).\n\n   [LISP-NATT]\n              Ermagan, V., Farinacci, =
D., Lewis, D., Skriver, J., Maino,\n              F., and C. White, "NAT =
traversal for LISP",\n              =
draft-ermagan-lisp-nat-traversal-03.txt (work in\n              =
progress).\n\n\n\n\nFarinacci, et al.         Expires July 31, 2014      =
          [Page 30]\n_\nInternet-Draft    LISP Canonical Address Format =
(LCAF)      January 2014\n\n\n   [LISP-RE]  Coras, F., =
Cabellos-Aparicio, A., Domingo-Pascual, J.,\n              Maino, F., =
and D. Farinacci, "LISP Replication\n              Engineering", =
draft-coras-lisp-re-03.txt (work in\n              progress).\n\n   =
[LISP-TE]  Farinacci, D., Lahiri, P., and M. Kowal, "LISP Traffic\n      =
        Engineering Use-Cases", draft-farinacci-lisp-te-03.txt\n         =
     (work in progress).\n\n   [WGS-84]   Geodesy and Geophysics =
Department, DoD., "World Geodetic\n              System 1984", NIMA =
TR8350.2, January 2000, _http://\n              =
earth-info.nga.mil/GandG/publications/tr8350.2/\n              =
wgs84fin.pdf_.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n=
\n\n\n\n\n\n\n\n\nFarinacci, et al.         Expires July 31, 2014        =
        [Page 31]\n_\nInternet-Draft    LISP Canonical Address Format =
(LCAF)      January 2014\n\n\nAppendix A.  Acknowledgments\n\n   The =
authors would like to thank Vince Fuller, Gregg Schudel, Jesper\n   =
Skriver, Luigi Iannone, Isidor Kouvelas, and Sander Steffann for\n   =
their technical and editorial commentary.\n\n   The authors would like =
to thank Victor Moreno for discussions that\n   lead to the definition =
of the Multicast Info LCAF type.\n\n   The authors would like to thank =
Parantap Lahiri and Michael Kowal for\n   discussions that lead to the =
definition of the Explicit Locator Path\n   (ELP) LCAF type.\n\n   The =
authors would like to thank Fabio Maino and Vina Ermagan for\n   =
discussions that lead to the definition of the Security Key LCAF\n   =
type.\n\n   The authors would like to thank Albert Cabellos-Aparicio and =
Florin\n   Coras for discussions that lead to the definition of the =
Replication\n   List Entry LCAF type.\n\n   Thanks goes to Michiel =
Blokzijl and Alberto Rodriguez-Natal for\n   suggesting new LCAF =
types.\n\n   Thanks also goes to Terry Manderson for assistance =
obtaining a LISP\n   AFI value from =
IANA.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nFarinacci, et =
al.         Expires July 31, 2014                [Page =
32]\n_\nInternet-Draft    LISP Canonical Address Format (LCAF)      =
January 2014\n\n\nAppendix B.  Document Change Log\n\nB.1.  Changes to =
draft-ietf-lisp-lcaf-04.txt\n\n   o  Submitted January 2014.\n\n   o  =
Agreement among ELP implementors to have the AFI 16-bit field\n      =
adjacent to the address.  This will make the encoding consistent\n      =
with all other LCAF type address encodings.\n\nB.2.  Changes to =
draft-ietf-lisp-lcaf-03.txt\n\n   o  Submitted September 2013.\n\n   o  =
Updated references and author\'s affilations.\n\n   o  Added Instance-ID =
to the Multicast Info Type so there is relative\n      ease in parsing =
(S,G) entries within a VPN.\n\n   o  Add port range encodings to the =
Application Data LCAF Type.\n\n   o  Add a new JSON LCAF Type.\n\n   o  =
Add Address Key/Value LCAF Type to allow attributes to be attached\n     =
 to an address.\n\nB.3.  Changes to draft-ietf-lisp-lcaf-02.txt\n\n   o  =
Submitted March 2013.\n\n   o  Added new LCAF Type "Replication List =
Entry" to support LISP\n      replication engineering use-cases.\n\n   o =
 Changed references to new LISP RFCs.\n\nB.4.  Changes to =
draft-ietf-lisp-lcaf-01.txt\n\n   o  Submitted January 2013.\n\n   o  =
Change longitude range from 0-90 to 0-180 in section 4.4.\n\n   o  Added =
reference to WGS-84 in section 4.4.\n\nB.5.  Changes to =
draft-ietf-lisp-lcaf-00.txt\n\n   o  Posted first working group draft =
August 2012.\n\n\n\n\n\nFarinacci, et al.         Expires July 31, 2014  =
              [Page 33]\n_\nInternet-Draft    LISP Canonical Address =
Format (LCAF)      January 2014\n\n\n   o  This draft was renamed from =
draft-farinacci-lisp-lcaf-10.txt.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\=
n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nFarinacci, =
et al.         Expires July 31, 2014                [Page =
34]\n_\nInternet-Draft    LISP Canonical Address Format (LCAF)      =
January 2014\n\n\nAuthors\' Addresses\n\n   Dino Farinacci\n   =
lispers.net\n   San Jose, CA\n   USA\n\n   Email: =
farinacci@gmail.com\n\n\n   Dave Meyer\n   Brocade\n   San Jose, CA\n   =
USA\n\n   Email: dmm@1-4-5.net\n\n\n   Job Snijders\n   Hibernia =
Networks\n   Tupolevlaan 103a\n   Schiphol-Rijk,   1119 PA\n   NL\n\n   =
Email: =
job.snijders@hibernianetworks.com\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\=
n\n\n\n\n\n\nFarinacci, et al.         Expires July 31, 2014             =
   [Page 35]\n_\n', 'url1': '', 'submit': 'Generate diff', 'url2': '', =
'--newcolour': 'green'} --></body></html>=

--Apple-Mail=_3BC4A146-4E67-4245-89D0-CEAF46C4FA3F
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
	charset=us-ascii




--Apple-Mail=_3BC4A146-4E67-4245-89D0-CEAF46C4FA3F
Content-Disposition: attachment;
	filename=draft-ietf-lisp-lcaf-05.txt
Content-Type: text/plain;
	x-unix-mode=0644;
	name="draft-ietf-lisp-lcaf-05.txt"
Content-Transfer-Encoding: quoted-printable




Network Working Group                                       D. Farinacci
Internet-Draft                                               lispers.net
Intended status: Experimental                                   D. Meyer
Expires: November 7, 2014                                        Brocade
                                                             J. Snijders
                                                       Hibernia Networks
                                                             May 6, 2014


                  LISP Canonical Address Format (LCAF)
                        draft-ietf-lisp-lcaf-05

Abstract

   This draft defines a canonical address format encoding used in LISP
   control messages and in the encoding of lookup keys for the LISP
   Mapping Database System.

Status of this Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on November 7, 2014.

Copyright Notice

   Copyright (c) 2014 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as



Farinacci, et al.       Expires November 7, 2014                [Page 1]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


   described in the Simplified BSD License.


Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
   2.  Definition of Terms  . . . . . . . . . . . . . . . . . . . . .  4
   3.  LISP Canonical Address Format Encodings  . . . . . . . . . . .  5
   4.  LISP Canonical Address Applications  . . . . . . . . . . . . .  7
     4.1.  Segmentation using LISP  . . . . . . . . . . . . . . . . .  7
     4.2.  Carrying AS Numbers in the Mapping Database  . . . . . . .  8
     4.3.  Convey Application Specific Data . . . . . . . . . . . . .  9
     4.4.  Assigning Geo Coordinates to Locator Addresses . . . . . . 10
     4.5.  Generic Database Mapping Lookups . . . . . . . . . . . . . 12
     4.6.  NAT Traversal Scenarios  . . . . . . . . . . . . . . . . . 13
     4.7.  PETR Admission Control Functionality . . . . . . . . . . . 15
     4.8.  Multicast Group Membership Information . . . . . . . . . . 16
     4.9.  Traffic Engineering using Re-encapsulating Tunnels . . . . 18
     4.10. Storing Security Data in the Mapping Database  . . . . . . 19
     4.11. Source/Destination 2-Tuple Lookups . . . . . . . . . . . . 20
     4.12. Replication List Entries for Multicast Forwarding  . . . . 21
     4.13. Data Model Encoding  . . . . . . . . . . . . . . . . . . . 22
     4.14. Encoding Key/Value Address Pairs . . . . . . . . . . . . . 23
     4.15. Applications for AFI List Type . . . . . . . . . . . . . . 23
       4.15.1.  Binding IPv4 and IPv6 Addresses . . . . . . . . . . . 23
       4.15.2.  Layer-2 VPNs  . . . . . . . . . . . . . . . . . . . . 25
       4.15.3.  ASCII Names in the Mapping Database . . . . . . . . . 25
       4.15.4.  Using Recursive LISP Canonical Address Encodings  . . 26
       4.15.5.  Compatibility Mode Use Case . . . . . . . . . . . . . 27
   5.  Security Considerations  . . . . . . . . . . . . . . . . . . . 28
   6.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 29
   7.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 30
     7.1.  Normative References . . . . . . . . . . . . . . . . . . . 30
     7.2.  Informative References . . . . . . . . . . . . . . . . . . 30
   Appendix A.  Acknowledgments . . . . . . . . . . . . . . . . . . . 32
   Appendix B.  Document Change Log . . . . . . . . . . . . . . . . . 33
     B.1.  Changes to draft-ietf-lisp-lcaf-05.txt . . . . . . . . . . 33
     B.2.  Changes to draft-ietf-lisp-lcaf-04.txt . . . . . . . . . . 33
     B.3.  Changes to draft-ietf-lisp-lcaf-03.txt . . . . . . . . . . 33
     B.4.  Changes to draft-ietf-lisp-lcaf-02.txt . . . . . . . . . . 33
     B.5.  Changes to draft-ietf-lisp-lcaf-01.txt . . . . . . . . . . 33
     B.6.  Changes to draft-ietf-lisp-lcaf-00.txt . . . . . . . . . . 34
   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 35








Farinacci, et al.       Expires November 7, 2014                [Page 2]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


1.  Introduction

   The LISP architecture and protocols [RFC6830] introduces two new
   numbering spaces, Endpoint Identifiers (EIDs) and Routing Locators
   (RLOCs) which are intended to replace most use of IP addresses on the
   Internet.  To provide flexibility for current and future
   applications, these values can be encoded in LISP control messages
   using a general syntax that includes Address Family Identifier (AFI),
   length, and value fields.

   Currently defined AFIs include IPv4 and IPv6 addresses, which are
   formatted according to code-points assigned in [AFI] as follows:

   IPv4 Encoded Address:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            AFI =3D 1            |       IPv4 Address ...        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     ...  IPv4 Address         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   IPv6 Encoded Address:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            AFI =3D 2            |       IPv6 Address ...        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                     ...  IPv6 Address  ...                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                     ...  IPv6 Address  ...                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                     ...  IPv6 Address  ...                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     ...  IPv6 Address         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   This document describes the currently-defined AFIs the LISP protocol
   uses along with their encodings and introduces the LISP Canonical
   Address Format (LCAF) that can be used to define the LISP-specific
   encodings for arbitrary AFI values.








Farinacci, et al.       Expires November 7, 2014                [Page 3]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


2.  Definition of Terms

   Address Family Identifier (AFI):  a term used to describe an address
      encoding in a packet.  An address family currently defined for
      IPv4 or IPv6 addresses.  See [AFI] and [RFC1700] for details.  The
      reserved AFI value of 0 is used in this specification to indicate
      an unspecified encoded address where the the length of the address
      is 0 bytes following the 16-bit AFI value of 0.

   Unspecified Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            AFI =3D 0            |    <nothing follows AFI=3D0>    =
|
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Endpoint ID (EID):   a 32-bit (for IPv4) or 128-bit (for IPv6) value
      used in the source and destination address fields of the first
      (most inner) LISP header of a packet.  The host obtains a
      destination EID the same way it obtains a destination address
      today, for example through a DNS lookup or SIP exchange.  The
      source EID is obtained via existing mechanisms used to set a
      host's "local" IP address.  An EID is allocated to a host from an
      EID-prefix block associated with the site where the host is
      located.  An EID can be used by a host to refer to other hosts.

   Routing Locator (RLOC):   the IPv4 or IPv6 address of an egress
      tunnel router (ETR).  It is the output of a EID-to-RLOC mapping
      lookup.  An EID maps to one or more RLOCs.  Typically, RLOCs are
      numbered from topologically aggregatable blocks that are assigned
      to a site at each point to which it attaches to the global
      Internet; where the topology is defined by the connectivity of
      provider networks, RLOCs can be thought of as PA addresses.
      Multiple RLOCs can be assigned to the same ETR device or to
      multiple ETR devices at a site.















Farinacci, et al.       Expires November 7, 2014                [Page 4]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


3.  LISP Canonical Address Format Encodings

   IANA has assigned AFI value 16387 (0x4003) to the LISP architecture
   and protocols.  This specification defines the encoding format of the
   LISP Canonical Address (LCA).

   The first 4 bytes of an LISP Canonical Address are followed by a
   variable length of fields:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |    Type       |     Rsvd2     |            Length             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Rsvd1:  this 8-bit field is reserved for future use and MUST be
      transmitted as 0 and ignored on receipt.

   Flags:  this 8-bit field is for future definition and use.  For now,
      set to zero on transmission and ignored on receipt.

   Type:  this 8-bit field is specific to the LISP Canonical Address
      formatted encodings, values are:

     Type 0:  Null Body Type

     Type 1:  AFI List Type

     Type 2:  Instance ID Type

     Type 3:  AS Number Type

     Type 4:  Application Data Type

     Type 5:  Geo Coordinates Type

     Type 6:  Opaque Key Type

     Type 7:  NAT-Traversal Type

     Type 8:  Nonce Locator Type

     Type 9:  Multicast Info Type






Farinacci, et al.       Expires November 7, 2014                [Page 5]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


     Type 10:  Explicit Locator Path Type

     Type 11:  Security Key Type

     Type 12:  Source/Dest Key Type

     Type 13:  Replication List Entry Type

     Type 14:  JSON Data Model Type

     Type 15:  Key/Value Address Pair Type

   Rsvd2:  this 8-bit field is reserved for future use and MUST be
      transmitted as 0 and ignored on receipt.

   Length:  this 16-bit field is in units of bytes and covers all of the
      LISP Canonical Address payload, starting and including the byte
      after the Length field.  So any LCAF encoded address will have a
      minimum length of 8 bytes when the Length field is 0.  The 8 bytes
      include the AFI, Flags, Type, Reserved, and Length fields.  When
      the AFI is not next to encoded address in a control message, then
      the encoded address will have a minimum length of 6 bytes when the
      Length field is 0.  The 6 bytes include the Flags, Type, Reserved,
      and Length fields.



























Farinacci, et al.       Expires November 7, 2014                [Page 6]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


4.  LISP Canonical Address Applications

4.1.  Segmentation using LISP

   When multiple organizations inside of a LISP site are using private
   addresses [RFC1918] as EID-prefixes, their address spaces must remain
   segregated due to possible address duplication.  An Instance ID in
   the address encoding can aid in making the entire AFI based address
   unique.

   Another use for the Instance ID LISP Canonical Address Format is when
   creating multiple segmented VPNs inside of a LISP site where keeping
   EID-prefix based subnets is desirable.

   Instance ID LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 2    | IID mask-len  |             4 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                         Instance ID                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |         Address  ...          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   IID mask-len:  if the AFI is set to 0, then this format is not
      encoding an extended EID-prefix but rather an instance-ID range
      where the 'IID mask-len' indicates the number of high-order bits
      used in the Instance ID field for the range.

   Length value n:  length in bytes of the AFI address that follows the
      Instance ID field including the AFI field itself.

   Instance ID:  the low-order 24-bits that can go into a LISP data
      header when the I-bit is set.  See [RFC6830] for details.

   AFI =3D x:  x can be any AFI value from [AFI].

   This LISP Canonical Address Type can be used to encode either EID or
   RLOC addresses.








Farinacci, et al.       Expires November 7, 2014                [Page 7]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


4.2.  Carrying AS Numbers in the Mapping Database

   When an AS number is stored in the LISP Mapping Database System for
   either policy or documentation reasons, it can be encoded in a LISP
   Canonical Address.

   AS Number LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 3    |     Rsvd2     |             4 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                           AS Number                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |         Address  ...          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of the AFI address that follows the
      AS Number field including the AFI field itself.

   AS Number:  the 32-bit AS number of the autonomous system that has
      been assigned either the EID or RLOC that follows.

   AFI =3D x:  x can be any AFI value from [AFI].

   The AS Number Canonical Address Type can be used to encode either EID
   or RLOC addresses.  The former is used to describe the LISP-ALT AS
   number the EID-prefix for the site is being carried for.  The latter
   is used to describe the AS that is carrying RLOC based prefixes in
   the underlying routing system.


















Farinacci, et al.       Expires November 7, 2014                [Page 8]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


4.3.  Convey Application Specific Data

   When a locator-set needs to be conveyed based on the type of
   application or the Per-Hop Behavior (PHB) of a packet, the
   Application Data Type can be used.

   Application Data LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 4    |     Rsvd2     |             8 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       IP TOS, IPv6 TC, or Flow Label          |    Protocol   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |    Local Port (lower-range)   |    Local Port (upper-range)   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Remote Port (lower-range)   |   Remote Port (upper-range)   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |         Address  ...          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of the AFI address that follows the
      8-byte Application Data fields including the AFI field itself.

   IP TOS, IPv6 TC, or Flow Label:  this field stores the 8-bit IPv4 TOS
      field used in an IPv4 header, the 8-bit IPv6 Traffic Class or Flow
      Label used in an IPv6 header.

   Local Port/Remote Port Ranges:  these fields are from the TCP, UDP,
      or SCTP transport header.  A range can be specified by using a
      lower value and an upper value.  When a single port is encoded,
      the lower and upper value fields are the same.

   AFI =3D x:  x can be any AFI value from [AFI].

   The Application Data Canonical Address Type is used for an EID
   encoding when an ITR wants a locator-set for a specific application.
   When used for an RLOC encoding, the ETR is supplying a locator-set
   for each specific application is has been configured to advertise.









Farinacci, et al.       Expires November 7, 2014                [Page 9]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


4.4.  Assigning Geo Coordinates to Locator Addresses

   If an ETR desires to send a Map-Reply describing the Geo Coordinates
   for each locator in its locator-set, it can use the Geo Coordinate
   Type to convey physical location information.

   Coordinates are specified using the WGS-84 (World Geodetic System)
   reference coordinate system [WGS-84].

   Geo Coordinate LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 5    |     Rsvd2     |            12 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |N|     Latitude Degrees        |    Minutes    |    Seconds    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |E|     Longitude Degrees       |    Minutes    |    Seconds    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                            Altitude                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |         Address  ...          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of the AFI address that follows the
      8-byte Longitude and Latitude fields including the AFI field
      itself.

   N: When set to 1 means North, otherwise South.

   Latitude Degrees:  Valid values range from 0 to 90 degrees above or
      below the equator (northern or southern hemisphere, respectively).

   Latitude Minutes:  Valid values range from 0 to 59.

   Latitude Seconds:  Valid values range from 0 to 59.

   E: When set to 1 means East, otherwise West.

   Longitude Degrees:  Value values are from 0 to 180 degrees right or
      left of the Prime Meridian.







Farinacci, et al.       Expires November 7, 2014               [Page 10]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


   Longitude Minutes:  Valid values range from 0 to 59.

   Longitude Seconds:  Valid values range from 0 to 59.

   Altitude:  Height relative to sea level in meters.  This is a signed
      integer meaning that the altitude could be below sea level.  A
      value of 0x7fffffff indicates no Altitude value is encoded.

   AFI =3D x:  x can be any AFI value from [AFI].

   The Geo Coordinates Canonical Address Type can be used to encode
   either EID or RLOC addresses.  When used for EID encodings, you can
   determine the physical location of an EID along with the topological
   location by observing the locator-set.





































Farinacci, et al.       Expires November 7, 2014               [Page 11]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


4.5.  Generic Database Mapping Lookups

   When the LISP Mapping Database system holds information accessed by a
   generic formatted key (where the key is not the usual IPv4 or IPv6
   address), an opaque key may be desirable.

   Opaque Key LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 6    |     Rsvd2     |               n               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    | Key Field Num |      Key Wildcard Fields      |   Key . . .   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                       . . . Key                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of the type's payload.  The value n
      is the number of bytes that follow this Length field.

   Key Field Num:  the number of fields (minus 1) the key can be broken
      up into.  The width of the fields are fixed length.  So for a key
      size of 8 bytes, with a Key Field Num of 4 allows 4 fields of 2
      bytes in length.  Valid values for this field range from 0 to 15
      supporting a maximum of 16 field separations.

   Key Wildcard Fields:  describes which fields in the key are not used
      as part of the key lookup.  This wildcard encoding is a bitfield.
      Each bit is a don't-care bit for a corresponding field in the key.
      Bit 0 (the low-order bit) in this bitfield corresponds the first
      field, right-justified in the key, bit 1 the second field, and so
      on.  When a bit is set in the bitfield it is a don't-care bit and
      should not be considered as part of the database lookup.  When the
      entire 16-bits is set to 0, then all bits of the key are used for
      the database lookup.

   Key:  the variable length key used to do a LISP Database Mapping
      lookup.  The length of the key is the value n (shown above) minus
      3.









Farinacci, et al.       Expires November 7, 2014               [Page 12]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


4.6.  NAT Traversal Scenarios

   When a LISP system is conveying global address and mapped port
   information when traversing through a NAT device, the NAT-Traversal
   LCAF Type is used.  See [LISP-NATT] for details.

   NAT-Traversal Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 7    |     Rsvd2     |             4 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |       MS UDP Port Number      |      ETR UDP Port Number      |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |  Global ETR RLOC Address  ... |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |       MS RLOC Address  ...    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          | Private ETR RLOC Address  ... |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |      RTR RLOC Address 1 ...   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |      RTR RLOC Address k ...   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of the AFI addresses that follows
      the UDP Port Number field including the AFI fields themselves.

   MS UDP Port Number:  this is the UDP port number of the Map-Server
      and is set to 4342.

   ETR UDP Port Number:  this is the port number returned to a LISP
      system which was copied from the source port from a packet that
      has flowed through a NAT device.

   AFI =3D x:  x can be any AFI value from [AFI].

   Global ETR RLOC Address:  this is an address known to be globally
      unique built by NAT-traversal functionality in a LISP router.

   MS RLOC Address:  this is the address of the Map-Server used in the
      destination RLOC of a packet that has flowed through a NAT device.






Farinacci, et al.       Expires November 7, 2014               [Page 13]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


   Private ETR RLOC Address:  this is an address known to be a private
      address inserted in this LCAF format by a LISP router that resides
      on the private side of a NAT device.

   RTR RLOC Address:  this is an encapsulation address used by an ITR or
      PITR which resides behind a NAT device.  This address is known to
      have state in a NAT device so packets can flow from it to the LISP
      ETR behind the NAT.  There can be one or more NTR addresses
      supplied in these set of fields.  The number of NTRs encoded is
      determined by the LCAF length field.  When there are no NTRs
      supplied, the NTR fields can be omitted and reflected by the LCAF
      length field or an AFI of 0 can be used to indicate zero NTRs
      encoded.






































Farinacci, et al.       Expires November 7, 2014               [Page 14]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


4.7.  PETR Admission Control Functionality

   When a public PETR device wants to verify who is encapsulating to it,
   it can check for a specific nonce value in the LISP encapsulated
   packet.  To convey the nonce to admitted ITRs or PITRs, this LCAF
   format is used in a Map-Register or Map-Reply locator-record.

   Nonce Locator Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 8    |     Rsvd2     |             4 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Reserved    |                  Nonce                        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |         Address  ...          |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of the AFI address that follows the
      Nonce field including the AFI field itself.

   Reserved:  must be set to zero and ignore on receipt.

   Nonce:  this is a nonce value returned by an ETR in a Map-Reply
      locator-record to be used by an ITR or PITR when encapsulating to
      the locator address encoded in the AFI field of this LCAF type.

   AFI =3D x:  x can be any AFI value from [AFI].




















Farinacci, et al.       Expires November 7, 2014               [Page 15]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


4.8.  Multicast Group Membership Information

   Multicast group information can be published in the mapping database
   so a lookup on an EID based group address can return a replication
   list of group addresses or a unicast addresses for single replication
   or multiple head-end replications.  The intent of this type of
   unicast replication is to deliver packets to multiple ETRs at
   receiver LISP multicast sites.  The locator-set encoding for this EID
   record type can be a list of ETRs when they each register with "Merge
   Semantics".  The encoding can be a typical AFI encoded locator
   address.  When an RTR list is being registered (with multiple levels
   according to [LISP-RE]), the Replication List Entry LCAF type is used
   for locator encoding.

   This LCAF encoding can be used to send broadcast packets to all
   members of a subnet when each EIDs are away from their home subnet
   location.

   Multicast Info Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 9    |  Rsvd2  |R|L|J|             8 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                         Instance-ID                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            Reserved           | Source MaskLen| Group MaskLen |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |   Source/Subnet Address  ...  |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |       Group Address  ...      |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of fields that follow.

   Reserved:  must be set to zero and ignore on receipt.

   R-bit:  this is the RP-bit that represents PIM (S,G,RP-bit) multicast
      state.  This bit can be set for Joins (when the J-bit is set) or
      for Leaves (when the L-bit is set).  See [LISP-MRSIG] for more
      usage details.







Farinacci, et al.       Expires November 7, 2014               [Page 16]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


   L-bit:  this is the Leave-Request bit and is used when this LCAF type
      is present in the destination EID-prefix field of a Map-Request.
      See [LISP-MRSIG] for details.

   J-bit:  this is the Join-Request bit and is used when this LCAF type
      is present in the destination EID-prefix field of a Map-Request.
      See [LISP-MRSIG] for details.  The J-bit MUST not be set when the
      L-bit is also set in the same LCAF block.  A receiver should not
      take any specific Join or Leave action when both bits are set.

   Instance ID:  the low-order 24-bits that can go into a LISP data
      header when the I-bit is set.  See [RFC6830] for details.  The use
      of the Instance-ID in this LCAF type is to associate a multicast
      forwarding entry for a given VPN.  The instance-ID describes the
      VPN and is registered to the mapping database system as a 3-tuple
      of (Instance-ID, S-prefix, G-prefix).

   Source MaskLen:  the mask length of the source prefix that follows.

   Group MaskLen:  the mask length of the group prefix that follows.

   AFI =3D x:  x can be any AFI value from [AFI].  When a specific AFI =
has
      its own encoding of a multicast address, this field must be either
      a group address or a broadcast address.



























Farinacci, et al.       Expires November 7, 2014               [Page 17]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


4.9.  Traffic Engineering using Re-encapsulating Tunnels

   For a given EID lookup into the mapping database, this LCAF format
   can be returned to provide a list of locators in an explicit re-
   encapsulation path.  See [LISP-TE] for details.

   Explicit Locator Path (ELP) Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 10   |     Rsvd2     |               n               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Rsvd3         |L|P|S|           AFI =3D x             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                         Reencap Hop 1  ...                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Rsvd3         |L|P|S|           AFI =3D x             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                         Reencap Hop k  ...                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of fields that follow.

   Lookup bit (L):  this is the Lookup bit used to indicate to the user
      of the ELP to not use this address for encapsulation but to look
      it up in the mapping database system to obtain an encapsulating
      RLOC address.

   RLOC-Probe bit (P):  this is the RLOC-probe bit which means the
      Reencap Hop allows RLOC-probe messages to be sent to it.  When the
      R-bit is set to 0, RLOC-probes must not be sent.  When a Reencap
      Hop is an anycast address then multiple physical Reencap Hops are
      using the same RLOC address.  In this case, RLOC-probes are not
      needed because when the closest RLOC address is not reachable
      another RLOC address can reachable.

   Strict bit (S):  this the strict bit which means the associated
      Rencap Hop is required to be used.  If this bit is 0, the
      reencapsulator can skip this Reencap Hop and go to the next one in
      the list.

   AFI =3D x:  x can be any AFI value from [AFI].  When a specific AFI =
has
      its own encoding of a multicast address, this field must be either
      a group address or a broadcast address.




Farinacci, et al.       Expires November 7, 2014               [Page 18]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


4.10.  Storing Security Data in the Mapping Database

   When a locator in a locator-set has a security key associated with
   it, this LCAF format will be used to encode key material.  See
   [LISP-DDT] for details.

   Security Key Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 11   |      Rsvd2    |             6 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Key Count   |      Rsvd3    | Key Algorithm |   Rsvd4     |R|
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Key Length          |       Key Material ...        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                        ... Key Material                       |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |       Locator Address ...     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of fields that start with the Key
      Material field.

   Key Count:  the Key Count field declares the number of Key sections
      included in this LCAF.

   Key Algorithm:  the Algorithm field identifies the key's
      cryptographic algorithm and specifies the format of the Public Key
      field.

   R bit:  this is the revoke bit and, if set, it specifies that this
      Key is being Revoked.

   Key Length:  this field determines the length in bytes of the Key
      Material field.

   Key Material:  the Key Material field stores the key material.  The
      format of the key material stored depends on the Key Algorithm
      field.

   AFI =3D x:  x can be any AFI value from [AFI].This is the locator
      address that owns the encoded security key.





Farinacci, et al.       Expires November 7, 2014               [Page 19]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


4.11.  Source/Destination 2-Tuple Lookups

   When both a source and destination address of a flow needs
   consideration for different locator-sets, this 2-tuple key is used in
   EID fields in LISP control messages.  When the Source/Dest key is
   registered to the mapping database, it can be encoded as a source-
   prefix and destination-prefix.  When the Source/Dest is used as a key
   for a mapping database lookup the source and destination come from a
   data packet.

   Source/Dest Key Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 12   |     Rsvd2     |             4 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            Reserved           |   Source-ML   |    Dest-ML    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |         Source-Prefix ...     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |     Destination-Prefix ...    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of fields that follow.

   Reserved:  must be set to zero and ignore on receipt.

   Source-ML:  the mask length of the source prefix that follows.

   Dest-ML:  the mask length of the destination prefix that follows.

   AFI =3D x:  x can be any AFI value from [AFI].  When a specific AFI =
has
      its own encoding of a multicast address, this field must be either
      a group address or a broadcast address.

   Refer to [LISP-TE] for usage details.












Farinacci, et al.       Expires November 7, 2014               [Page 20]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


4.12.  Replication List Entries for Multicast Forwarding

   The Replication List Entry LCAF type is an encoding for a locator
   being used for unicast replication according to the specification in
   [LISP-RE].  This locator encoding is pointed to by a Multicast Info
   LCAF Type and is registered by Re-encapsulating Tunnel Routers (RTRs)
   that are participating in an overlay distribution tree.  Each RTR
   will register its locator address and its configured level in the
   distribution tree.

   Replication List Entry Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 13   |    Rsvd2      |             4 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              Rsvd3            |     Rsvd4     |  Level Value  |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |           RTR/ETR #1 ...      |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              Rsvd3            |     Rsvd4     |  Level Value  |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |           RTR/ETR  #n ...     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of fields that follow.

   Rsvd{1,2,3,4}:  must be set to zero and ignore on receipt.

   Level Value:  this value is associated with the level within the
      overlay distribution tree hierarchy where the RTR resides.  The
      level numbers are ordered from lowest value being close to the ITR
      (meaning that ITRs replicate to level-0 RTRs) and higher levels
      are further downstream on the distribution tree closer to ETRs of
      multicast receiver sites.

   AFI =3D x:  x can be any AFI value from [AFI].  A specific AFI has =
its
      own encoding of either a unicast or multicast locator address.
      All RTR/ETR entries for the same level should be combined together
      by a Map-Server to avoid searching through the entire multi-level
      list of locator entries in a Map-Reply message.







Farinacci, et al.       Expires November 7, 2014               [Page 21]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


4.13.  Data Model Encoding

   This type allows a JSON data model to be encoded either as an EID or
   RLOC.

   JSON Data Model Type Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 14   |    Rsvd2    |B|               n               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           JSON length         | JSON binary/text encoding ... |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |       Optional Address ...    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of fields that follow.

   Rsvd{1,2}:  must be set to zero and ignore on receipt.

   B bit:  indicates that the JSON field is binary encoded according to
      [JSON-BINARY] when the bit is set to 1.  Otherwise the encoding is
      based on text encoding according to [RFC4627].

   JSON length:  length in octets of the following 'JSON binary/text
      encoding' field.

   JSON binary/text encoding field:  a variable length field that
      contains either binary or text encodings.

   AFI =3D x:  x can be any AFI value from [AFI].  A specific AFI has =
its
      own encoding of either a unicast or multicast locator address.
      All RTR/ETR entries for the same level should be combined together
      by a Map-Server to avoid searching through the entire multi-level
      list of locator entries in a Map-Reply message.













Farinacci, et al.       Expires November 7, 2014               [Page 22]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


4.14.  Encoding Key/Value Address Pairs

   The Key/Value pair is for example useful for attaching attributes to
   other elements of LISP packets, such as EIDs or RLOCs.  When
   attaching attributes to EIDs or RLOCs, it's necessary to distinguish
   between the element that should be used as EID or RLOC, and hence as
   key for lookups, and additional attributes.  This is especially the
   case when the difference cannot be determined from the types of the
   elements, such as when two IP addresses are being used.

   Key/Value Pair Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 15   |     Rsvd2     |               n               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |       Address as Key ...      |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D x          |       Address as Value ...    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length value n:  length in bytes of fields that follow.

   Rsvd{1,2}:  must be set to zero and ignore on receipt.

   AFI =3D x:  x can be any AFI value from [AFI].  A specific AFI has =
its
      own encoding of either a unicast or multicast locator address.
      All RTR/ETR entries for the same level should be combined together
      by a Map-Server to avoid searching through the entire multi-level
      list of locator entries in a Map-Reply message.

   Address as Key:  this AFI encoded address will be attached with the
      attributes encoded in "Address as Value" which follows this field.

   Address as Value:  this AFI encoded address will be the attribute
      address that goes along with "Address as Key" which precedes this
      field.

4.15.  Applications for AFI List Type

4.15.1.  Binding IPv4 and IPv6 Addresses

   When header translation between IPv4 and IPv6 is desirable a LISP
   Canonical Address can use the AFI List Type to carry multiple AFIs in
   one LCAF AFI.



Farinacci, et al.       Expires November 7, 2014               [Page 23]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


   Address Binding LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 1    |     Rsvd2     |         2 + 4 + 2 + 16        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            AFI =3D 1            |       IPv4 Address ...        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     ...  IPv4 Address         |            AFI =3D 2            |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                          IPv6 Address ...                     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                     ...  IPv6 Address  ...                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                     ...  IPv6 Address  ...                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                     ...  IPv6 Address                         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length:  length in bytes is fixed at 24 when IPv4 and IPv6 AFI
      encoded addresses are used.

   This type of address format can be included in a Map-Request when the
   address is being used as an EID, but the Mapping Database System
   lookup destination can use only the IPv4 address.  This is so a
   Mapping Database Service Transport System, such as LISP-ALT
   [RFC6836], can use the Map-Request destination address to route the
   control message to the desired LISP site.




















Farinacci, et al.       Expires November 7, 2014               [Page 24]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


4.15.2.  Layer-2 VPNs

   When MAC addresses are stored in the LISP Mapping Database System,
   the AFI List Type can be used to carry AFI 6.

   MAC Address LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 1    |     Rsvd2     |             2 + 6             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |             AFI =3D 6           |    Layer-2 MAC Address  ...   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                    ... Layer-2 MAC Address                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length:  length in bytes is fixed at 8 when MAC address AFI encoded
      addresses are used.

   This address format can be used to connect layer-2 domains together
   using LISP over an IPv4 or IPv6 core network to create a layer-2 VPN.
   In this use-case, a MAC address is being used as an EID, and the
   locator-set that this EID maps to can be an IPv4 or IPv6 RLOCs, or
   even another MAC address being used as an RLOC.

4.15.3.  ASCII Names in the Mapping Database

   If DNS names or URIs are stored in the LISP Mapping Database System,
   the AFI List Type can be used to carry an ASCII string where it is
   delimited by length 'n' of the LCAF Length encoding.

   ASCII LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 1    |     Rsvd2     |             2 + n             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |             AFI =3D 17          |      DNS Name or URI  ...     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+






Farinacci, et al.       Expires November 7, 2014               [Page 25]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


   Length value n:  length in bytes AFI=3D17 field and the =
null-terminated
      ASCII string (the last byte of 0 is included).

4.15.4.  Using Recursive LISP Canonical Address Encodings

   When any combination of above is desirable, the AFI List Type value
   can be used to carry within the LCAF AFI another LCAF AFI.

   Recursive LISP Canonical Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 1    |     Rsvd2     |         4 + 8 + 2 + 4         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 4    |     Rsvd2     |              12               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   IP TOS, IPv6 QQS or Flow Label              |    Protocol   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Local Port          |         Remote Port           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |            AFI =3D 1            |       IPv4 Address ...        |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     ...  IPv4 Address         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Length:  length in bytes is fixed at 18 when an AFI=3D1 IPv4 address =
is
      included.

   This format could be used by a Mapping Database Transport System,
   such as LISP-ALT [RFC6836], where the AFI=3D1 IPv4 address is used as
   an EID and placed in the Map-Request destination address by the
   sending LISP system.  The ALT system can deliver the Map-Request to
   the LISP destination site independent of the Application Data Type
   AFI payload values.  When this AFI is processed by the destination
   LISP site, it can return different locator-sets based on the type of
   application or level of service that is being requested.










Farinacci, et al.       Expires November 7, 2014               [Page 26]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


4.15.5.  Compatibility Mode Use Case

   A LISP system should use the AFI List Type format when sending to
   LISP systems that do not support a particular LCAF Type used to
   encode locators.  This allows the receiving system to be able to
   parse a locator address for encapsulation purposes.  The list of AFIs
   in an AFI List LCAF Type has no semantic ordering and a receiver
   should parse each AFI element no matter what the ordering.

   Compatibility Mode Address Format:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 1    |     Rsvd2     |            22 + 6             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           AFI =3D 16387         |     Rsvd1     |     Flags     |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |   Type =3D 5    |     Rsvd2     |            12 + 2             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |N|     Latitude Degrees        |    Minutes    |    Seconds    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |E|     Longitude Degrees       |    Minutes    |    Seconds    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                            Altitude                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |              AFI =3D 0          |           AFI =3D 1             =
|
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                          IPv4 Address                         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   If a system does not recognized the Geo Coordinate LCAF Type that is
   accompanying a locator address, an encoder can include the Geo
   Coordinate LCAF Type embedded in a AFI List LCAF Type where the AFI
   in the Geo Coordinate LCAF is set to 0 and the AFI encoded next in
   the list is encoded with a valid AFI value to identify the locator
   address.

   A LISP system is required to support the AFI List LCAF Type to use
   this procedure.  It would skip over 10 bytes of the Geo Coordinate
   LCAF Type to get to the locator address encoding (an IPv4 locator
   address).  A LISP system that does support the Geo Coordinate LCAF
   Type can support parsing the locator address within the Geo
   Coordinate LCAF encoding or in the locator encoding that follows in
   the AFI List LCAF.




Farinacci, et al.       Expires November 7, 2014               [Page 27]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


5.  Security Considerations

   There are no security considerations for this specification.  The
   security considerations are documented for the protocols that use
   LISP Canonical Addressing.  Refer to the those relevant
   specifications.













































Farinacci, et al.       Expires November 7, 2014               [Page 28]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


6.  IANA Considerations

   The Address Family AFI definitions from [AFI] only allocate code-
   points for the AFI value itself.  The length of the address or entity
   that follows is not defined and is implied based on conventional
   experience.  Where the LISP protocol uses LISP Canonical Addresses
   specifically, the address length definitions will be in this
   specification and take precedent over any other specification.

   An IANA Registry for LCAF Type values will be created.  The values
   that are considered for use by the main LISP specification [RFC6830]
   will be in the IANA Registry.  Other Type values used for
   experimentation will be defined and described in this document.






































Farinacci, et al.       Expires November 7, 2014               [Page 29]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


7.  References

7.1.  Normative References

   [RFC1700]  Reynolds, J. and J. Postel, "Assigned Numbers", RFC 1700,
              October 1994.

   [RFC1918]  Rekhter, Y., Moskowitz, R., Karrenberg, D., Groot, G., and
              E. Lear, "Address Allocation for Private Internets",
              BCP 5, RFC 1918, February 1996.

   [RFC4627]  Crockford, D., "The application/json Media Type for
              JavaScript Object Notation (JSON)", RFC 4627, July 2006.

   [RFC6830]  Farinacci, D., Fuller, V., Meyer, D., and D. Lewis, "The
              Locator/ID Separation Protocol (LISP)", RFC 6830,
              January 2013.

   [RFC6836]  Fuller, V., Farinacci, D., Meyer, D., and D. Lewis,
              "Locator/ID Separation Protocol Alternative Logical
              Topology (LISP+ALT)", RFC 6836, January 2013.

7.2.  Informative References

   [AFI]      IANA, "Address Family Identifier (AFIs)", ADDRESS FAMILY
              NUMBERS http://www.iana.org/numbers.html, Febuary 2007.

   [JSON-BINARY]
              "Universal Binary JSON Specification",
              URL http://ubjson.org.

   [LISP-DDT]
              Fuller, V., Lewis, D., and V. Ermagan, "LISP Delegated
              Database Tree", draft-ietf-lisp-ddt-01.txt (work in
              progress).

   [LISP-MRSIG]
              Farinacci, D. and M. Napierala, "LISP Control-Plane
              Multicast Signaling",
              draft-farinacci-lisp-mr-signaling-03.txt (work in
              progress).

   [LISP-NATT]
              Ermagan, V., Farinacci, D., Lewis, D., Skriver, J., Maino,
              F., and C. White, "NAT traversal for LISP",
              draft-ermagan-lisp-nat-traversal-03.txt (work in
              progress).




Farinacci, et al.       Expires November 7, 2014               [Page 30]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


   [LISP-RE]  Coras, F., Cabellos-Aparicio, A., Domingo-Pascual, J.,
              Maino, F., and D. Farinacci, "LISP Replication
              Engineering", draft-coras-lisp-re-03.txt (work in
              progress).

   [LISP-TE]  Farinacci, D., Lahiri, P., and M. Kowal, "LISP Traffic
              Engineering Use-Cases", draft-farinacci-lisp-te-03.txt
              (work in progress).

   [WGS-84]   Geodesy and Geophysics Department, DoD., "World Geodetic
              System 1984", NIMA TR8350.2, January 2000, <http://
              earth-info.nga.mil/GandG/publications/tr8350.2/
              wgs84fin.pdf>.






































Farinacci, et al.       Expires November 7, 2014               [Page 31]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


Appendix A.  Acknowledgments

   The authors would like to thank Vince Fuller, Gregg Schudel, Jesper
   Skriver, Luigi Iannone, Isidor Kouvelas, and Sander Steffann for
   their technical and editorial commentary.

   The authors would like to thank Victor Moreno for discussions that
   lead to the definition of the Multicast Info LCAF type.

   The authors would like to thank Parantap Lahiri and Michael Kowal for
   discussions that lead to the definition of the Explicit Locator Path
   (ELP) LCAF type.

   The authors would like to thank Fabio Maino and Vina Ermagan for
   discussions that lead to the definition of the Security Key LCAF
   type.

   The authors would like to thank Albert Cabellos-Aparicio and Florin
   Coras for discussions that lead to the definition of the Replication
   List Entry LCAF type.

   Thanks goes to Michiel Blokzijl and Alberto Rodriguez-Natal for
   suggesting new LCAF types.

   Thanks also goes to Terry Manderson for assistance obtaining a LISP
   AFI value from IANA.

























Farinacci, et al.       Expires November 7, 2014               [Page 32]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


Appendix B.  Document Change Log

B.1.  Changes to draft-ietf-lisp-lcaf-05.txt

   o  Submitted May 2014.

   o  Add a length field of the JSON payload that can be used for either
      binary or text encoding of JSON data.

B.2.  Changes to draft-ietf-lisp-lcaf-04.txt

   o  Submitted January 2014.

   o  Agreement among ELP implementors to have the AFI 16-bit field
      adjacent to the address.  This will make the encoding consistent
      with all other LCAF type address encodings.

B.3.  Changes to draft-ietf-lisp-lcaf-03.txt

   o  Submitted September 2013.

   o  Updated references and author's affilations.

   o  Added Instance-ID to the Multicast Info Type so there is relative
      ease in parsing (S,G) entries within a VPN.

   o  Add port range encodings to the Application Data LCAF Type.

   o  Add a new JSON LCAF Type.

   o  Add Address Key/Value LCAF Type to allow attributes to be attached
      to an address.

B.4.  Changes to draft-ietf-lisp-lcaf-02.txt

   o  Submitted March 2013.

   o  Added new LCAF Type "Replication List Entry" to support LISP
      replication engineering use-cases.

   o  Changed references to new LISP RFCs.

B.5.  Changes to draft-ietf-lisp-lcaf-01.txt

   o  Submitted January 2013.

   o  Change longitude range from 0-90 to 0-180 in section 4.4.




Farinacci, et al.       Expires November 7, 2014               [Page 33]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


   o  Added reference to WGS-84 in section 4.4.

B.6.  Changes to draft-ietf-lisp-lcaf-00.txt

   o  Posted first working group draft August 2012.

   o  This draft was renamed from draft-farinacci-lisp-lcaf-10.txt.












































Farinacci, et al.       Expires November 7, 2014               [Page 34]
=0C
Internet-Draft    LISP Canonical Address Format (LCAF)          May 2014


Authors' Addresses

   Dino Farinacci
   lispers.net
   San Jose, CA
   USA

   Email: farinacci@gmail.com


   Dave Meyer
   Brocade
   San Jose, CA
   USA

   Email: dmm@1-4-5.net


   Job Snijders
   Hibernia Networks
   Tupolevlaan 103a
   Schiphol-Rijk,   1119 PA
   NL

   Email: job.snijders@hibernianetworks.com


























Farinacci, et al.       Expires November 7, 2014               [Page 35]
=0C

--Apple-Mail=_3BC4A146-4E67-4245-89D0-CEAF46C4FA3F
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
	charset=us-ascii




--Apple-Mail=_3BC4A146-4E67-4245-89D0-CEAF46C4FA3F--


From nobody Tue May  6 08:43:43 2014
Return-Path: <internet-drafts@ietf.org>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F0181A077E; Tue,  6 May 2014 08:43:34 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jFg1L6XbDp9Z; Tue,  6 May 2014 08:43:32 -0700 (PDT)
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E77A21A0391; Tue,  6 May 2014 08:43:31 -0700 (PDT)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: internet-drafts@ietf.org
To: i-d-announce@ietf.org
X-Test-IDTracker: no
X-IETF-IDTracker: 5.4.2
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <20140506154331.6259.59551.idtracker@ietfa.amsl.com>
Date: Tue, 06 May 2014 08:43:31 -0700
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/-wc0MLXc4_Drlq7eVRtpth7cOIM
Cc: lisp@ietf.org
Subject: [lisp] I-D Action: draft-ietf-lisp-lcaf-05.txt
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 06 May 2014 15:43:34 -0000

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Locator/ID Separation Protocol Working Group of the IETF.

        Title           : LISP Canonical Address Format (LCAF)
        Authors         : Dino Farinacci
                          Dave Meyer
                          Job Snijders
	Filename        : draft-ietf-lisp-lcaf-05.txt
	Pages           : 35
	Date            : 2014-05-06

Abstract:
   This draft defines a canonical address format encoding used in LISP
   control messages and in the encoding of lookup keys for the LISP
   Mapping Database System.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-lisp-lcaf/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-lisp-lcaf-05

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-lisp-lcaf-05


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/


From nobody Fri May  9 08:54:05 2014
Return-Path: <jmh@joelhalpern.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51F881A0059 for <lisp@ietfa.amsl.com>; Fri,  9 May 2014 08:54:03 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.502
X-Spam-Level: 
X-Spam-Status: No, score=-0.502 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1H6yLLlJl6iy for <lisp@ietfa.amsl.com>; Fri,  9 May 2014 08:54:01 -0700 (PDT)
Received: from mailc2.tigertech.net (mailc2.tigertech.net [208.80.4.156]) by ietfa.amsl.com (Postfix) with ESMTP id DA6AC1A02E8 for <lisp@ietf.org>; Fri,  9 May 2014 08:54:01 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mailc2.tigertech.net (Postfix) with ESMTP id 4A8131C2655B for <lisp@ietf.org>; Fri,  9 May 2014 08:53:57 -0700 (PDT)
X-Virus-Scanned: Debian amavisd-new at c2.tigertech.net
Received: from Joels-MacBook-Pro.local (unknown [190.112.55.105]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mailc2.tigertech.net (Postfix) with ESMTPSA id F09B91C26556 for <lisp@ietf.org>; Fri,  9 May 2014 08:53:56 -0700 (PDT)
Message-ID: <536CFA13.4010102@joelhalpern.com>
Date: Fri, 09 May 2014 11:53:55 -0400
From: "Joel M. Halpern" <jmh@joelhalpern.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.5.0
MIME-Version: 1.0
To: "lisp@ietf.org" <lisp@ietf.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/8WrDuVgrvk5iTU0a-rdsh_w83-E
Subject: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 09 May 2014 15:54:03 -0000

Sorry for the delay getting this out.
This email starts a new (and hopefully final) last call on 
draft-ietf-lisp-threats, version 9:
http://datatracker.ietf.org/doc/draft-ietf-lisp-threats/

The last call will end in two weeks, close of business 23-May-2014.

Thank you,
Joel


From nobody Mon May 12 10:11:45 2014
Return-Path: <rcallon@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ADD951A073E for <lisp@ietfa.amsl.com>; Mon, 12 May 2014 10:11:42 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Level: 
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MUSMA9D-fFb2 for <lisp@ietfa.amsl.com>; Mon, 12 May 2014 10:11:34 -0700 (PDT)
Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1blp0190.outbound.protection.outlook.com [207.46.163.190]) by ietfa.amsl.com (Postfix) with ESMTP id C22501A072A for <lisp@ietf.org>; Mon, 12 May 2014 10:11:33 -0700 (PDT)
Received: from CO2PR05MB634.namprd05.prod.outlook.com (10.141.199.17) by CO2PR05MB747.namprd05.prod.outlook.com (10.141.227.147) with Microsoft SMTP Server (TLS) id 15.0.929.12; Mon, 12 May 2014 17:11:26 +0000
Received: from CO2PR05MB636.namprd05.prod.outlook.com (10.141.199.24) by CO2PR05MB634.namprd05.prod.outlook.com (10.141.199.17) with Microsoft SMTP Server (TLS) id 15.0.929.12; Mon, 12 May 2014 17:11:24 +0000
Received: from CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) by CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) with mapi id 15.00.0929.001; Mon, 12 May 2014 17:11:23 +0000
From: Ross Callon <rcallon@juniper.net>
To: "Joel M. Halpern" <jmh@joelhalpern.com>, "lisp@ietf.org" <lisp@ietf.org>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58M9eFhkxJvMEaw1MEc+Ryfdps9FMJA
Date: Mon, 12 May 2014 17:11:23 +0000
Message-ID: <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com>
In-Reply-To: <536CFA13.4010102@joelhalpern.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.14]
x-forefront-prvs: 0209425D0A
x-forefront-antispam-report: SFV:NSPM; SFS:(10009001)(6009001)(428001)(13464003)(189002)(199002)(377454003)(164054003)(51444003)(77982001)(31966008)(66066001)(4396001)(46102001)(54356999)(87936001)(76576001)(74662001)(2656002)(79102001)(85852003)(92566001)(99286001)(33646001)(86362001)(83072002)(76176999)(50986999)(15202345003)(74502001)(15975445006)(81342001)(80022001)(77096999)(83322001)(20776003)(551544002)(19580395003)(19580405001)(81542001)(99396002)(74316001)(76482001)(101416001)(24736002); DIR:OUT; SFP:1101; SCL:1; SRVR:CO2PR05MB634; H:CO2PR05MB636.namprd05.prod.outlook.com; FPR:EE5FF1D9.A7FA138E.B9F7318B.4AE4CB11.20843; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/inGOlVWADvdXzUhydlp-9N0nF20
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 12 May 2014 17:11:42 -0000

Thanks Joel;

I think that draft-ietf-lisp-threats-09.txt is a start towards a threats do=
cument, but that it has serious omissions and needs more work before being =
progressed. Here are some specific comments:=20


Section 2 (On-path Attackers), first paragraph:=20

   On-path attackers are attackers that are able to capture and modify
   all the packets exchanged between an Ingress Tunnel Router (ITR) and
   an Egress Tunnel Router (ETR).  To cope with such an attacker,
   cryptographic techniques such as those used by IPSec ([RFC4301]) are
   required.  As with IP, LISP relies on higher layer cryptography to
   secure packet payloads from on path attacks, so this document does
   not consider on-path attackers.

To me an on-path attacker is one which is on the data path. Such an attacke=
r might attack the contents of the data packet. In this case the paragraph =
seems mostly correct to me: You encrypt the contents if you don't want some=
one on the path to the destination to look at the contents. However, as is =
discussed later in the document, LISP allows systems which are not in the n=
ormal physical path, through a gleaning attack, to inject themselves into t=
he data path. This could be applied to allow attacker's systems to inject t=
hemselves into the path of the key management protocol. This implies that a=
 legitimate user could get keys supplied by an attacker, just as easily as =
it could get keys supplied by a legitimate Internet site. If you are propos=
ing that end to end encryption is the solution to on path attackers then yo=
u need to understand the implications of LISP on the operation of the proto=
col needed for key management to support end to end encryption.=20

Also, you should mention in this section that a gleaning attack would allow=
 at least in the short term for an attacker to become temporarily on-path e=
ven if they are not on what should be the normal path to the destination.=20

An on-path attacker might choose to only change something about the LISP ha=
ndling details, such as exploding the map cache or redirecting a user to a =
different site. Some of this is mentioned later in the document. One thing =
that is not mentioned: Suppose that the encapsulated packet is encrypted. T=
he on-path attacker could however see the LISP header, and thus could chang=
e the nonce, or add a nonce, or reply to the nonce, change versioning infor=
mation,...  Are you proposing that the LISP header be encrypted also? If so=
, where is this specified and what does it do to forwarding performance in =
the xTR?=20


Section 4.3.1, second paragraph, third sentence:=20

   This is not different from today's
   Internet where a spoofing off-path attacker may inject data packets
   in any flow.

In terms of injecting traffic that the end system receives and acts upon, I=
 believe that this sentence is entirely true. However, in terms of the effe=
ct on the router's control plane, and particularly the operation of xTR's, =
this sentence is not true. Today there is very little that a spoofing attac=
ker that is outside of a particular service provider can do to exercise the=
 control plane of that provider's routers. This is important and intentiona=
l (see DOS discussion below).=20


Minor nit, next sentence:

   A non-spoofing off-path attacker (NSA)...

Given recent events, I think that "NSA" is an unfortunate acronym to use he=
re. How about NSOA?=20


Section 4.3.1.1 (Gleaning Attacks), last paragraph:

   By itself, an attack made solely using gleaning cannot last long,
   however it should be noted that with current network capacities, a
   large amount of packets might be exchanged during even a small
   fraction of time.

The amount of damage that might be caused by this may depend upon what happ=
ens to be exchanged in that "short amount of time". For example, the initia=
l handshake between sites (at the application layer) could include sign in =
information (account names and passwords), on the basis that this is the so=
rt of information that needs to be exchanged at the beginning of, for examp=
le, financial transactions. My understanding is that for Internet commerce,=
 it is normal for users to be redirected to a different site to enter credi=
t card information. This appears to constitute a "new session" (or at least=
 may be to an entirely different location) and therefore the entire credit =
card exchange could occur in a small period of time. I think it would be wo=
rth mentioning here that the sensitivity of the information that could be e=
xchanged during this "short amount of time" is not known, and could potenti=
ally be serious.=20

Also, depending upon how long xTR's are willing to store gleaned informatio=
n (before the map request comes back), the time that a user is misdirected =
due to a gleaning attack might be extended by coordinating a DDOS attack wi=
th the gleaning attack. For example, an attacker may send packets to a very=
 large number of sites, with a source EID which is from a major stock broke=
r or bank and an RLOC from the attacker's captive servers. The many sites g=
lean the EID to RLOC mapping from the arriving packets. Each pretty much si=
multaneously initiates an EID lookup (to verify the EID to RLOC mapping). T=
his creates a DOS attack on the control plane of the mapping function suppo=
rting that stock broker or bank. This implies that the responses are going =
to be delayed (and could be greatly delayed), which allows the incorrect ma=
ppings to last longer than they otherwise would. This allows any systems th=
at actually happen to be trying to connect to that stock or banking site to=
 be redirected to the attacker's site. The attacker then becomes a man in t=
he middle and can for example can obtain the password and account informati=
on for users. =20


Last paragraph of section 4.3.2.2:=20

   If the size of the Map-Request
   message is larger than the size of the smallest LISP-encapsulated
   packet that could trigger such a message, this could lead to
   amplification attacks (see Section 4.4.1) so that more bandwidth is
   consumed on the target than the bandwidth necessary at the attacker
   side.

The size of the packet is not the only issue. If the amount of processing r=
equired to send a map-request and deal with the reply is greater than the a=
mount of processing that is required to send a packet that triggers such a =
request, then this could also result in an amplification attack. In princip=
le it would seem that sending out a large number of packets to trigger such=
 a request would be relatively straightforward (for example the attacker mi=
ght be sending out many packets only incrementing the EID in order to attac=
k the ITR that will need to generate many map requests). We may note that f=
or many systems, particularly very high speed routers (which might exist fo=
r example as PE routers connecting very large enterprise customers), the co=
ntrol plane may be several orders of magnitude slower than the data plane, =
so that an attack that requires response from the router's control plane wo=
uld be much more serious than an attack of the same size that can be handle=
d in the data plane. I will say more about this in my comments below regard=
ing DOS attacks.=20


Section 4.3.2.3, third paragraph (right after the bullets):=20

   The first type of packet should not cause any major problem to ITRs.
   As the reachability test uses a 24 bits nonce, it is unlikely that an
   off-path attacker could send a single packet that causes an ITR to
   believe that the ETR it is testing is reachable while in reality it
   is not reachable.  To increase the success likelihood of such attack,
   the attacker should create a massive amount of packets carrying all
   possible nonce values.

However, this could be a problem if there are on-path attackers, since they=
 will see the nonce. They could insert nonce's where none are present, requ=
iring a response from the ETR. Given that the control plane of very high sp=
eed PE routers may be much slower than the data plane, this could cause a r=
elatively moderate data stream that the data plane or the PE could easily h=
andle to turn into a control plane attack that the control plane of a PE ro=
uter could not handle. Also, the on-path attacker could see the nonce's and=
 respond "correctly" (or in a way that the ITR that sent the nonce *thinks*=
 is correct), thereby "verifying" connectivity when none is present. You di=
smissed on-path attacks earlier in the document on the basis that the user =
data could be encrypted, but these are examples of on-path attacks that wou=
ld be on the LISP header and operation, and not on the user data.=20


Section 5.2 (Denial of Service):

You need to mention here the relative difference in speed between the data =
plane and the control plane of high speed routers. For example, there are p=
lenty of examples currently widely deployed of routers which can handle a f=
ew terabits of data in the data plane. These routers might typically have g=
igabit Ethernet links to the control processor, but I doubt that any of the=
m could handle Map-Requests coming in at line rate at a gigabit. Thus the r=
atio between the speed of the control plane the speed of the data plane is =
significantly greater than 1000. I understand that many PE routers have slo=
wer data planes (and the CE "wireless router" that sits in each of our home=
s is of course a lot slower than this), but large data centers or large ent=
erprise sites could very well be connected to their service provider via a =
few very high speed PE routers. Therefore an attack that would be trivial t=
o handle in the data plane (say, a few gigabits) could overwhelm the contro=
l plane.=20

Gleaning allows incoming packets to create map requests, which allows a dat=
a plane attack to turn into a control plane attack. Given the difference in=
 speeds between the data plane and the control plane, this makes it much ea=
sier to create an effective DOS attack.=20


Section 8 (Security Considerations).=20

I am pleased that you removed the sentence from section 1 of the previous (=
-08) draft that read: "As a result of  the performed analysis, the document=
 discusses the severity of the threats and proposes recommendations to reac=
h the same level of security in LISP than in Internet today (e.g., without =
LISP)". This sentence was not actually correct. However, in looking through=
 the document and in thinking about the implications (see the rest of this =
email) it is quite clear that the security of an Internet using LISP would =
be significantly less than the current Internet (at least if you assume tha=
t there is *any* security at all in the current Internet). I am thinking th=
at there should be a sentence at the end of section 8 to the effect that "A=
t the current time it appears that LISP would have significant security imp=
lications if deployed on an Internet-wide scale".


Finally, two items left out:

I don't see any discussion on the effect of LISP on firewalls. I am assumin=
g that pretty much all currently deployed firewalls are not able to look pa=
st a LISP header to inspect the contents of packets. At a minimum, this wou=
ld seem to imply that LISP will need to be deployed toward the Internet cor=
e from the current firewalls, so that the firewalls can be looking at norma=
l (unchanged) IP packets.


There is another issue which might belong in the section on privacy: In the=
 Internet today if you want to attack a network with prefix aa.bb/16, and y=
ou see this advertisement in the BGP routes, you can pick a random address =
and send a packet and see if anything happens. You get little feedback. Wit=
h LISP you can send a map request to a random address in the block and get =
back a map reply. This gives you an RLOC which is in general the actual IP =
address of a real PE or CE router. Of course you can repeat this across the=
 entire /16, or even the Internet (given sufficient time and traffic), and =
get something close to a complete list of LISP xTRs. This implies that if s=
ervice providers implement LISP on PE routers, then they will be exposing t=
he identity of their PE routers to worldwide inspection. Given the number o=
f PE routers in the world (obviously much larger than the number of service=
 providers, and given PA address aggregation probably larger than the numbe=
r of routes that show up in the BGP routing table) we should expect that th=
ere are lots of PE routers that have not been carefully secured, and exposi=
ng their existence to open worldwide easy discovery would likely open the d=
oor to a number of attacks that involve compromise of PE routers. Of course=
 if LISP is deployed on CE routers then their RLOC would similarly be expos=
ed.=20

Thanks, Ross

-----Original Message-----
From: lisp [mailto:lisp-bounces@ietf.org] On Behalf Of Joel M. Halpern
Sent: Friday, May 09, 2014 11:54 AM
To: lisp@ietf.org
Subject: [lisp] Restarting last call on LISP threats

Sorry for the delay getting this out.
This email starts a new (and hopefully final) last call on=20
draft-ietf-lisp-threats, version 9:
http://datatracker.ietf.org/doc/draft-ietf-lisp-threats/

The last call will end in two weeks, close of business 23-May-2014.

Thank you,
Joel

_______________________________________________
lisp mailing list
lisp@ietf.org
https://www.ietf.org/mailman/listinfo/lisp


From nobody Tue May 13 00:48:01 2014
Return-Path: <rogerj@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 52A461A0851 for <lisp@ietfa.amsl.com>; Tue, 13 May 2014 00:47:59 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.7
X-Spam-Level: 
X-Spam-Status: No, score=-1.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, MIME_8BIT_HEADER=0.3, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6GC-qdEOD9-r for <lisp@ietfa.amsl.com>; Tue, 13 May 2014 00:47:58 -0700 (PDT)
Received: from mail-we0-x22a.google.com (mail-we0-x22a.google.com [IPv6:2a00:1450:400c:c03::22a]) by ietfa.amsl.com (Postfix) with ESMTP id CDAF11A084A for <lisp@ietf.org>; Tue, 13 May 2014 00:47:57 -0700 (PDT)
Received: by mail-we0-f170.google.com with SMTP id u57so8028575wes.1 for <lisp@ietf.org>; Tue, 13 May 2014 00:47:51 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=pY62u+dtq4pzYJuMHvLJ0bwoIKl3I15wka/nieleV2M=; b=yhAvi8uocqd/8AR0DBfGc0MwE2YlSmnMtFMMdy8jUA2lTLuwVhwBSFZi3nPmZtjY83 6pS9vLZc5sqJO5pQYGys/GiAcf+nya/Zsd5Mbq/iD+cx4YUZCTbXrFDJHkD6tdUWgUgB 1cJHdk+aHE4c0kTH/6TNKWKexrU9r3e6RO4VeBLY6U6sj5JOQ9davQxeaSguK6jSw+r3 0Lviz/Nv63MurkWsk84gnc91cnJurtg/QNSdyFM6D84vEUwlgDR36aFEndFxITCW2h18 BjBJEez3Pf4+LcGvkkQCzwVcHyQMMiPwxfk89dVo3tGt89ExaAxl2mQV+SYYwgjgBJQj TOPQ==
MIME-Version: 1.0
X-Received: by 10.194.48.100 with SMTP id k4mr6396084wjn.49.1399967271189; Tue, 13 May 2014 00:47:51 -0700 (PDT)
Received: by 10.216.210.6 with HTTP; Tue, 13 May 2014 00:47:51 -0700 (PDT)
In-Reply-To: <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com>
Date: Tue, 13 May 2014 09:47:51 +0200
Message-ID: <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com>
From: =?UTF-8?Q?Roger_J=C3=B8rgensen?= <rogerj@gmail.com>
To: Ross Callon <rcallon@juniper.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/u41zvtAcpjnm23QVBnSjbCYp4t0
Cc: "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 13 May 2014 07:47:59 -0000

Hi Ross,

See inline,


On Mon, May 12, 2014 at 7:11 PM, Ross Callon <rcallon@juniper.net> wrote:
> Thanks Joel;
>
> I think that draft-ietf-lisp-threats-09.txt is a start towards a threats =
document, but that it has serious omissions and needs more work before bein=
g progressed. Here are some specific comments:
>
>
> Section 2 (On-path Attackers), first paragraph:
>
>    On-path attackers are attackers that are able to capture and modify
>    all the packets exchanged between an Ingress Tunnel Router (ITR) and
>    an Egress Tunnel Router (ETR).  To cope with such an attacker,
>    cryptographic techniques such as those used by IPSec ([RFC4301]) are
>    required.  As with IP, LISP relies on higher layer cryptography to
>    secure packet payloads from on path attacks, so this document does
>    not consider on-path attackers.
>
> To me an on-path attacker is one which is on the data path. Such an attac=
ker might attack the contents of the data packet. In this case the paragrap=
h seems mostly correct to me: You encrypt the contents if you don't want so=
meone on the path to the destination to look at the contents. However, as i=
s discussed later in the document, LISP allows systems which are not in the=
 normal physical path, through a gleaning attack, to inject themselves into=
 the data path. This could be applied to allow attacker's systems to inject=
 themselves into the path of the key management protocol. This implies that=
 a legitimate user could get keys supplied by an attacker, just as easily a=
s it could get keys supplied by a legitimate Internet site. If you are prop=
osing that end to end encryption is the solution to on path attackers then =
you need to understand the implications of LISP on the operation of the pro=
tocol needed for key management to support end to end encryption.



There exist two draft that are relevant to what you address.

You have https://datatracker.ietf.org/doc/draft-farinacci-lisp-crypto/
where the payload of a LISP encapsulated packet are encrypted. None of
the keys for encrypting/decrypting are stored in the mapping system
but is calculated by the xTR's involved.
Then you have https://datatracker.ietf.org/doc/draft-ietf-lisp-sec/
that attempts to secure the xTR to xTR relationship.



--=20

Roger Jorgensen           | ROJO9-RIPE
rogerj@gmail.com          | - IPv6 is The Key!
http://www.jorgensen.no   | roger@jorgensen.no


From nobody Tue May 13 09:31:41 2014
Return-Path: <rcallon@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3930B1A011B for <lisp@ietfa.amsl.com>; Tue, 13 May 2014 09:31:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.601
X-Spam-Level: 
X-Spam-Status: No, score=-1.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1KOdeY4yb44W for <lisp@ietfa.amsl.com>; Tue, 13 May 2014 09:31:37 -0700 (PDT)
Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2on0095.outbound.protection.outlook.com [65.55.169.95]) by ietfa.amsl.com (Postfix) with ESMTP id D3AFC1A0117 for <lisp@ietf.org>; Tue, 13 May 2014 09:31:36 -0700 (PDT)
Received: from CO2PR05MB636.namprd05.prod.outlook.com (10.141.199.24) by CO2PR05MB634.namprd05.prod.outlook.com (10.141.199.17) with Microsoft SMTP Server (TLS) id 15.0.944.11; Tue, 13 May 2014 16:31:22 +0000
Received: from CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) by CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) with mapi id 15.00.0929.001; Tue, 13 May 2014 16:31:21 +0000
From: Ross Callon <rcallon@juniper.net>
To: =?utf-8?B?Um9nZXIgSsO4cmdlbnNlbg==?= <rogerj@gmail.com>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58M9eFhkxJvMEaw1MEc+Ryfdps9FMJAgAETSICAAIz2sA==
Date: Tue, 13 May 2014 16:31:20 +0000
Message-ID: <e03a83d7e45345dfbbe5f08f54cb47fa@CO2PR05MB636.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com>
In-Reply-To: <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.17]
x-forefront-prvs: 0210479ED8
x-forefront-antispam-report: SFV:NSPM; SFS:(10009001)(6009001)(428001)(189002)(199002)(51704005)(13464003)(24454002)(377454003)(87936001)(15975445006)(99396002)(46102001)(15202345003)(2656002)(20776003)(19580405001)(99286001)(21056001)(83322001)(19580395003)(101416001)(80022001)(86362001)(66066001)(77096999)(16601075003)(85852003)(54356999)(33646001)(4396001)(76482001)(81342001)(79102001)(81542001)(83072002)(74502001)(1411001)(77982001)(76176999)(74316001)(50986999)(74662001)(76576001)(24736002); DIR:OUT; SFP:1101; SCL:1; SRVR:CO2PR05MB634; H:CO2PR05MB636.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rcallon@juniper.net; 
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/N9Bba4eXuBEhf5OMkZULEy3AokE
Cc: "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 13 May 2014 16:31:39 -0000

SSBkb24ndCB0aGluayB0aGF0IHRoZSB0d28gZHJhZnRzIHRoYXQgeW91IHJlZmVyZW5jZSBzb2x2
ZSB0aGUgcHJvYmxlbSB0aGF0IEkgYW0gY29uY2VybmVkIGFib3V0ICh0aGV5IGFkZHJlc3MgYW5k
IG1heSBzb2x2ZSBvdGhlciBwcm9ibGVtcywgb2YgY291cnNlKS4gDQoNCkZvciBleGFtcGxlLCBs
b29raW5nIGF0IGRyYWZ0LWlldGYtbGlzcC1zZWMtMDYsIGl0IHNheXM6DQoNCiAgIFRoaXMgbWVt
byBzcGVjaWZpZXMgTElTUC1TRUMsIGEgc2V0IG9mIHNlY3VyaXR5IG1lY2hhbmlzbXMgdGhhdA0K
ICAgcHJvdmlkZXMgb3JpZ2luIGF1dGhlbnRpY2F0aW9uLCBpbnRlZ3JpdHkgYW5kIGFudGktcmVw
bGF5IHByb3RlY3Rpb24NCiAgIHRvIExJU1AncyBFSUQtdG8tUkxPQyBtYXBwaW5nIGRhdGEgY29u
dmV5ZWQgdmlhIG1hcHBpbmcgbG9va3VwDQogICBwcm9jZXNzLiAgTElTUC1TRUMgYWxzbyBlbmFi
bGVzIHZlcmlmaWNhdGlvbiBvZiBhdXRob3JpemF0aW9uIG9uIEVJRC0NCiAgIHByZWZpeCBjbGFp
bXMgaW4gTWFwLVJlcGx5IG1lc3NhZ2VzLg0KDQpUaHVzIGlmIHdlIGFzc3VtZSB0aGF0IGRyYWZ0
LWlldGYtbGlzcC1zZWMtMDYgd29ya3MsIHRoZW4gd2hhdCB3ZSBoZWFyIGJhY2sgZnJvbSB0aGUg
bWFwcGluZyBzeXN0ZW0gc2hvdWxkIGJlIGNvcnJlY3QgKG9yIHNob3VsZCBiZSBlcXVhbGx5IHJl
bGlhYmxlIHRvIHdoYXQgd2UgaGVhciBiYWNrIGZyb20gdGhlIEROUyBzeXN0ZW0gdG9kYXksIGFu
ZCB3ZSBkbyB0b2RheSByZWx5IG9uIEROUyB3aGVuIHdlIGFyZSBjb250YWN0aW5nIG91ciBiYW5r
IG9yIGJyb2tlcmFnZSBzZXJ2aWNlIHRvIGNvbmR1Y3QgZmluYW5jaWFsIHRyYW5zYWN0aW9ucyku
IA0KDQpXaGF0IEkgYW0gY29uY2VybmVkIGFib3V0IGlzIHRoYXQgKmJlZm9yZSogd2UgaGVhciBi
YWNrIGZyb20gdGhlIG1hcHBpbmcgc3lzdGVtLCB3ZSBhcmUgYmVsaWV2aW5nIHdoYXQgd2UgaGF2
ZSBnbGVhbmVkLCBhbmQgdGhpcyBtYXkgY2F1c2UgdXMgdG8gYmUgdGFsa2luZyB0byB0aGUgd3Jv
bmcgc3lzdGVtLiBXZSBtaWdodCBiZSBjb25kdWN0aW5nIGtleSBuZWdvdGlhdGlvbiB3aXRoIHRo
ZSB3cm9uZyBzeXN0ZW0ganVzdCBhcyBlYXNpbHkgYXMgd2UgY291bGQgYmUgZXhjaGFuZ2luZyBi
YW5raW5nIG9yIGJyb2tlcmFnZSBpbmZvcm1hdGlvbiB3aXRoIHRoZSB3cm9uZyBzeXN0ZW0uIA0K
DQpSb3NzICANCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IFJvZ2VyIErDuHJn
ZW5zZW4gW21haWx0bzpyb2dlcmpAZ21haWwuY29tXSANClNlbnQ6IFR1ZXNkYXksIE1heSAxMywg
MjAxNCAzOjQ4IEFNDQpUbzogUm9zcyBDYWxsb24NCkNjOiBsaXNwQGlldGYub3JnDQpTdWJqZWN0
OiBSZTogW2xpc3BdIFJlc3RhcnRpbmcgbGFzdCBjYWxsIG9uIExJU1AgdGhyZWF0cw0KDQpIaSBS
b3NzLA0KDQpTZWUgaW5saW5lLA0KDQoNCk9uIE1vbiwgTWF5IDEyLCAyMDE0IGF0IDc6MTEgUE0s
IFJvc3MgQ2FsbG9uIDxyY2FsbG9uQGp1bmlwZXIubmV0PiB3cm90ZToNCj4gVGhhbmtzIEpvZWw7
DQo+DQo+IEkgdGhpbmsgdGhhdCBkcmFmdC1pZXRmLWxpc3AtdGhyZWF0cy0wOS50eHQgaXMgYSBz
dGFydCB0b3dhcmRzIGEgdGhyZWF0cyBkb2N1bWVudCwgYnV0IHRoYXQgaXQgaGFzIHNlcmlvdXMg
b21pc3Npb25zIGFuZCBuZWVkcyBtb3JlIHdvcmsgYmVmb3JlIGJlaW5nIHByb2dyZXNzZWQuIEhl
cmUgYXJlIHNvbWUgc3BlY2lmaWMgY29tbWVudHM6DQo+DQo+DQo+IFNlY3Rpb24gMiAoT24tcGF0
aCBBdHRhY2tlcnMpLCBmaXJzdCBwYXJhZ3JhcGg6DQo+DQo+ICAgIE9uLXBhdGggYXR0YWNrZXJz
IGFyZSBhdHRhY2tlcnMgdGhhdCBhcmUgYWJsZSB0byBjYXB0dXJlIGFuZCBtb2RpZnkNCj4gICAg
YWxsIHRoZSBwYWNrZXRzIGV4Y2hhbmdlZCBiZXR3ZWVuIGFuIEluZ3Jlc3MgVHVubmVsIFJvdXRl
ciAoSVRSKSBhbmQNCj4gICAgYW4gRWdyZXNzIFR1bm5lbCBSb3V0ZXIgKEVUUikuICBUbyBjb3Bl
IHdpdGggc3VjaCBhbiBhdHRhY2tlciwNCj4gICAgY3J5cHRvZ3JhcGhpYyB0ZWNobmlxdWVzIHN1
Y2ggYXMgdGhvc2UgdXNlZCBieSBJUFNlYyAoW1JGQzQzMDFdKSBhcmUNCj4gICAgcmVxdWlyZWQu
ICBBcyB3aXRoIElQLCBMSVNQIHJlbGllcyBvbiBoaWdoZXIgbGF5ZXIgY3J5cHRvZ3JhcGh5IHRv
DQo+ICAgIHNlY3VyZSBwYWNrZXQgcGF5bG9hZHMgZnJvbSBvbiBwYXRoIGF0dGFja3MsIHNvIHRo
aXMgZG9jdW1lbnQgZG9lcw0KPiAgICBub3QgY29uc2lkZXIgb24tcGF0aCBhdHRhY2tlcnMuDQo+
DQo+IFRvIG1lIGFuIG9uLXBhdGggYXR0YWNrZXIgaXMgb25lIHdoaWNoIGlzIG9uIHRoZSBkYXRh
IHBhdGguIFN1Y2ggYW4gYXR0YWNrZXIgbWlnaHQgYXR0YWNrIHRoZSBjb250ZW50cyBvZiB0aGUg
ZGF0YSBwYWNrZXQuIEluIHRoaXMgY2FzZSB0aGUgcGFyYWdyYXBoIHNlZW1zIG1vc3RseSBjb3Jy
ZWN0IHRvIG1lOiBZb3UgZW5jcnlwdCB0aGUgY29udGVudHMgaWYgeW91IGRvbid0IHdhbnQgc29t
ZW9uZSBvbiB0aGUgcGF0aCB0byB0aGUgZGVzdGluYXRpb24gdG8gbG9vayBhdCB0aGUgY29udGVu
dHMuIEhvd2V2ZXIsIGFzIGlzIGRpc2N1c3NlZCBsYXRlciBpbiB0aGUgZG9jdW1lbnQsIExJU1Ag
YWxsb3dzIHN5c3RlbXMgd2hpY2ggYXJlIG5vdCBpbiB0aGUgbm9ybWFsIHBoeXNpY2FsIHBhdGgs
IHRocm91Z2ggYSBnbGVhbmluZyBhdHRhY2ssIHRvIGluamVjdCB0aGVtc2VsdmVzIGludG8gdGhl
IGRhdGEgcGF0aC4gVGhpcyBjb3VsZCBiZSBhcHBsaWVkIHRvIGFsbG93IGF0dGFja2VyJ3Mgc3lz
dGVtcyB0byBpbmplY3QgdGhlbXNlbHZlcyBpbnRvIHRoZSBwYXRoIG9mIHRoZSBrZXkgbWFuYWdl
bWVudCBwcm90b2NvbC4gVGhpcyBpbXBsaWVzIHRoYXQgYSBsZWdpdGltYXRlIHVzZXIgY291bGQg
Z2V0IGtleXMgc3VwcGxpZWQgYnkgYW4gYXR0YWNrZXIsIGp1c3QgYXMgZWFzaWx5IGFzIGl0IGNv
dWxkIGdldCBrZXlzIHN1cHBsaWVkIGJ5IGEgbGVnaXRpbWF0ZSBJbnRlcm5ldCBzaXRlLiBJZiB5
b3UgYXJlIHByb3Bvc2luZyB0aGF0IGVuZCB0byBlbmQgZW5jcnlwdGlvbiBpcyB0aGUgc29sdXRp
b24gdG8gb24gcGF0aCBhdHRhY2tlcnMgdGhlbiB5b3UgbmVlZCB0byB1bmRlcnN0YW5kIHRoZSBp
bXBsaWNhdGlvbnMgb2YgTElTUCBvbiB0aGUgb3BlcmF0aW9uIG9mIHRoZSBwcm90b2NvbCBuZWVk
ZWQgZm9yIGtleSBtYW5hZ2VtZW50IHRvIHN1cHBvcnQgZW5kIHRvIGVuZCBlbmNyeXB0aW9uLg0K
DQoNCg0KVGhlcmUgZXhpc3QgdHdvIGRyYWZ0IHRoYXQgYXJlIHJlbGV2YW50IHRvIHdoYXQgeW91
IGFkZHJlc3MuDQoNCllvdSBoYXZlIGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2Ry
YWZ0LWZhcmluYWNjaS1saXNwLWNyeXB0by8NCndoZXJlIHRoZSBwYXlsb2FkIG9mIGEgTElTUCBl
bmNhcHN1bGF0ZWQgcGFja2V0IGFyZSBlbmNyeXB0ZWQuIE5vbmUgb2YNCnRoZSBrZXlzIGZvciBl
bmNyeXB0aW5nL2RlY3J5cHRpbmcgYXJlIHN0b3JlZCBpbiB0aGUgbWFwcGluZyBzeXN0ZW0NCmJ1
dCBpcyBjYWxjdWxhdGVkIGJ5IHRoZSB4VFIncyBpbnZvbHZlZC4NClRoZW4geW91IGhhdmUgaHR0
cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtaWV0Zi1saXNwLXNlYy8NCnRoYXQg
YXR0ZW1wdHMgdG8gc2VjdXJlIHRoZSB4VFIgdG8geFRSIHJlbGF0aW9uc2hpcC4NCg0KDQoNCi0t
IA0KDQpSb2dlciBKb3JnZW5zZW4gICAgICAgICAgIHwgUk9KTzktUklQRQ0Kcm9nZXJqQGdtYWls
LmNvbSAgICAgICAgICB8IC0gSVB2NiBpcyBUaGUgS2V5IQ0KaHR0cDovL3d3dy5qb3JnZW5zZW4u
bm8gICB8IHJvZ2VyQGpvcmdlbnNlbi5ubw0K


From nobody Tue May 13 10:22:08 2014
Return-Path: <rbonica@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C50081A018D for <lisp@ietfa.amsl.com>; Tue, 13 May 2014 10:22:04 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.602
X-Spam-Level: 
X-Spam-Status: No, score=-101.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DOkT0NfAw2KL for <lisp@ietfa.amsl.com>; Tue, 13 May 2014 10:22:02 -0700 (PDT)
Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0139.outbound.protection.outlook.com [207.46.163.139]) by ietfa.amsl.com (Postfix) with ESMTP id A191F1A017E for <lisp@ietf.org>; Tue, 13 May 2014 10:21:59 -0700 (PDT)
Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by DM2PR05MB639.namprd05.prod.outlook.com (10.141.157.150) with Microsoft SMTP Server (TLS) id 15.0.934.12; Tue, 13 May 2014 17:21:51 +0000
Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.25]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.25]) with mapi id 15.00.0939.000; Tue, 13 May 2014 17:21:51 +0000
From: Ronald Bonica <rbonica@juniper.net>
To: =?iso-8859-1?Q?Roger_J=F8rgensen?= <rogerj@gmail.com>, Ross Callon <rcallon@juniper.net>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8A==
Date: Tue, 13 May 2014 17:21:50 +0000
Message-ID: <7aa1593be30a47d3a0edfc806d64796e@CO1PR05MB442.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com>
In-Reply-To: <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.14]
x-forefront-prvs: 0210479ED8
x-forefront-antispam-report: SFV:NSPM; SFS:(10009001)(6009001)(428001)(51704005)(199002)(189002)(46102001)(74502001)(33646001)(4396001)(76482001)(15975445006)(1941001)(83072002)(21056001)(86362001)(76576001)(85852003)(101416001)(77982001)(81542001)(2656002)(74316001)(99286001)(81342001)(83322001)(50986999)(74662001)(76176999)(20776003)(79102001)(87936001)(54356999)(66066001)(19580395003)(99396002)(80022001)(24736002); DIR:OUT; SFP:1101; SCL:1; SRVR:DM2PR05MB639; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; 
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/br2Mxd-7sgr2qSOs6G58_s6_kR8
Cc: "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 13 May 2014 17:22:05 -0000

Hi Roger,

Can this draft stand on its own, without integrating content from the docum=
ents that you reference?

                                                                           =
                  Ron

>=20
> There exist two draft that are relevant to what you address.
>=20
> You have https://datatracker.ietf.org/doc/draft-farinacci-lisp-crypto/
> where the payload of a LISP encapsulated packet are encrypted. None of th=
e
> keys for encrypting/decrypting are stored in the mapping system but is
> calculated by the xTR's involved.
> Then you have https://datatracker.ietf.org/doc/draft-ietf-lisp-sec/
> that attempts to secure the xTR to xTR relationship.
>=20
>=20
>=20
> --
>=20


From nobody Tue May 13 10:31:59 2014
Return-Path: <rbonica@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53CEB1A012F for <lisp@ietfa.amsl.com>; Tue, 13 May 2014 10:31:57 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.302
X-Spam-Level: 
X-Spam-Status: No, score=-102.302 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AjcdKHgdGwxd for <lisp@ietfa.amsl.com>; Tue, 13 May 2014 10:31:55 -0700 (PDT)
Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2lp0238.outbound.protection.outlook.com [207.46.163.238]) by ietfa.amsl.com (Postfix) with ESMTP id 5B1391A0116 for <lisp@ietf.org>; Tue, 13 May 2014 10:31:55 -0700 (PDT)
Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by BLUPR05MB626.namprd05.prod.outlook.com (10.141.204.143) with Microsoft SMTP Server (TLS) id 15.0.934.12; Tue, 13 May 2014 17:31:47 +0000
Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.25]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.25]) with mapi id 15.00.0939.000; Tue, 13 May 2014 17:31:46 +0000
From: Ronald Bonica <rbonica@juniper.net>
To: =?iso-8859-1?Q?Roger_J=F8rgensen?= <rogerj@gmail.com>, Ross Callon <rcallon@juniper.net>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQ
Date: Tue, 13 May 2014 17:31:45 +0000
Message-ID: <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> 
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.14]
x-forefront-prvs: 0210479ED8
x-forefront-antispam-report: SFV:NSPM; SFS:(10009001)(6009001)(428001)(51704005)(189002)(199002)(377454003)(13464003)(83072002)(85852003)(1941001)(79102001)(86362001)(19580405001)(83322001)(76576001)(19580395003)(20776003)(15975445006)(46102001)(101416001)(76482001)(77982001)(87936001)(2656002)(66066001)(80022001)(54356999)(4396001)(99396002)(99286001)(33646001)(74502001)(74662001)(76176999)(50986999)(81342001)(21056001)(74316001)(81542001)(24736002); DIR:OUT; SFP:1101; SCL:1; SRVR:BLUPR05MB626; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; 
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/GfGwE92o6a7C8rClqvvgVK2fg3U
Cc: "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 13 May 2014 17:31:57 -0000

Hi Roger,

Or asked more explicitly, can the level of security claimed by the threats =
document be achieved without implementing the protocol extensions described=
 in lisp-sec and lisp-crypto?

                                                          Ron


> -----Original Message-----
> From: Ronald Bonica
> Sent: Tuesday, May 13, 2014 1:22 PM
> To: 'Roger J=F8rgensen'; Ross Callon
> Cc: lisp@ietf.org
> Subject: RE: [lisp] Restarting last call on LISP threats
>=20
> Hi Roger,
>=20
> Can this draft stand on its own, without integrating content from the
> documents that you reference?
>=20
>                                                                          =
                    Ron
>=20
> >
> > There exist two draft that are relevant to what you address.
> >
> > You have https://datatracker.ietf.org/doc/draft-farinacci-lisp-crypto/
> > where the payload of a LISP encapsulated packet are encrypted. None of
> > the keys for encrypting/decrypting are stored in the mapping system
> > but is calculated by the xTR's involved.
> > Then you have https://datatracker.ietf.org/doc/draft-ietf-lisp-sec/
> > that attempts to secure the xTR to xTR relationship.
> >
> >
> >
> > --
> >


From nobody Tue May 13 10:47:15 2014
Return-Path: <farinacci@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDD1A1A0126 for <lisp@ietfa.amsl.com>; Tue, 13 May 2014 10:47:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level: 
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9,  DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ylhM_v-Y_pbc for <lisp@ietfa.amsl.com>; Tue, 13 May 2014 10:47:10 -0700 (PDT)
Received: from mail-pa0-x22f.google.com (mail-pa0-x22f.google.com [IPv6:2607:f8b0:400e:c03::22f]) by ietfa.amsl.com (Postfix) with ESMTP id 4C5451A011A for <lisp@ietf.org>; Tue, 13 May 2014 10:47:10 -0700 (PDT)
Received: by mail-pa0-f47.google.com with SMTP id lf10so544967pab.6 for <lisp@ietf.org>; Tue, 13 May 2014 10:47:04 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=WdQMh1NXogSb9KI/7ovTY6eY8VIpQfYQcEURVJ2Qzj4=; b=kv3mY3CeEhkkoE8myOT1RvClASlUOPrjkthVTTIMbxJ+FWRIDC4Uolzd+3tZEXraZ4 k8Nv11g+ffaKBxTCqTIf1ppbmoKFzWo8Y8ACkN5eFKlx4Ppu2k8skCqHhh41Vg8ZhKWk 4yHMCUeLCyFmukN9p0HJXIXnk9HJOu//SqkzjcXB4ypNf/zPHYYSyZ3XKJcF1bmwPXpG h+bcK5/mIaGH8BRUG0+Y8Yo8pdZtL1a4atYnGqgyXM0qzDsAFSrSafwXbhp5lPNzxwa6 FW4EX48muJIJGHwaVZcrCLdb7RYj5g77xQN68mkPJTXPG3MrkKDD/dupbZHLtpIUOxi2 Lmwg==
X-Received: by 10.68.114.227 with SMTP id jj3mr4422042pbb.61.1400003224046; Tue, 13 May 2014 10:47:04 -0700 (PDT)
Received: from [192.168.1.79] (173-8-188-29-SFBA.hfc.comcastbusiness.net. [173.8.188.29]) by mx.google.com with ESMTPSA id vf9sm29277974pbc.94.2014.05.13.10.47.01 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 13 May 2014 10:47:01 -0700 (PDT)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\))
From: Dino Farinacci <farinacci@gmail.com>
In-Reply-To: <e03a83d7e45345dfbbe5f08f54cb47fa@CO2PR05MB636.namprd05.prod.outlook.com>
Date: Tue, 13 May 2014 10:47:00 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <11916828-2EE5-4B46-B6F3-994CD9DBA42D@gmail.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <e03a83d7e45345dfbbe5f08f54cb47fa@CO2PR05MB636.namprd05.prod.outlook.com>
To: Ross Callon <rcallon@juniper.net>
X-Mailer: Apple Mail (2.1874)
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/iIn2081YB6QAxF6gSILjsLYodO4
Cc: Roger Jorgensen <rogerj@gmail.com>, "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 13 May 2014 17:47:12 -0000

> Thus if we assume that draft-ietf-lisp-sec-06 works, then what we hear =
back from the mapping system should be correct (or should be equally =
reliable to what we hear back from the DNS system today, and we do today =
rely on DNS when we are contacting our bank or brokerage service to =
conduct financial transactions).=20

The main LISP spec (RFC6830) indicates if you want to trust the mapping =
system you can use the gleaned information as soon as you receive it. =
And if you don't trust the mapping system, you can send a "verifying =
Map-Request" to the mapping system which results in a signed Map-Reply =
returned ala draft-ietf-lisp-sec-06.

Dino


From nobody Tue May 13 14:56:41 2014
Return-Path: <jmh@joelhalpern.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53E971A01E2 for <lisp@ietfa.amsl.com>; Tue, 13 May 2014 14:56:40 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.602
X-Spam-Level: 
X-Spam-Status: No, score=-1.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gRDZf4sPT7PY for <lisp@ietfa.amsl.com>; Tue, 13 May 2014 14:56:39 -0700 (PDT)
Received: from mailc2.tigertech.net (mailc2.tigertech.net [208.80.4.156]) by ietfa.amsl.com (Postfix) with ESMTP id 684C71A01A5 for <lisp@ietf.org>; Tue, 13 May 2014 14:56:39 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mailc2.tigertech.net (Postfix) with ESMTP id 4F4C0381DA1; Tue, 13 May 2014 14:56:33 -0700 (PDT)
X-Virus-Scanned: Debian amavisd-new at c2.tigertech.net
Received: from Joels-MacBook-Pro.local (pool-70-106-135-10.clppva.east.verizon.net [70.106.135.10]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mailc2.tigertech.net (Postfix) with ESMTPSA id 6CC63381D30; Tue, 13 May 2014 14:56:32 -0700 (PDT)
Message-ID: <5372950E.3080704@joelhalpern.com>
Date: Tue, 13 May 2014 17:56:30 -0400
From: "Joel M. Halpern" <jmh@joelhalpern.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.5.0
MIME-Version: 1.0
To: Ronald Bonica <rbonica@juniper.net>, =?ISO-8859-1?Q?Roger_J=F8rgens?= =?ISO-8859-1?Q?en?= <rogerj@gmail.com>, Ross Callon <rcallon@juniper.net>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com>
In-Reply-To: <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/OkwIDIiit9P7WjWXQ62b-rXpBu8
Cc: "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 13 May 2014 21:56:40 -0000

Ron, I am having trouble with the question.

The threats document describes the threats as they exist today, without 
the adoption of either document that Roger pointed to.  Thus, I do not 
see any dependence.

If there is a threat that is not well described in the base spec or this 
document, then we should add it.  We should add it even if there are 
proposals to remediate it.  But if there is a clear proposal of a 
missing threat, I missed it.

Yours,
Joel

On 5/13/14, 1:31 PM, Ronald Bonica wrote:
> Hi Roger,
>
> Or asked more explicitly, can the level of security claimed by the threats document be achieved without implementing the protocol extensions described in lisp-sec and lisp-crypto?
>
>                                                            Ron
>
>
>> -----Original Message-----
>> From: Ronald Bonica
>> Sent: Tuesday, May 13, 2014 1:22 PM
>> To: 'Roger Jørgensen'; Ross Callon
>> Cc: lisp@ietf.org
>> Subject: RE: [lisp] Restarting last call on LISP threats
>>
>> Hi Roger,
>>
>> Can this draft stand on its own, without integrating content from the
>> documents that you reference?
>>
>>                                                                                               Ron
>>
>>>
>>> There exist two draft that are relevant to what you address.
>>>
>>> You have https://datatracker.ietf.org/doc/draft-farinacci-lisp-crypto/
>>> where the payload of a LISP encapsulated packet are encrypted. None of
>>> the keys for encrypting/decrypting are stored in the mapping system
>>> but is calculated by the xTR's involved.
>>> Then you have https://datatracker.ietf.org/doc/draft-ietf-lisp-sec/
>>> that attempts to secure the xTR to xTR relationship.
>>>
>>>
>>>
>>> --
>>>
>
> _______________________________________________
> lisp mailing list
> lisp@ietf.org
> https://www.ietf.org/mailman/listinfo/lisp
>


From nobody Wed May 14 00:59:03 2014
Return-Path: <rogerj@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B50C01A0275 for <lisp@ietfa.amsl.com>; Wed, 14 May 2014 00:59:00 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.7
X-Spam-Level: 
X-Spam-Status: No, score=-1.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, MIME_8BIT_HEADER=0.3, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KV8VYuAdcwyt for <lisp@ietfa.amsl.com>; Wed, 14 May 2014 00:58:59 -0700 (PDT)
Received: from mail-wi0-x230.google.com (mail-wi0-x230.google.com [IPv6:2a00:1450:400c:c05::230]) by ietfa.amsl.com (Postfix) with ESMTP id 05A711A0235 for <lisp@ietf.org>; Wed, 14 May 2014 00:58:58 -0700 (PDT)
Received: by mail-wi0-f176.google.com with SMTP id n15so7548605wiw.3 for <lisp@ietf.org>; Wed, 14 May 2014 00:58:52 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=vBNPgxaw3kM4o50HTf90Tff1yNnX3y+Ia0lELKSfX/k=; b=oauMopm38rNSio4PG/FOY5F+XazgPH6/MGqzONAxthgxGK2D4ywymfvS+dEKVnlt4W Spb5jkqGtx95xJ0k1HKL+fldu/38VFDsqpxiQd1vf8APR5Yx5FsL7yNarWQUBKkJSnLP 30LTvWs0WpvWyQmqzXT+/AnRJWTRGsYUKt5pHdgk4uq9X3PnvelK3+QO2cw9Wv5zcPgy EDBwQ2xsGJWQgWgoeOEfIfJIZ8xUiXO6GlKBOAjd6uATCO84wQmjtQEmuOi+CNJF5Qjg iWTiMwH2+cV6AISC/DHlCzempXTzlDwPe/URcXus5dCYonl7yCoclpm4AA4/XAc3yMv9 HvSw==
MIME-Version: 1.0
X-Received: by 10.180.80.232 with SMTP id u8mr24865181wix.13.1400054331912; Wed, 14 May 2014 00:58:51 -0700 (PDT)
Received: by 10.216.210.6 with HTTP; Wed, 14 May 2014 00:58:51 -0700 (PDT)
In-Reply-To: <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com>
Date: Wed, 14 May 2014 09:58:51 +0200
Message-ID: <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com>
From: =?UTF-8?Q?Roger_J=C3=B8rgensen?= <rogerj@gmail.com>
To: Ronald Bonica <rbonica@juniper.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/6W-UYVuCO95NnUv8xGS9mCNwUqE
Cc: "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 14 May 2014 07:59:00 -0000

On Tue, May 13, 2014 at 7:31 PM, Ronald Bonica <rbonica@juniper.net> wrote:
> Hi Roger,
>
> Or asked more explicitly, can the level of security claimed by the threat=
s document be achieved without implementing the protocol extensions describ=
ed in lisp-sec and lisp-crypto?

I've been pondering on what to answer you since yesterday but think
the reply from Joel cover it well. However as an addon to Joel and
partly reply to your question, see more inline.


On Tue, May 13, 2014 at 11:56 PM, Joel M. Halpern <jmh@joelhalpern.com> wro=
te:
> Ron, I am having trouble with the question.
>
> The threats document describes the threats as they exist today, without t=
he
> adoption of either document that Roger pointed to.  Thus, I do not see an=
y
> dependence.
>
> If there is a threat that is not well described in the base spec or this
> document, then we should add it.  We should add it even if there are
> proposals to remediate it.  But if there is a clear proposal of a missing
> threat, I missed it.

Your question made me question the purpose of the LISP threats draft -
should it cover potential problem with RFC6830 and include pointers to
other work that cover them? That will include we'll get a document
that will be updated over time and is that a good thing?

The other way to look at LISP threats document is to have it as a
"review" of RFC6830, point out weaknesses and discuss them but with no
references to other documents. It will be a upstream document that we
can refer to from like the two draft I mention.

I don't think LISP threat should point to the two draft I mention, but
both drafts should have a reference to LISP threat since this will be
create a more stable threat document.



Then Dino mention:

On Tue, May 13, 2014 at 7:47 PM, Dino Farinacci <farinacci@gmail.com> wrote=
:
<snip>
> The main LISP spec (RFC6830) indicates if you want to trust the mapping s=
ystem you can use the gleaned information as soon as you receive it. And if=
 you don't trust the mapping system, you can send a "verifying Map-Request"=
 to the mapping system which results in a signed Map-Reply returned ala dra=
ft-ietf-lisp-sec-06.


Is this covered in the document? I didn't see it but it's still early here.=
..



--=20

Roger Jorgensen           | ROJO9-RIPE
rogerj@gmail.com          | - IPv6 is The Key!
http://www.jorgensen.no   | roger@jorgensen.no


From nobody Thu May 15 11:15:56 2014
Return-Path: <rbonica@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 582581A02E6 for <lisp@ietfa.amsl.com>; Thu, 15 May 2014 11:15:52 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.602
X-Spam-Level: 
X-Spam-Status: No, score=-101.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8S9wKaA7zNzb for <lisp@ietfa.amsl.com>; Thu, 15 May 2014 11:15:50 -0700 (PDT)
Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0142.outbound.protection.outlook.com [207.46.163.142]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6B3AE1A0317 for <lisp@ietf.org>; Thu, 15 May 2014 11:15:49 -0700 (PDT)
Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by BLUPR05MB628.namprd05.prod.outlook.com (10.141.204.156) with Microsoft SMTP Server (TLS) id 15.0.939.12; Thu, 15 May 2014 18:15:40 +0000
Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) with mapi id 15.00.0944.000; Thu, 15 May 2014 18:15:39 +0000
From: Ronald Bonica <rbonica@juniper.net>
To: "Joel M. Halpern" <jmh@joelhalpern.com>, =?iso-8859-1?Q?Roger_J=F8rgensen?= <rogerj@gmail.com>, Ross Callon <rcallon@juniper.net>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgABKWQCAAuX8QA==
Date: Thu, 15 May 2014 18:15:39 +0000
Message-ID: <172db6c3e26f458ebd70141bed7b7a8b@CO1PR05MB442.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <5372950E.3080704@joelhalpern.com>
In-Reply-To: <5372950E.3080704@joelhalpern.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.14]
x-forefront-prvs: 0212BDE3BE
x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(377454003)(479174003)(24454002)(189002)(13464003)(199002)(51704005)(19580395003)(19580405001)(83322001)(1941001)(31966008)(74502001)(76576001)(66066001)(21056001)(79102001)(20776003)(64706001)(80022001)(15975445006)(4396001)(81342001)(81542001)(33646001)(74662001)(99396002)(85852003)(83072002)(46102001)(76482001)(77982001)(50986999)(54356999)(76176999)(99286001)(86362001)(2656002)(87936001)(101416001)(92566001)(74316001)(561944003)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:BLUPR05MB628; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; 
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/gFivDkL2sZ17Ov9MlTURFtrq0K4
Cc: "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 15 May 2014 18:15:52 -0000

Joel,

The threats document should not depend on lisp-sec or lisp-crypto. However,=
 Roger's response did rely on those documents (see his response, below).=20

So, we are left to explore whether something was omitted from the threats d=
ocument. Standby for my response to Roger.

                                                                        Ron



> -----Original Message-----
> From: Joel M. Halpern [mailto:jmh@joelhalpern.com]
> Sent: Tuesday, May 13, 2014 5:57 PM
> To: Ronald Bonica; Roger J=F8rgensen; Ross Callon
> Cc: lisp@ietf.org
> Subject: Re: [lisp] Restarting last call on LISP threats
>=20
> Ron, I am having trouble with the question.
>=20
> The threats document describes the threats as they exist today, without t=
he
> adoption of either document that Roger pointed to.  Thus, I do not see an=
y
> dependence.
>=20
> If there is a threat that is not well described in the base spec or this
> document, then we should add it.  We should add it even if there are
> proposals to remediate it.  But if there is a clear proposal of a missing=
 threat, I
> missed it.
>=20
> Yours,
> Joel
>=20
> On 5/13/14, 1:31 PM, Ronald Bonica wrote:
> > Hi Roger,
> >
> > Or asked more explicitly, can the level of security claimed by the thre=
ats
> document be achieved without implementing the protocol extensions
> described in lisp-sec and lisp-crypto?
> >
> >                                                            Ron
> >
> >
> >> -----Original Message-----
> >> From: Ronald Bonica
> >> Sent: Tuesday, May 13, 2014 1:22 PM
> >> To: 'Roger J=F8rgensen'; Ross Callon
> >> Cc: lisp@ietf.org
> >> Subject: RE: [lisp] Restarting last call on LISP threats
> >>
> >> Hi Roger,
> >>
> >> Can this draft stand on its own, without integrating content from the
> >> documents that you reference?
> >>
> >>
> >> Ron
> >>
> >>>
> >>> There exist two draft that are relevant to what you address.
> >>>
> >>> You have
> >>> https://datatracker.ietf.org/doc/draft-farinacci-lisp-crypto/
> >>> where the payload of a LISP encapsulated packet are encrypted. None
> >>> of the keys for encrypting/decrypting are stored in the mapping
> >>> system but is calculated by the xTR's involved.
> >>> Then you have https://datatracker.ietf.org/doc/draft-ietf-lisp-sec/
> >>> that attempts to secure the xTR to xTR relationship.
> >>>
> >>>
> >>>
> >>> --
> >>>
> >
> > _______________________________________________
> > lisp mailing list
> > lisp@ietf.org
> > https://www.ietf.org/mailman/listinfo/lisp
> >


From nobody Thu May 15 11:29:43 2014
Return-Path: <jmh.direct@joelhalpern.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E98791A0317 for <lisp@ietfa.amsl.com>; Thu, 15 May 2014 11:29:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.602
X-Spam-Level: 
X-Spam-Status: No, score=-1.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tcpkSamiVPhP for <lisp@ietfa.amsl.com>; Thu, 15 May 2014 11:29:38 -0700 (PDT)
Received: from mailc2.tigertech.net (mailc2.tigertech.net [208.80.4.156]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C5C5D1A030B for <lisp@ietf.org>; Thu, 15 May 2014 11:29:38 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mailc2.tigertech.net (Postfix) with ESMTP id D7671480781; Thu, 15 May 2014 11:29:31 -0700 (PDT)
X-Virus-Scanned: Debian amavisd-new at c2.tigertech.net
Received: from Joels-MacBook-Pro.local (pool-70-106-135-10.clppva.east.verizon.net [70.106.135.10]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mailc2.tigertech.net (Postfix) with ESMTPSA id C5A8C480780; Thu, 15 May 2014 11:29:30 -0700 (PDT)
Message-ID: <53750788.900@joelhalpern.com>
Date: Thu, 15 May 2014 14:29:28 -0400
From: Joel Halpern Direct <jmh.direct@joelhalpern.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.5.0
MIME-Version: 1.0
To: Ronald Bonica <rbonica@juniper.net>,  "Joel M. Halpern" <jmh@joelhalpern.com>, =?ISO-8859-1?Q?Roger_J=F8rgensen?= <rogerj@gmail.com>,  Ross Callon <rcallon@juniper.net>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <5372950E.3080704@joelhalpern.com> <172db6c3e26f458ebd70141bed7b7a8b@CO1PR05MB442.namprd05.prod.outlook.com>
In-Reply-To: <172db6c3e26f458ebd70141bed7b7a8b@CO1PR05MB442.namprd05.prod.outlook.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/YfkZ9XxKlLO-5VJXncJTBCxbbkM
Cc: "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 15 May 2014 18:29:40 -0000

The threats document does not specify how to resolve the threats.  It
identifies problems.  In this particular case, it already identifies the
problem that Ross raised.  Quite clearly.

There is no dependence on the documents Roger pointed to.  They are ways 
of remediating the threat.

Yours,
Joel

On 5/15/14, 2:15 PM, Ronald Bonica wrote:
> Joel,
>
> The threats document should not depend on lisp-sec or lisp-crypto.
> However, Roger's response did rely on those documents (see his
> response, below).
>
> So, we are left to explore whether something was omitted from the
> threats document. Standby for my response to Roger.
>
> Ron
>
>
>
>> -----Original Message----- From: Joel M. Halpern
>> [mailto:jmh@joelhalpern.com] Sent: Tuesday, May 13, 2014 5:57 PM
>> To: Ronald Bonica; Roger Jørgensen; Ross Callon Cc: lisp@ietf.org
>> Subject: Re: [lisp] Restarting last call on LISP threats
>>
>> Ron, I am having trouble with the question.
>>
>> The threats document describes the threats as they exist today,
>> without the adoption of either document that Roger pointed to.
>> Thus, I do not see any dependence.
>>
>> If there is a threat that is not well described in the base spec or
>> this document, then we should add it.  We should add it even if
>> there are proposals to remediate it.  But if there is a clear
>> proposal of a missing threat, I missed it.
>>
>> Yours, Joel
>>
>> On 5/13/14, 1:31 PM, Ronald Bonica wrote:
>>> Hi Roger,
>>>
>>> Or asked more explicitly, can the level of security claimed by
>>> the threats
>> document be achieved without implementing the protocol extensions
>> described in lisp-sec and lisp-crypto?
>>>
>>> Ron
>>>
>>>
>>>> -----Original Message----- From: Ronald Bonica Sent: Tuesday,
>>>> May 13, 2014 1:22 PM To: 'Roger Jørgensen'; Ross Callon Cc:
>>>> lisp@ietf.org Subject: RE: [lisp] Restarting last call on LISP
>>>> threats
>>>>
>>>> Hi Roger,
>>>>
>>>> Can this draft stand on its own, without integrating content
>>>> from the documents that you reference?
>>>>
>>>>
>>>> Ron
>>>>
>>>>>
>>>>> There exist two draft that are relevant to what you address.
>>>>>
>>>>> You have
>>>>> https://datatracker.ietf.org/doc/draft-farinacci-lisp-crypto/
>>>>>
>>>>>
where the payload of a LISP encapsulated packet are encrypted. None
>>>>> of the keys for encrypting/decrypting are stored in the
>>>>> mapping system but is calculated by the xTR's involved. Then
>>>>> you have
>>>>> https://datatracker.ietf.org/doc/draft-ietf-lisp-sec/ that
>>>>> attempts to secure the xTR to xTR relationship.
>>>>>
>>>>>
>>>>>
>>>>> --
>>>>>
>>>
>>> _______________________________________________ lisp mailing
>>> list lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp
>>>


From nobody Thu May 15 11:42:34 2014
Return-Path: <rbonica@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C3DE31A009C for <lisp@ietfa.amsl.com>; Thu, 15 May 2014 11:42:32 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.602
X-Spam-Level: 
X-Spam-Status: No, score=-101.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mxmCT2AS-xPc for <lisp@ietfa.amsl.com>; Thu, 15 May 2014 11:42:30 -0700 (PDT)
Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0144.outbound.protection.outlook.com [207.46.163.144]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8ED201A0053 for <lisp@ietf.org>; Thu, 15 May 2014 11:42:30 -0700 (PDT)
Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO2PR05MB634.namprd05.prod.outlook.com (10.141.199.17) with Microsoft SMTP Server (TLS) id 15.0.944.11; Thu, 15 May 2014 18:42:21 +0000
Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) with mapi id 15.00.0944.000; Thu, 15 May 2014 18:42:21 +0000
From: Ronald Bonica <rbonica@juniper.net>
To: Joel Halpern Direct <jmh.direct@joelhalpern.com>, "Joel M. Halpern" <jmh@joelhalpern.com>, =?iso-8859-1?Q?Roger_J=F8rgensen?= <rogerj@gmail.com>,  Ross Callon <rcallon@juniper.net>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgABKWQCAAuX8QIAABNUAgAADScA=
Date: Thu, 15 May 2014 18:42:20 +0000
Message-ID: <11cf5759b99444189c9ac1621f3a8def@CO1PR05MB442.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <5372950E.3080704@joelhalpern.com> <172db6c3e26f458ebd70141bed7b7a8b@CO1PR05MB442.namprd05.prod.outlook.com> <53750788.900@joelhalpern.com>
In-Reply-To: <53750788.900@joelhalpern.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.14]
x-forefront-prvs: 0212BDE3BE
x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(51704005)(199002)(189002)(377454003)(479174003)(24454002)(13464003)(33646001)(83322001)(87936001)(2656002)(19580395003)(21056001)(19580405001)(76176999)(92566001)(101416001)(86362001)(50986999)(54356999)(99286001)(99396002)(64706001)(20776003)(561944003)(79102001)(66066001)(80022001)(74662001)(31966008)(74502001)(76576001)(15975445006)(76482001)(46102001)(74316001)(77982001)(1941001)(4396001)(81342001)(81542001)(85852003)(83072002)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO2PR05MB634; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; 
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/Au6qMe81qRiLKrKtDOugsTD-N_g
Cc: "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 15 May 2014 18:42:32 -0000

Joel,

Please standby for my response to Roger.

                                    Ron


> -----Original Message-----
> From: Joel Halpern Direct [mailto:jmh.direct@joelhalpern.com]
> Sent: Thursday, May 15, 2014 2:29 PM
> To: Ronald Bonica; Joel M. Halpern; Roger J=F8rgensen; Ross Callon
> Cc: lisp@ietf.org
> Subject: Re: [lisp] Restarting last call on LISP threats
>=20
> The threats document does not specify how to resolve the threats.  It
> identifies problems.  In this particular case, it already identifies the =
problem
> that Ross raised.  Quite clearly.
>=20
> There is no dependence on the documents Roger pointed to.  They are ways
> of remediating the threat.
>=20
> Yours,
> Joel
>=20
> On 5/15/14, 2:15 PM, Ronald Bonica wrote:
> > Joel,
> >
> > The threats document should not depend on lisp-sec or lisp-crypto.
> > However, Roger's response did rely on those documents (see his
> > response, below).
> >
> > So, we are left to explore whether something was omitted from the
> > threats document. Standby for my response to Roger.
> >
> > Ron
> >
> >
> >
> >> -----Original Message----- From: Joel M. Halpern
> >> [mailto:jmh@joelhalpern.com] Sent: Tuesday, May 13, 2014 5:57 PM
> >> To: Ronald Bonica; Roger J=F8rgensen; Ross Callon Cc: lisp@ietf.org
> >> Subject: Re: [lisp] Restarting last call on LISP threats
> >>
> >> Ron, I am having trouble with the question.
> >>
> >> The threats document describes the threats as they exist today,
> >> without the adoption of either document that Roger pointed to.
> >> Thus, I do not see any dependence.
> >>
> >> If there is a threat that is not well described in the base spec or
> >> this document, then we should add it.  We should add it even if there
> >> are proposals to remediate it.  But if there is a clear proposal of a
> >> missing threat, I missed it.
> >>
> >> Yours, Joel
> >>
> >> On 5/13/14, 1:31 PM, Ronald Bonica wrote:
> >>> Hi Roger,
> >>>
> >>> Or asked more explicitly, can the level of security claimed by the
> >>> threats
> >> document be achieved without implementing the protocol extensions
> >> described in lisp-sec and lisp-crypto?
> >>>
> >>> Ron
> >>>
> >>>
> >>>> -----Original Message----- From: Ronald Bonica Sent: Tuesday, May
> >>>> 13, 2014 1:22 PM To: 'Roger J=F8rgensen'; Ross Callon Cc:
> >>>> lisp@ietf.org Subject: RE: [lisp] Restarting last call on LISP
> >>>> threats
> >>>>
> >>>> Hi Roger,
> >>>>
> >>>> Can this draft stand on its own, without integrating content from
> >>>> the documents that you reference?
> >>>>
> >>>>
> >>>> Ron
> >>>>
> >>>>>
> >>>>> There exist two draft that are relevant to what you address.
> >>>>>
> >>>>> You have
> >>>>> https://datatracker.ietf.org/doc/draft-farinacci-lisp-crypto/
> >>>>>
> >>>>>
> where the payload of a LISP encapsulated packet are encrypted. None
> >>>>> of the keys for encrypting/decrypting are stored in the mapping
> >>>>> system but is calculated by the xTR's involved. Then you have
> >>>>> https://datatracker.ietf.org/doc/draft-ietf-lisp-sec/ that
> >>>>> attempts to secure the xTR to xTR relationship.
> >>>>>
> >>>>>
> >>>>>
> >>>>> --
> >>>>>
> >>>
> >>> _______________________________________________ lisp
> mailing list
> >>> lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp
> >>>


From nobody Thu May 15 12:47:18 2014
Return-Path: <rbonica@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C16931A013C for <lisp@ietfa.amsl.com>; Thu, 15 May 2014 12:47:17 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.902
X-Spam-Level: 
X-Spam-Status: No, score=-101.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ez5tp6F3BzsW for <lisp@ietfa.amsl.com>; Thu, 15 May 2014 12:47:15 -0700 (PDT)
Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1blp0187.outbound.protection.outlook.com [207.46.163.187]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 60AB71A016C for <lisp@ietf.org>; Thu, 15 May 2014 12:47:15 -0700 (PDT)
Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO2PR05MB635.namprd05.prod.outlook.com (10.141.199.22) with Microsoft SMTP Server (TLS) id 15.0.944.11; Thu, 15 May 2014 19:47:05 +0000
Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) with mapi id 15.00.0944.000; Thu, 15 May 2014 19:47:05 +0000
From: Ronald Bonica <rbonica@juniper.net>
To: Dino Farinacci <farinacci@gmail.com>, Ross Callon <rcallon@juniper.net>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJJCAIAAFSQAgANEi6A=
Date: Thu, 15 May 2014 19:47:04 +0000
Message-ID: <b8a367fbacd544f088e615ee5dea7001@CO1PR05MB442.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <e03a83d7e45345dfbbe5f08f54cb47fa@CO2PR05MB636.namprd05.prod.outlook.com> <11916828-2EE5-4B46-B6F3-994CD9DBA42D@gmail.com>
In-Reply-To: <11916828-2EE5-4B46-B6F3-994CD9DBA42D@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.14]
x-forefront-prvs: 0212BDE3BE
x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(377454003)(199002)(189002)(13464003)(51704005)(74316001)(66066001)(74662001)(80022001)(74502001)(31966008)(15975445006)(83072002)(2656002)(79102001)(101416001)(87936001)(85852003)(64706001)(76576001)(20776003)(54356999)(4396001)(99286001)(1941001)(99396002)(76482001)(83322001)(19580405001)(33646001)(77982001)(19580395003)(92566001)(21056001)(76176999)(50986999)(86362001)(46102001)(81542001)(81342001)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO2PR05MB635; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; 
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/bZj86_R5o8LhY3Hbo9O8v-8VzIY
Cc: Roger Jorgensen <rogerj@gmail.com>, "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 15 May 2014 19:47:17 -0000

Dino,

Don't you always have to trust the mapping system?=20

Did you mean to say, "If you want to trust the originator of the gleaned in=
formation, ...." ?

                                                                           =
Ron


                                                                           =
                                          =20

> -----Original Message-----
> From: lisp [mailto:lisp-bounces@ietf.org] On Behalf Of Dino Farinacci
> Sent: Tuesday, May 13, 2014 1:47 PM
> To: Ross Callon
> Cc: Roger Jorgensen; lisp@ietf.org
> Subject: Re: [lisp] Restarting last call on LISP threats
>=20
> > Thus if we assume that draft-ietf-lisp-sec-06 works, then what we hear
> back from the mapping system should be correct (or should be equally
> reliable to what we hear back from the DNS system today, and we do today
> rely on DNS when we are contacting our bank or brokerage service to
> conduct financial transactions).
>=20
> The main LISP spec (RFC6830) indicates if you want to trust the mapping
> system you can use the gleaned information as soon as you receive it. And=
 if
> you don't trust the mapping system, you can send a "verifying Map-Request=
"
> to the mapping system which results in a signed Map-Reply returned ala
> draft-ietf-lisp-sec-06.
>=20
> Dino
>=20
> _______________________________________________
> lisp mailing list
> lisp@ietf.org
> https://www.ietf.org/mailman/listinfo/lisp


From nobody Thu May 15 12:55:55 2014
Return-Path: <farinacci@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D61BF1A02E6 for <lisp@ietfa.amsl.com>; Thu, 15 May 2014 12:55:53 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level: 
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9,  DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LKEiSGdXG-10 for <lisp@ietfa.amsl.com>; Thu, 15 May 2014 12:55:52 -0700 (PDT)
Received: from mail-yk0-x22d.google.com (mail-yk0-x22d.google.com [IPv6:2607:f8b0:4002:c07::22d]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ACD991A0146 for <lisp@ietf.org>; Thu, 15 May 2014 12:55:52 -0700 (PDT)
Received: by mail-yk0-f173.google.com with SMTP id 142so1308077ykq.4 for <lisp@ietf.org>; Thu, 15 May 2014 12:55:45 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=P8hM/rbW1a2GJ6GYy9XuTKgymyt7qduiLWq472C2mzg=; b=z3XeGikAFuPk0zIONqg/Ca8yKsyOXdgytCBq+kD+7OM9FDoQHARLamg7E5DOlQI/YL ROHRT055XV2Rl9IrMXXMow6tLm9ZD9Y2qVV+PlA/NnvrRztK7hNefz3DOP+sW7ZX+d9Q /3FroG+D1GeOqoKqYF8W4oUsjVfyXjn8xk/YBg3d7xVyWFSSEjWHSxkwDYrTtjeM0Eh0 6SjN6T9ihyUt9uhvhbVob2V23ATLLd2pAcjXWVp/wOyH+zD64ihyc1Kw0/mSJb6MlKj8 h91VsWoDvB5ex3A1kM/kxMYytHfpMV/xeaVe4F8iUsvo2D0rMCm6EQfsHo6vcrbBcSa0 7vVg==
X-Received: by 10.236.180.169 with SMTP id j29mr18216994yhm.47.1400183745257;  Thu, 15 May 2014 12:55:45 -0700 (PDT)
Received: from [10.241.191.15] ([166.205.49.172]) by mx.google.com with ESMTPSA id y3sm8657888yhd.28.2014.05.15.12.55.44 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Thu, 15 May 2014 12:55:44 -0700 (PDT)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (1.0)
From: Dino Farinacci <farinacci@gmail.com>
X-Mailer: iPhone Mail (11D167)
In-Reply-To: <b8a367fbacd544f088e615ee5dea7001@CO1PR05MB442.namprd05.prod.outlook.com>
Date: Thu, 15 May 2014 15:55:44 -0400
Content-Transfer-Encoding: quoted-printable
Message-Id: <37C7547E-E012-41F3-B49D-994397310FB4@gmail.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <e03a83d7e45345dfbbe5f08f54cb47fa@CO2PR05MB636.namprd05.prod.outlook.com> <11916828-2EE5-4B46-B6F3-994CD9DBA42D@gmail.com> <b8a367fbacd544f088e615ee5dea7001@CO1PR05MB442.namprd05.prod.outlook.com>
To: Ronald Bonica <rbonica@juniper.net>
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/knt1uyh5xZJhHSnBW19jFLolH64
Cc: Roger Jorgensen <rogerj@gmail.com>, "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 15 May 2014 19:55:54 -0000

>=20
> Don't you always have to trust the mapping system?=20

Yes.=20

> Did you mean to say, "If you want to trust the originator of the gleaned i=
nformation, ...." ?

Yes. But what I wrote was not incorrect. If the gleaned information comes fr=
om an xTR from the site, you are not trusting the mapping system at this poi=
nt.=20

Dino=


From nobody Thu May 15 14:02:40 2014
Return-Path: <rbonica@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0FEDA1A0124 for <lisp@ietfa.amsl.com>; Thu, 15 May 2014 14:02:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.602
X-Spam-Level: 
X-Spam-Status: No, score=-101.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iiZlwOFxI2S8 for <lisp@ietfa.amsl.com>; Thu, 15 May 2014 14:02:37 -0700 (PDT)
Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0142.outbound.protection.outlook.com [207.46.163.142]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A23801A011B for <lisp@ietf.org>; Thu, 15 May 2014 14:02:36 -0700 (PDT)
Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO2PR05MB636.namprd05.prod.outlook.com (10.141.199.24) with Microsoft SMTP Server (TLS) id 15.0.944.11; Thu, 15 May 2014 21:02:28 +0000
Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) with mapi id 15.00.0944.000; Thu, 15 May 2014 21:02:27 +0000
From: Ronald Bonica <rbonica@juniper.net>
To: =?utf-8?B?Um9nZXIgSsO4cmdlbnNlbg==?= <rogerj@gmail.com>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEA==
Date: Thu, 15 May 2014 21:02:26 +0000
Message-ID: <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com>
In-Reply-To: <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.14]
x-forefront-prvs: 0212BDE3BE
x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(24454002)(189002)(199002)(13464003)(377454003)(51704005)(15975445006)(86362001)(66066001)(80022001)(74662001)(31966008)(83322001)(19580395003)(19580405001)(81342001)(561944003)(54356999)(50986999)(79102001)(81542001)(74502001)(15202345003)(76176999)(33646001)(16601075003)(99396002)(99286001)(4396001)(20776003)(64706001)(76576001)(74316001)(101416001)(77982001)(83072002)(76482001)(92566001)(85852003)(46102001)(21056001)(2656002)(87936001)(1411001)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO2PR05MB636; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; 
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/1GGr-UOj9tw6TopkErbZ03XswPY
Cc: "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 15 May 2014 21:02:39 -0000

Um9nZXIsDQoNCkhhdmluZyBjb25zaWRlcmVkIHRoaXMsIGl0IGFwcGVhcnMgdGhhdCB0aGUgTElT
UCBkYXRhIHBsYW5lIGNhbiBvcGVyYXRlIGluIHRydXN0ZWQgb3IgdW50cnVzdGVkIG1vZGUuIElu
IHRoZSB0cnVzdGVkIG1vZGUsIHdoZW4gb25lIFhUUiByZWNlaXZlcyBhIGRhdGEtcGxhbmUgcGFj
a2V0IGZyb20gYW5vdGhlciwgaXQgY2FuIHRydXN0IGNvbnRyb2wgcGxhbmUgaW5mb3JtYXRpb24g
dGhhdCBpdCBtaWdodCBnbGVhbiBmcm9tIHRoZSBwYWNrZXQncyBvdXRlciBJUCBoZWFkZXIgYW5k
IExJU1AgaGVhZGVyLiBTdWNoIHRydXN0IGlzIGJhc2VkIG9uIHRoZSBhc3N1bXB0aW9uIHRoYXQ6
DQoNCi0gdGhlIHNlbmRpbmcgWFRSIGlzIHdobyBpdCBjbGFpbXMgdG8gYmUNCi0gdGhlIHNlbmRp
bmcgWFRSIGlzIG5vdCBpbnRlbnRpb25hbGx5IG9mZmVyaW5nIGJhZCBtYXBwaW5nIGluZm9ybWF0
aW9uIHRvIHRoZSByZWNlaXZpbmcgWFRSDQoNCkluIHRydXN0ZWQgbW9kZSwgdGhlIHJlY2Vpdmlu
ZyBYVFIgY2FuIGdsZWFuIGNvbnRyb2wgaW5mb3JtYXRpb24gZnJvbSB0aGUgZGF0YSBwbGFuZS4g
SG93ZXZlciwgaW4gdW50cnVzdGVkIG1vZGUsIHRoZSByZWNlaXZpbmcgWFRSIG11c3Qgbm90IGRv
IHNvLiBBbHRlcm5hdGl2ZWx5LCBpdCBtdXN0IHNlbmQgYSB2ZXJpZnlpbmcgTUFQLVJFUVVFU1Qg
dG8gdGhlIG1hcHBpbmcgc3lzdGVtLg0KDQpTbyBmYXIsIGFsbCBvZiB0aGlzIGlzIGNvdmVyZWQg
bmljZWx5IGJldHdlZW4gUkZDIDY4MzAgYW5kIHRoZSBMSVNQIHRocmVhdHMgZG9jdW1lbnQuIEhv
d2V2ZXIsIHdlIGhhdmUgeWV0IHRvIGV4cGxvcmUgdGhlIHRocmVhdHMgYXNzb2NpYXRlZCB3aXRo
IHVuc2VjdXJlZCBtb2RlIG9wZXJhdGlvbiwgd2hlcmUgZ2xlYW5lZCBpbmZvcm1hdGlvbiBjYW5u
b3QgYmUgdXNlZC4NCg0KRm9yIGV4YW1wbGUsIGFzc3VtZSB0aGF0IHR3byBYVFJzIGFuZCBhbiBh
dHRhY2tlciBhcmUgY29ubmVjdGVkIHRvIHRoZSBnbG9iYWwgSW50ZXJuZXQuIFRoZSBhdHRhY2tl
ciBpcyBuZWl0aGVyIGFuIFhUUiBub3IgY29udGFpbmVkIGJ5IGEgTElTUCBzaXRlLiBUaGUgYXR0
YWNrZXIgaXMgY2FwYWJsZSBvZiBzcG9vZmluZyBpdHMgc291cmNlcyBhZGRyZXNzLg0KDQpUaGUg
YXR0YWNrZXIgY2FuIGxhdW5jaCBhIERvUyBhdHRhY2sgYWdhaW5zdCBhbiBYVFJzIGNvbnRyb2wg
cGxhbiBieSBzZW5kaW5nIGEgYmFycmFnZSBvZiBjcmFmdGVkIHBhY2tldHMgdG8gdGhlIHZpY3Rp
bSBYVFIuIEVhY2ggY3JhZnRlZCBwYWNrZXQgY2F1c2UgdGhlIHZpY3RpbSBYVFIgdG8gc2VuZCBh
IHZlcmlmeWluZyBNQVAtUkVRVUVTVCB0byB0aGUgbWFwcGluZyBzeXN0ZW0uICBUaGUgYXR0YWNr
IHN0cmVhbSBtYXkgYmUgc28gbGFyZ2UgdGhhdCBpdCBjYXVzZXMgdGhlIHZpY3RpbSBYVFIgdG8g
ZXhjZWVkIHRoZSByYXRlIGxpbWl0IGZvciBNQVAtUkVRVUVTVCBtZXNzYWdlcy4gDQoNCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUm9uDQoNCg0KPiAt
LS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiBSb2dlciBKw7hyZ2Vuc2VuIFttYWls
dG86cm9nZXJqQGdtYWlsLmNvbV0NCj4gU2VudDogV2VkbmVzZGF5LCBNYXkgMTQsIDIwMTQgMzo1
OSBBTQ0KPiBUbzogUm9uYWxkIEJvbmljYQ0KPiBDYzogUm9zcyBDYWxsb247IGxpc3BAaWV0Zi5v
cmcNCj4gU3ViamVjdDogUmU6IFtsaXNwXSBSZXN0YXJ0aW5nIGxhc3QgY2FsbCBvbiBMSVNQIHRo
cmVhdHMNCj4gDQo+IE9uIFR1ZSwgTWF5IDEzLCAyMDE0IGF0IDc6MzEgUE0sIFJvbmFsZCBCb25p
Y2EgPHJib25pY2FAanVuaXBlci5uZXQ+DQo+IHdyb3RlOg0KPiA+IEhpIFJvZ2VyLA0KPiA+DQo+
ID4gT3IgYXNrZWQgbW9yZSBleHBsaWNpdGx5LCBjYW4gdGhlIGxldmVsIG9mIHNlY3VyaXR5IGNs
YWltZWQgYnkgdGhlIHRocmVhdHMNCj4gZG9jdW1lbnQgYmUgYWNoaWV2ZWQgd2l0aG91dCBpbXBs
ZW1lbnRpbmcgdGhlIHByb3RvY29sIGV4dGVuc2lvbnMNCj4gZGVzY3JpYmVkIGluIGxpc3Atc2Vj
IGFuZCBsaXNwLWNyeXB0bz8NCj4gDQo+IEkndmUgYmVlbiBwb25kZXJpbmcgb24gd2hhdCB0byBh
bnN3ZXIgeW91IHNpbmNlIHllc3RlcmRheSBidXQgdGhpbmsgdGhlDQo+IHJlcGx5IGZyb20gSm9l
bCBjb3ZlciBpdCB3ZWxsLiBIb3dldmVyIGFzIGFuIGFkZG9uIHRvIEpvZWwgYW5kIHBhcnRseSBy
ZXBseSB0bw0KPiB5b3VyIHF1ZXN0aW9uLCBzZWUgbW9yZSBpbmxpbmUuDQo+IA0KPiANCj4gT24g
VHVlLCBNYXkgMTMsIDIwMTQgYXQgMTE6NTYgUE0sIEpvZWwgTS4gSGFscGVybiA8am1oQGpvZWxo
YWxwZXJuLmNvbT4NCj4gd3JvdGU6DQo+ID4gUm9uLCBJIGFtIGhhdmluZyB0cm91YmxlIHdpdGgg
dGhlIHF1ZXN0aW9uLg0KPiA+DQo+ID4gVGhlIHRocmVhdHMgZG9jdW1lbnQgZGVzY3JpYmVzIHRo
ZSB0aHJlYXRzIGFzIHRoZXkgZXhpc3QgdG9kYXksDQo+ID4gd2l0aG91dCB0aGUgYWRvcHRpb24g
b2YgZWl0aGVyIGRvY3VtZW50IHRoYXQgUm9nZXIgcG9pbnRlZCB0by4gIFRodXMsDQo+ID4gSSBk
byBub3Qgc2VlIGFueSBkZXBlbmRlbmNlLg0KPiA+DQo+ID4gSWYgdGhlcmUgaXMgYSB0aHJlYXQg
dGhhdCBpcyBub3Qgd2VsbCBkZXNjcmliZWQgaW4gdGhlIGJhc2Ugc3BlYyBvcg0KPiA+IHRoaXMg
ZG9jdW1lbnQsIHRoZW4gd2Ugc2hvdWxkIGFkZCBpdC4gIFdlIHNob3VsZCBhZGQgaXQgZXZlbiBp
ZiB0aGVyZQ0KPiA+IGFyZSBwcm9wb3NhbHMgdG8gcmVtZWRpYXRlIGl0LiAgQnV0IGlmIHRoZXJl
IGlzIGEgY2xlYXIgcHJvcG9zYWwgb2YgYQ0KPiA+IG1pc3NpbmcgdGhyZWF0LCBJIG1pc3NlZCBp
dC4NCj4gDQo+IFlvdXIgcXVlc3Rpb24gbWFkZSBtZSBxdWVzdGlvbiB0aGUgcHVycG9zZSBvZiB0
aGUgTElTUCB0aHJlYXRzIGRyYWZ0IC0NCj4gc2hvdWxkIGl0IGNvdmVyIHBvdGVudGlhbCBwcm9i
bGVtIHdpdGggUkZDNjgzMCBhbmQgaW5jbHVkZSBwb2ludGVycyB0byBvdGhlcg0KPiB3b3JrIHRo
YXQgY292ZXIgdGhlbT8gVGhhdCB3aWxsIGluY2x1ZGUgd2UnbGwgZ2V0IGEgZG9jdW1lbnQgdGhh
dCB3aWxsIGJlDQo+IHVwZGF0ZWQgb3ZlciB0aW1lIGFuZCBpcyB0aGF0IGEgZ29vZCB0aGluZz8N
Cj4gDQo+IFRoZSBvdGhlciB3YXkgdG8gbG9vayBhdCBMSVNQIHRocmVhdHMgZG9jdW1lbnQgaXMg
dG8gaGF2ZSBpdCBhcyBhICJyZXZpZXciIG9mDQo+IFJGQzY4MzAsIHBvaW50IG91dCB3ZWFrbmVz
c2VzIGFuZCBkaXNjdXNzIHRoZW0gYnV0IHdpdGggbm8gcmVmZXJlbmNlcyB0bw0KPiBvdGhlciBk
b2N1bWVudHMuIEl0IHdpbGwgYmUgYSB1cHN0cmVhbSBkb2N1bWVudCB0aGF0IHdlIGNhbiByZWZl
ciB0byBmcm9tDQo+IGxpa2UgdGhlIHR3byBkcmFmdCBJIG1lbnRpb24uDQo+IA0KPiBJIGRvbid0
IHRoaW5rIExJU1AgdGhyZWF0IHNob3VsZCBwb2ludCB0byB0aGUgdHdvIGRyYWZ0IEkgbWVudGlv
biwgYnV0IGJvdGgNCj4gZHJhZnRzIHNob3VsZCBoYXZlIGEgcmVmZXJlbmNlIHRvIExJU1AgdGhy
ZWF0IHNpbmNlIHRoaXMgd2lsbCBiZSBjcmVhdGUgYSBtb3JlDQo+IHN0YWJsZSB0aHJlYXQgZG9j
dW1lbnQuDQo+IA0KPiANCj4gDQo+IFRoZW4gRGlubyBtZW50aW9uOg0KPiANCj4gT24gVHVlLCBN
YXkgMTMsIDIwMTQgYXQgNzo0NyBQTSwgRGlubyBGYXJpbmFjY2kgPGZhcmluYWNjaUBnbWFpbC5j
b20+DQo+IHdyb3RlOg0KPiA8c25pcD4NCj4gPiBUaGUgbWFpbiBMSVNQIHNwZWMgKFJGQzY4MzAp
IGluZGljYXRlcyBpZiB5b3Ugd2FudCB0byB0cnVzdCB0aGUgbWFwcGluZw0KPiBzeXN0ZW0geW91
IGNhbiB1c2UgdGhlIGdsZWFuZWQgaW5mb3JtYXRpb24gYXMgc29vbiBhcyB5b3UgcmVjZWl2ZSBp
dC4gQW5kIGlmDQo+IHlvdSBkb24ndCB0cnVzdCB0aGUgbWFwcGluZyBzeXN0ZW0sIHlvdSBjYW4g
c2VuZCBhICJ2ZXJpZnlpbmcgTWFwLVJlcXVlc3QiDQo+IHRvIHRoZSBtYXBwaW5nIHN5c3RlbSB3
aGljaCByZXN1bHRzIGluIGEgc2lnbmVkIE1hcC1SZXBseSByZXR1cm5lZCBhbGENCj4gZHJhZnQt
aWV0Zi1saXNwLXNlYy0wNi4NCj4gDQo+IA0KPiBJcyB0aGlzIGNvdmVyZWQgaW4gdGhlIGRvY3Vt
ZW50PyBJIGRpZG4ndCBzZWUgaXQgYnV0IGl0J3Mgc3RpbGwgZWFybHkgaGVyZS4uLg0KPiANCj4g
DQo+IA0KPiAtLQ0KPiANCj4gUm9nZXIgSm9yZ2Vuc2VuICAgICAgICAgICB8IFJPSk85LVJJUEUN
Cj4gcm9nZXJqQGdtYWlsLmNvbSAgICAgICAgICB8IC0gSVB2NiBpcyBUaGUgS2V5IQ0KPiBodHRw
Oi8vd3d3LmpvcmdlbnNlbi5ubyAgIHwgcm9nZXJAam9yZ2Vuc2VuLm5vDQo=


From nobody Thu May 15 14:39:50 2014
Return-Path: <rcallon@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F11E61A02A2 for <lisp@ietfa.amsl.com>; Thu, 15 May 2014 14:39:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.602
X-Spam-Level: 
X-Spam-Status: No, score=-1.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oaRZdyIk9FBb for <lisp@ietfa.amsl.com>; Thu, 15 May 2014 14:39:46 -0700 (PDT)
Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0145.outbound.protection.outlook.com [207.46.163.145]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C824E1A014B for <lisp@ietf.org>; Thu, 15 May 2014 14:39:45 -0700 (PDT)
Received: from CO2PR05MB636.namprd05.prod.outlook.com (10.141.199.24) by BN1PR05MB437.namprd05.prod.outlook.com (10.141.58.11) with Microsoft SMTP Server (TLS) id 15.0.939.12; Thu, 15 May 2014 21:39:37 +0000
Received: from CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) by CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) with mapi id 15.00.0944.000; Thu, 15 May 2014 21:39:36 +0000
From: Ross Callon <rcallon@juniper.net>
To: Joel Halpern Direct <jmh.direct@joelhalpern.com>, Ronald Bonica <rbonica@juniper.net>, "Joel M. Halpern" <jmh@joelhalpern.com>, =?iso-8859-1?Q?Roger_J=F8rgensen?= <rogerj@gmail.com>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58M9eFhkxJvMEaw1MEc+Ryfdps9MyiAgAD04oCAAJ/u8IAAAtXQgABKWQCAAub1gIAAA9wAgAA0wSA=
Date: Thu, 15 May 2014 21:39:35 +0000
Message-ID: <0f6d1eca517e45f7ac5217f3ba1e8d80@CO2PR05MB636.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <5372950E.3080704@joelhalpern.com> <172db6c3e26f458ebd70141bed7b7a8b@CO1PR05MB442.namprd05.prod.outlook.com> <53750788.900@joelhalpern.com>
In-Reply-To: <53750788.900@joelhalpern.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.11]
x-forefront-prvs: 0212BDE3BE
x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(51704005)(199002)(189002)(24454002)(13464003)(479174003)(377454003)(33646001)(561944003)(101416001)(81542001)(81342001)(4396001)(46102001)(76576001)(1941001)(76482001)(77982001)(85852003)(74316001)(83072002)(92566001)(86362001)(99396002)(19580395003)(87936001)(99286001)(2656002)(19580405001)(15975445006)(83322001)(80022001)(66066001)(20776003)(64706001)(74502001)(79102001)(50986999)(31966008)(76176999)(21056001)(74662001)(54356999)(77096999)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:BN1PR05MB437; H:CO2PR05MB636.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rcallon@juniper.net; 
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/adGLqpPt4fO_2Za7aCVd7U73Hgw
Cc: "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 15 May 2014 21:39:47 -0000

I raised a list of problems. They are not all already mentioned in the thre=
ats document (eg, note the privacy issue at the end of my detailed email).=
=20

Ross

-----Original Message-----
From: Joel Halpern Direct [mailto:jmh.direct@joelhalpern.com]=20
Sent: Thursday, May 15, 2014 2:29 PM
To: Ronald Bonica; Joel M. Halpern; Roger J=F8rgensen; Ross Callon
Cc: lisp@ietf.org
Subject: Re: [lisp] Restarting last call on LISP threats

The threats document does not specify how to resolve the threats.  It
identifies problems.  In this particular case, it already identifies the
problem that Ross raised.  Quite clearly.

There is no dependence on the documents Roger pointed to.  They are ways=20
of remediating the threat.

Yours,
Joel

On 5/15/14, 2:15 PM, Ronald Bonica wrote:
> Joel,
>
> The threats document should not depend on lisp-sec or lisp-crypto.
> However, Roger's response did rely on those documents (see his
> response, below).
>
> So, we are left to explore whether something was omitted from the
> threats document. Standby for my response to Roger.
>
> Ron
>
>
>
>> -----Original Message----- From: Joel M. Halpern
>> [mailto:jmh@joelhalpern.com] Sent: Tuesday, May 13, 2014 5:57 PM
>> To: Ronald Bonica; Roger J=F8rgensen; Ross Callon Cc: lisp@ietf.org
>> Subject: Re: [lisp] Restarting last call on LISP threats
>>
>> Ron, I am having trouble with the question.
>>
>> The threats document describes the threats as they exist today,
>> without the adoption of either document that Roger pointed to.
>> Thus, I do not see any dependence.
>>
>> If there is a threat that is not well described in the base spec or
>> this document, then we should add it.  We should add it even if
>> there are proposals to remediate it.  But if there is a clear
>> proposal of a missing threat, I missed it.
>>
>> Yours, Joel
>>
>> On 5/13/14, 1:31 PM, Ronald Bonica wrote:
>>> Hi Roger,
>>>
>>> Or asked more explicitly, can the level of security claimed by
>>> the threats
>> document be achieved without implementing the protocol extensions
>> described in lisp-sec and lisp-crypto?
>>>
>>> Ron
>>>
>>>
>>>> -----Original Message----- From: Ronald Bonica Sent: Tuesday,
>>>> May 13, 2014 1:22 PM To: 'Roger J=F8rgensen'; Ross Callon Cc:
>>>> lisp@ietf.org Subject: RE: [lisp] Restarting last call on LISP
>>>> threats
>>>>
>>>> Hi Roger,
>>>>
>>>> Can this draft stand on its own, without integrating content
>>>> from the documents that you reference?
>>>>
>>>>
>>>> Ron
>>>>
>>>>>
>>>>> There exist two draft that are relevant to what you address.
>>>>>
>>>>> You have
>>>>> https://datatracker.ietf.org/doc/draft-farinacci-lisp-crypto/
>>>>>
>>>>>
where the payload of a LISP encapsulated packet are encrypted. None
>>>>> of the keys for encrypting/decrypting are stored in the
>>>>> mapping system but is calculated by the xTR's involved. Then
>>>>> you have
>>>>> https://datatracker.ietf.org/doc/draft-ietf-lisp-sec/ that
>>>>> attempts to secure the xTR to xTR relationship.
>>>>>
>>>>>
>>>>>
>>>>> --
>>>>>
>>>
>>> _______________________________________________ lisp mailing
>>> list lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp
>>>


From nobody Thu May 15 14:42:34 2014
Return-Path: <jmh@joelhalpern.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C6B41A0144 for <lisp@ietfa.amsl.com>; Thu, 15 May 2014 14:42:30 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.602
X-Spam-Level: 
X-Spam-Status: No, score=-1.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j8pYmf81C9aG for <lisp@ietfa.amsl.com>; Thu, 15 May 2014 14:42:29 -0700 (PDT)
Received: from mailc2.tigertech.net (mailc2.tigertech.net [208.80.4.156]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 71F4A1A0138 for <lisp@ietf.org>; Thu, 15 May 2014 14:42:29 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mailc2.tigertech.net (Postfix) with ESMTP id 6B951481C8D; Thu, 15 May 2014 14:42:22 -0700 (PDT)
X-Virus-Scanned: Debian amavisd-new at c2.tigertech.net
Received: from Joels-MacBook-Pro.local (pool-70-106-135-10.clppva.east.verizon.net [70.106.135.10]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mailc2.tigertech.net (Postfix) with ESMTPSA id 27EA4481C92; Thu, 15 May 2014 14:42:21 -0700 (PDT)
Message-ID: <537534BA.6020106@joelhalpern.com>
Date: Thu, 15 May 2014 17:42:18 -0400
From: "Joel M. Halpern" <jmh@joelhalpern.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.5.0
MIME-Version: 1.0
To: Ross Callon <rcallon@juniper.net>,  Joel Halpern Direct <jmh.direct@joelhalpern.com>, Ronald Bonica <rbonica@juniper.net>, =?ISO-8859-1?Q?Roger_J=F8rgensen?= <rogerj@gmail.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <5372950E.3080704@joelhalpern.com> <172db6c3e26f458ebd70141bed7b7a8b@CO1PR05MB442.namprd05.prod.outlook.com> <53750788.900@joelhalpern.com> <0f6d1eca517e45f7ac5217f3ba1e8d80@CO2PR05MB636.namprd05.prod.outlook.com>
In-Reply-To: <0f6d1eca517e45f7ac5217f3ba1e8d80@CO2PR05MB636.namprd05.prod.outlook.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/XEDWjJrwHqQ1rr22n05kHN4pnoA
Cc: "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 15 May 2014 21:42:30 -0000

I may have misread the discussion.
I was commenting only on the one topic of gleaning.  I was leaving it to 
the authors to respond to your other comments.
Yours,
Joel

On 5/15/14, 5:39 PM, Ross Callon wrote:
> I raised a list of problems. They are not all already mentioned in the threats document (eg, note the privacy issue at the end of my detailed email).
>
> Ross
>
> -----Original Message-----
> From: Joel Halpern Direct [mailto:jmh.direct@joelhalpern.com]
> Sent: Thursday, May 15, 2014 2:29 PM
> To: Ronald Bonica; Joel M. Halpern; Roger Jørgensen; Ross Callon
> Cc: lisp@ietf.org
> Subject: Re: [lisp] Restarting last call on LISP threats
>
> The threats document does not specify how to resolve the threats.  It
> identifies problems.  In this particular case, it already identifies the
> problem that Ross raised.  Quite clearly.
>
> There is no dependence on the documents Roger pointed to.  They are ways
> of remediating the threat.
>
> Yours,
> Joel
>
> On 5/15/14, 2:15 PM, Ronald Bonica wrote:
>> Joel,
>>
>> The threats document should not depend on lisp-sec or lisp-crypto.
>> However, Roger's response did rely on those documents (see his
>> response, below).
>>
>> So, we are left to explore whether something was omitted from the
>> threats document. Standby for my response to Roger.
>>
>> Ron
>>
>>
>>
>>> -----Original Message----- From: Joel M. Halpern
>>> [mailto:jmh@joelhalpern.com] Sent: Tuesday, May 13, 2014 5:57 PM
>>> To: Ronald Bonica; Roger Jørgensen; Ross Callon Cc: lisp@ietf.org
>>> Subject: Re: [lisp] Restarting last call on LISP threats
>>>
>>> Ron, I am having trouble with the question.
>>>
>>> The threats document describes the threats as they exist today,
>>> without the adoption of either document that Roger pointed to.
>>> Thus, I do not see any dependence.
>>>
>>> If there is a threat that is not well described in the base spec or
>>> this document, then we should add it.  We should add it even if
>>> there are proposals to remediate it.  But if there is a clear
>>> proposal of a missing threat, I missed it.
>>>
>>> Yours, Joel
>>>
>>> On 5/13/14, 1:31 PM, Ronald Bonica wrote:
>>>> Hi Roger,
>>>>
>>>> Or asked more explicitly, can the level of security claimed by
>>>> the threats
>>> document be achieved without implementing the protocol extensions
>>> described in lisp-sec and lisp-crypto?
>>>>
>>>> Ron
>>>>
>>>>
>>>>> -----Original Message----- From: Ronald Bonica Sent: Tuesday,
>>>>> May 13, 2014 1:22 PM To: 'Roger Jørgensen'; Ross Callon Cc:
>>>>> lisp@ietf.org Subject: RE: [lisp] Restarting last call on LISP
>>>>> threats
>>>>>
>>>>> Hi Roger,
>>>>>
>>>>> Can this draft stand on its own, without integrating content
>>>>> from the documents that you reference?
>>>>>
>>>>>
>>>>> Ron
>>>>>
>>>>>>
>>>>>> There exist two draft that are relevant to what you address.
>>>>>>
>>>>>> You have
>>>>>> https://datatracker.ietf.org/doc/draft-farinacci-lisp-crypto/
>>>>>>
>>>>>>
> where the payload of a LISP encapsulated packet are encrypted. None
>>>>>> of the keys for encrypting/decrypting are stored in the
>>>>>> mapping system but is calculated by the xTR's involved. Then
>>>>>> you have
>>>>>> https://datatracker.ietf.org/doc/draft-ietf-lisp-sec/ that
>>>>>> attempts to secure the xTR to xTR relationship.
>>>>>>
>>>>>>
>>>>>>
>>>>>> --
>>>>>>
>>>>
>>>> _______________________________________________ lisp mailing
>>>> list lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp
>>>>
>


From nobody Thu May 15 14:48:05 2014
Return-Path: <rcallon@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7453D1A0150 for <lisp@ietfa.amsl.com>; Thu, 15 May 2014 14:48:03 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.301
X-Spam-Level: 
X-Spam-Status: No, score=-2.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8bNqs33Tz0VJ for <lisp@ietfa.amsl.com>; Thu, 15 May 2014 14:48:00 -0700 (PDT)
Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2lp0204.outbound.protection.outlook.com [207.46.163.204]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6B2D11A014B for <lisp@ietf.org>; Thu, 15 May 2014 14:48:00 -0700 (PDT)
Received: from CO2PR05MB636.namprd05.prod.outlook.com (10.141.199.24) by BLUPR05MB433.namprd05.prod.outlook.com (10.141.27.140) with Microsoft SMTP Server (TLS) id 15.0.944.11; Thu, 15 May 2014 21:47:45 +0000
Received: from CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) by CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) with mapi id 15.00.0944.000; Thu, 15 May 2014 21:47:44 +0000
From: Ross Callon <rcallon@juniper.net>
To: "Joel M. Halpern" <jmh@joelhalpern.com>, Joel Halpern Direct <jmh.direct@joelhalpern.com>, Ronald Bonica <rbonica@juniper.net>, =?iso-8859-1?Q?Roger_J=F8rgensen?= <rogerj@gmail.com>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58M9eFhkxJvMEaw1MEc+Ryfdps9MyiAgAD04oCAAJ/u8IAAAtXQgABKWQCAAub1gIAAA9wAgAA0wSCAAAEgAIAAAVZA
Date: Thu, 15 May 2014 21:47:43 +0000
Message-ID: <d2cdd5d87e57474eb1fc8ef42583b308@CO2PR05MB636.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <5372950E.3080704@joelhalpern.com> <172db6c3e26f458ebd70141bed7b7a8b@CO1PR05MB442.namprd05.prod.outlook.com> <53750788.900@joelhalpern.com> <0f6d1eca517e45f7ac5217f3ba1e8d80@CO2PR05MB636.namprd05.prod.outlook.com> <537534BA.6020106@joelhalpern.com>
In-Reply-To: <537534BA.6020106@joelhalpern.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.11]
x-forefront-prvs: 0212BDE3BE
x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(51704005)(199002)(189002)(24454002)(377454003)(13464003)(479174003)(19580405001)(76482001)(74502001)(561944003)(83322001)(50986999)(77096999)(76176999)(54356999)(31966008)(15975445006)(33646001)(77982001)(46102001)(99396002)(81342001)(81542001)(99286001)(74316001)(74662001)(19580395003)(80022001)(86362001)(66066001)(21056001)(76576001)(92566001)(20776003)(64706001)(79102001)(85852003)(1941001)(83072002)(87936001)(101416001)(2656002)(4396001)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:BLUPR05MB433; H:CO2PR05MB636.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rcallon@juniper.net; 
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/t1O_9IYoreMpZA4BMgoabafTgDU
Cc: "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 15 May 2014 21:48:03 -0000

No problem. I just didn't want the other issues to be forgotten in the exci=
tement over gleaning.=20

Ross

-----Original Message-----
From: Joel M. Halpern [mailto:jmh@joelhalpern.com]=20
Sent: Thursday, May 15, 2014 5:42 PM
To: Ross Callon; Joel Halpern Direct; Ronald Bonica; Roger J=F8rgensen
Cc: lisp@ietf.org
Subject: Re: [lisp] Restarting last call on LISP threats

I may have misread the discussion.
I was commenting only on the one topic of gleaning.  I was leaving it to=20
the authors to respond to your other comments.
Yours,
Joel

On 5/15/14, 5:39 PM, Ross Callon wrote:
> I raised a list of problems. They are not all already mentioned in the th=
reats document (eg, note the privacy issue at the end of my detailed email)=
.
>
> Ross
>
> -----Original Message-----
> From: Joel Halpern Direct [mailto:jmh.direct@joelhalpern.com]
> Sent: Thursday, May 15, 2014 2:29 PM
> To: Ronald Bonica; Joel M. Halpern; Roger J=F8rgensen; Ross Callon
> Cc: lisp@ietf.org
> Subject: Re: [lisp] Restarting last call on LISP threats
>
> The threats document does not specify how to resolve the threats.  It
> identifies problems.  In this particular case, it already identifies the
> problem that Ross raised.  Quite clearly.
>
> There is no dependence on the documents Roger pointed to.  They are ways
> of remediating the threat.
>
> Yours,
> Joel
>
> On 5/15/14, 2:15 PM, Ronald Bonica wrote:
>> Joel,
>>
>> The threats document should not depend on lisp-sec or lisp-crypto.
>> However, Roger's response did rely on those documents (see his
>> response, below).
>>
>> So, we are left to explore whether something was omitted from the
>> threats document. Standby for my response to Roger.
>>
>> Ron
>>
>>
>>
>>> -----Original Message----- From: Joel M. Halpern
>>> [mailto:jmh@joelhalpern.com] Sent: Tuesday, May 13, 2014 5:57 PM
>>> To: Ronald Bonica; Roger J=F8rgensen; Ross Callon Cc: lisp@ietf.org
>>> Subject: Re: [lisp] Restarting last call on LISP threats
>>>
>>> Ron, I am having trouble with the question.
>>>
>>> The threats document describes the threats as they exist today,
>>> without the adoption of either document that Roger pointed to.
>>> Thus, I do not see any dependence.
>>>
>>> If there is a threat that is not well described in the base spec or
>>> this document, then we should add it.  We should add it even if
>>> there are proposals to remediate it.  But if there is a clear
>>> proposal of a missing threat, I missed it.
>>>
>>> Yours, Joel
>>>
>>> On 5/13/14, 1:31 PM, Ronald Bonica wrote:
>>>> Hi Roger,
>>>>
>>>> Or asked more explicitly, can the level of security claimed by
>>>> the threats
>>> document be achieved without implementing the protocol extensions
>>> described in lisp-sec and lisp-crypto?
>>>>
>>>> Ron
>>>>
>>>>
>>>>> -----Original Message----- From: Ronald Bonica Sent: Tuesday,
>>>>> May 13, 2014 1:22 PM To: 'Roger J=F8rgensen'; Ross Callon Cc:
>>>>> lisp@ietf.org Subject: RE: [lisp] Restarting last call on LISP
>>>>> threats
>>>>>
>>>>> Hi Roger,
>>>>>
>>>>> Can this draft stand on its own, without integrating content
>>>>> from the documents that you reference?
>>>>>
>>>>>
>>>>> Ron
>>>>>
>>>>>>
>>>>>> There exist two draft that are relevant to what you address.
>>>>>>
>>>>>> You have
>>>>>> https://datatracker.ietf.org/doc/draft-farinacci-lisp-crypto/
>>>>>>
>>>>>>
> where the payload of a LISP encapsulated packet are encrypted. None
>>>>>> of the keys for encrypting/decrypting are stored in the
>>>>>> mapping system but is calculated by the xTR's involved. Then
>>>>>> you have
>>>>>> https://datatracker.ietf.org/doc/draft-ietf-lisp-sec/ that
>>>>>> attempts to secure the xTR to xTR relationship.
>>>>>>
>>>>>>
>>>>>>
>>>>>> --
>>>>>>
>>>>
>>>> _______________________________________________ lisp mailing
>>>> list lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp
>>>>
>


From nobody Fri May 16 10:06:13 2014
Return-Path: <jmh@joelhalpern.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BDDE31A02CC; Fri, 16 May 2014 10:06:10 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Level: 
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IJHo6_IDlC4D; Fri, 16 May 2014 10:06:09 -0700 (PDT)
Received: from mailc2.tigertech.net (mailc2.tigertech.net [208.80.4.156]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F113A1A02AE; Fri, 16 May 2014 10:06:08 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mailc2.tigertech.net (Postfix) with ESMTP id B1AB5141E34; Fri, 16 May 2014 10:06:01 -0700 (PDT)
X-Virus-Scanned: Debian amavisd-new at c2.tigertech.net
Received: from Joels-MacBook-Pro.local (pool-70-106-135-10.clppva.east.verizon.net [70.106.135.10]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mailc2.tigertech.net (Postfix) with ESMTPSA id D7DC3141E33; Fri, 16 May 2014 10:06:00 -0700 (PDT)
Message-ID: <53764577.6070502@joelhalpern.com>
Date: Fri, 16 May 2014 13:05:59 -0400
From: "Joel M. Halpern" <jmh@joelhalpern.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.5.0
MIME-Version: 1.0
To: "lisp@ietf.org" <lisp@ietf.org>, "karp@ietf.org" <karp@ietf.org>
References: <9913.1400250296@sandelman.ca>
In-Reply-To: <9913.1400250296@sandelman.ca>
X-Forwarded-Message-Id: <9913.1400250296@sandelman.ca>
Content-Type: multipart/mixed; boundary="------------090905030802060406060007"
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/inC4uqsa7w5h0zPZdyfZySD-Jto
Subject: [lisp] Fwd: NomCom 2014-2015 Call for Volunteers
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 16 May 2014 17:06:11 -0000

This is a multi-part message in MIME format.
--------------090905030802060406060007
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Please consider volunteering for the IETF nominating committee.
Broad community participation is important for our process.

Thank you,
Joel


-------- Original Message --------
Subject: NomCom 2014-2015 Call for Volunteers
Date: Fri, 16 May 2014 10:24:56 -0400
From: Michael Richardson <mcr+ietf@sandelman.ca>
Reply-To: nomcom-chair-2014@ietf.org
To: ietf@ietf.org


{I have to post using my subscribed address. Appologies for duplicates}

The IETF nominating committee (nomcom) process for 2014-15 has begun. The
IETF nomcom appoints folks to fill the open slots on the IAOC, the IAB,
and the IESG (including IETF Chair).

Ten voting members for the nomcom are selected in a verifiably random
way from a pool of volunteers. The more volunteers, the better chance we 
have of
choosing a random yet representative cross section of the IETF population.

Let's break the 200 volunteer mark again this year!

The details of the operation of the nomcom can be found in RFC 3777,
and BCP10/RFC3797 details the selection algorithm.

Volunteers must have attended 3 of the past 5 IETF meetings.  As 
specified in
RFC 3777, that means three out of the five past meetings up to the time this
email announcement goes out to start the solicitation of volunteers.
The five meetings out of which you must have attended *three*
are IETF 85(Atlanta),      \
          86(Orlando),       \
          87(Berlin),         *** ANY THREE!
          88(Vancouver),     /
          89(London)        /

If you qualify, please volunteer.   However, much as we want this, 
before you
decide to volunteer, please be sure you are willing to forgo appointment
to any of the positions for which this nomcom is responsible.

The list of people and posts whose terms end with the March 2015 IETF
meeting, and thus the positions for which this nomcom is responsible, are

IAOC:
To be confirmed

IAB:
Joel Halpern
Russ Housley
Eliot Lear
Xing Li
Andrew Sullivan
Dave Thaler

IESG:
Pete Resnick (Applications)
Ted Lemon (Internet)
Joel Jaeggli (Operations and Management)
Richard Barnes (RAI)
Adrian Farrel* (Routing)
Stephen Farrell (Security)
Spencer Dawkins (Transport)
Jari Arkko (Gen)

(names with * have publically indicated they will not serve another term)

The primary activity for this nomcom will begin in July 2014 and should be
completed in January 2015.   The nomcom will have regularly scheduled
conference calls to ensure progress. (We might dogfood WebRTC)
There will be activities to collect requirements from the community, review
candidate questionnaires, review feedback from community members about
candidates, and talk to candidates.

Thus, being a nomcom member does require some time commitment; but it is 
also
a very rewarding experience.

It is very important that you be able to attend IETF91 to conduct 
interviews.
Being at IETF90 is useful for training.  Being at IETF92 is not essential.

Please volunteer by sending me an email before 11:59 pm EDT (UTC -4 hours)
June 22, 2013, as follows:

To: nomcom-chair-2014@ietf.org
Subject: Nomcom 2014-15 Volunteer

Please include the following information in the email body:

  <Your Full Name>
     // First/Given Name followed by Last/Family Name
     // matching how you enter it in the IETF Registration Form)

  <Current Primary Affiliation>
     // Typically what goes in the Company field
     // in the IETF Registration Form
[<All email addresses used to register for the past 5 IETF meetings>]
  <Preferred email address>
  <Telephone number>
     // For confirmation if selected

You should expect an email response from me within 3 business days stating
whether or not you are qualified.  If you don't receive this response,
please re-send your email with the tag "RESEND"" added to the subject line.

If you are not yet sure if you would like to volunteer, please consider
that nomcom members play a very important role in shaping the leadership
of the IETF.  Questions by email or voice are welcome.
Volunteering for the nomcom is a great way to contribute to the IETF!

You can find a detailed timeline on the nomcom web site at:
     https://datatracker.ietf.org/nomcom/2014/

I will be publishing a more detailed target timetable, as well as details
of the randomness seeds to be used for the RFC 3797 selection process,
within the next couple weeks.

Thank you!
Michael Richardson
mcr+nomcom@sandelman.ca
nomcom-chair-2014@ietf.org





--------------090905030802060406060007
Content-Type: application/pgp-signature;
 name="Attached Message Part"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
 filename="Attached Message Part"

LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KVmVyc2lvbjogR251UEcgdjEuNC4xMiAo
R05VL0xpbnV4KQoKaVFFVkF3VUJVM1lmdDRDTGNQdmQwTjFsQVFLNEVnZi9WZmxWbmdiTHU3
NEhpai83WUtDbGVLcG8ybWZUVi90NAplcWhacndkWkh1SlhrbTdlZWEzbk5TdG5jQXRiY0dD
R1hUZXY1WThEMkFMdkJtamdUZlpRano0YXNkcjVNU3BnCkZ3aEM1ZVNSRVJFbVpiSU5mbjdY
L2NtOHZFc1RpWjFDbndPUUdHMWxPVjFUQ1Q4TWg0aEFNYnZpZWJtRHdOdFkKTWVmU1VkV21S
YkF4TkdqbDJmQkRoeDRvV3lNaDNaa1hyWnNwMlNHMzloUWoweFZUcGEvdXJvMGRqNFB3Q0NK
SgpjTXFnbUVKd1V1VXpLc3RCdzY4U3BsT3B5ZUIreDZxZ1QwcmVaK0Z2RXhtbk8rZlhDdDRI
c25yRG9DQkREckp4CmdJQVBEaTVsdVpmSndzM1pxbmhJLzNoVTFNaHVpT0dickhRRkpoYURt
aiswTk9YbzNXbkR2dz09Cj1PUHM3Ci0tLS0tRU5EIFBHUCBTSUdOQVRVUkUtLS0tLQo=
--------------090905030802060406060007--


From nobody Fri May 16 11:36:31 2014
Return-Path: <farinacci@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 512EC1A0354 for <lisp@ietfa.amsl.com>; Fri, 16 May 2014 11:36:30 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level: 
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9,  DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TN4AqfI0IoBt for <lisp@ietfa.amsl.com>; Fri, 16 May 2014 11:36:28 -0700 (PDT)
Received: from mail-yh0-x22b.google.com (mail-yh0-x22b.google.com [IPv6:2607:f8b0:4002:c01::22b]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DDD5C1A0347 for <lisp@ietf.org>; Fri, 16 May 2014 11:36:27 -0700 (PDT)
Received: by mail-yh0-f43.google.com with SMTP id v1so4709340yhn.30 for <lisp@ietf.org>; Fri, 16 May 2014 11:36:20 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=vR3w6cQdPAvFTnqPae7U9pvnbhtbgTVVt549Rz0NruI=; b=QvS6kLEidXMVVpsymKxzVV3hbMAwYMUHmPAbwSBgrw8P9gsn1bcAGQmnWjEg4FUK8J egWzF6+U8bGtZX1/g4JdcZLLS/QzgNfMU0r2xvxOs4q2k18UYhBJEKPHtmi32jhwFntW u91qVIYOLZnhaHiiOYSxEle+1VTJa1tRMa8HGE70kxUsewJa0KElTgSUUxrYLXRBtn71 wXjH2VS0e+VRAPkt2YUmtvPWfCBuNlx9WUsTUY+8FlofGDHt5OzTddxoWZfzjr1ZKmcR i5gWXCqmGW7zqygIqJPyXcK9twceCZG2AZL8Kb1qI3IUq9QAiBlDMqIIBHPQHsSEaB3H B6uw==
X-Received: by 10.236.93.16 with SMTP id k16mr6469485yhf.140.1400265379942; Fri, 16 May 2014 11:36:19 -0700 (PDT)
Received: from [192.168.0.150] ([72.252.14.172]) by mx.google.com with ESMTPSA id u5sm13009325yhg.25.2014.05.16.11.36.17 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 16 May 2014 11:36:17 -0700 (PDT)
Content-Type: text/plain; charset=iso-8859-1
Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\))
From: Dino Farinacci <farinacci@gmail.com>
In-Reply-To: <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com>
Date: Fri, 16 May 2014 11:36:18 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com>
To: Ronald Bonica <rbonica@juniper.net>
X-Mailer: Apple Mail (2.1874)
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/r75sG-YEEYsX11PItZVbGN0tUDI
Cc: Roger Jorgensen <rogerj@gmail.com>, "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 16 May 2014 18:36:30 -0000

> Roger,
>=20
> Having considered this, it appears that the LISP data plane can =
operate in trusted or untrusted mode. In the trusted mode, when one XTR =
receives a data-plane packet from another, it can trust control plane =
information that it might glean from the packet's outer IP header and =
LISP header. Such trust is based on the assumption that:
>=20
> - the sending XTR is who it claims to be
> - the sending XTR is not intentionally offering bad mapping =
information to the receiving XTR

Determining "who" is rather nebulous. How can I trust this email is from =
you Ron? It's because I have ultra meta-data about you. That is, I know =
you can be versed in LISP so I am likely talking to another LISP spoofer =
that looks like Ron.

So if I am getting packets from an xTR that has a global locator that is =
your DSL router at your house, I would expect to see the inner source =
EID be from the mapping. I can tell that the EID->RLOC mapping is =
authenticated and validated by asking the mapping system, but if Roger =
managed to get packets to me with BOTH your EID and RLOC, then I really =
don't know if those packets are coming from Ron.=20

Now how Roger does this will be an amazing feat because a lot of ISPs =
between Roger and me would be very broken.

> In trusted mode, the receiving XTR can glean control information from =
the data plane. However, in untrusted mode, the receiving XTR must not =
do so. Alternatively, it must send a verifying MAP-REQUEST to the =
mapping system.

If you encrypt data to me, I cannot tell you are actually Roger or Ron. =
But the conversation between me and Roger (who is spoofing Ron) will be =
confidential.  ;-)

We either have total privacy or we have NSA intrusion.  ;-)  You can't =
have both so we should have the former.

> So far, all of this is covered nicely between RFC 6830 and the LISP =
threats document. However, we have yet to explore the threats associated =
with unsecured mode operation, where gleaned information cannot be used.

This is true. When a system receives an ARP-request it gleans the source =
information in there to minimize broadcast traffic for returned unicast =
traffic. That is a benefit willing to receive at a cost of knowing a LAN =
is secure and scoped (if that is really true, it is another story). So =
there is a value/risk tradeoff here.

> For example, assume that two XTRs and an attacker are connected to the =
global Internet. The attacker is neither an XTR nor contained by a LISP =
site. The attacker is capable of spoofing its sources address.

But will the entire path to any destination let him?

> The attacker can launch a DoS attack against an XTRs control plan by =
sending a barrage of crafted packets to the victim XTR. Each crafted =
packet cause the victim XTR to send a verifying MAP-REQUEST to the =
mapping system.  The attack stream may be so large that it causes the =
victim XTR to exceed the rate limit for MAP-REQUEST messages.=20

You can trust sources less if they ARE NOT in the mapping database. That =
is, if you are a LISP site, you have more tools be verify trust.

Dino

>=20
>                                                                        =
                                   Ron
>=20
>=20
>> -----Original Message-----
>> From: Roger J=F8rgensen [mailto:rogerj@gmail.com]
>> Sent: Wednesday, May 14, 2014 3:59 AM
>> To: Ronald Bonica
>> Cc: Ross Callon; lisp@ietf.org
>> Subject: Re: [lisp] Restarting last call on LISP threats
>>=20
>> On Tue, May 13, 2014 at 7:31 PM, Ronald Bonica <rbonica@juniper.net>
>> wrote:
>>> Hi Roger,
>>>=20
>>> Or asked more explicitly, can the level of security claimed by the =
threats
>> document be achieved without implementing the protocol extensions
>> described in lisp-sec and lisp-crypto?
>>=20
>> I've been pondering on what to answer you since yesterday but think =
the
>> reply from Joel cover it well. However as an addon to Joel and partly =
reply to
>> your question, see more inline.
>>=20
>>=20
>> On Tue, May 13, 2014 at 11:56 PM, Joel M. Halpern =
<jmh@joelhalpern.com>
>> wrote:
>>> Ron, I am having trouble with the question.
>>>=20
>>> The threats document describes the threats as they exist today,
>>> without the adoption of either document that Roger pointed to.  =
Thus,
>>> I do not see any dependence.
>>>=20
>>> If there is a threat that is not well described in the base spec or
>>> this document, then we should add it.  We should add it even if =
there
>>> are proposals to remediate it.  But if there is a clear proposal of =
a
>>> missing threat, I missed it.
>>=20
>> Your question made me question the purpose of the LISP threats draft =
-
>> should it cover potential problem with RFC6830 and include pointers =
to other
>> work that cover them? That will include we'll get a document that =
will be
>> updated over time and is that a good thing?
>>=20
>> The other way to look at LISP threats document is to have it as a =
"review" of
>> RFC6830, point out weaknesses and discuss them but with no references =
to
>> other documents. It will be a upstream document that we can refer to =
from
>> like the two draft I mention.
>>=20
>> I don't think LISP threat should point to the two draft I mention, =
but both
>> drafts should have a reference to LISP threat since this will be =
create a more
>> stable threat document.
>>=20
>>=20
>>=20
>> Then Dino mention:
>>=20
>> On Tue, May 13, 2014 at 7:47 PM, Dino Farinacci <farinacci@gmail.com>
>> wrote:
>> <snip>
>>> The main LISP spec (RFC6830) indicates if you want to trust the =
mapping
>> system you can use the gleaned information as soon as you receive it. =
And if
>> you don't trust the mapping system, you can send a "verifying =
Map-Request"
>> to the mapping system which results in a signed Map-Reply returned =
ala
>> draft-ietf-lisp-sec-06.
>>=20
>>=20
>> Is this covered in the document? I didn't see it but it's still early =
here...
>>=20
>>=20
>>=20
>> --
>>=20
>> Roger Jorgensen           | ROJO9-RIPE
>> rogerj@gmail.com          | - IPv6 is The Key!
>> http://www.jorgensen.no   | roger@jorgensen.no
> _______________________________________________
> lisp mailing list
> lisp@ietf.org
> https://www.ietf.org/mailman/listinfo/lisp


From nobody Fri May 16 12:15:28 2014
Return-Path: <sander@steffann.nl>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF3F11A0338 for <lisp@ietfa.amsl.com>; Fri, 16 May 2014 12:15:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.194
X-Spam-Level: 
X-Spam-Status: No, score=0.194 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_NL=0.55, HOST_EQ_NL=1.545, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z3rXW7AwqV43 for <lisp@ietfa.amsl.com>; Fri, 16 May 2014 12:15:24 -0700 (PDT)
Received: from mail.sintact.nl (mail.sintact.nl [IPv6:2001:9e0:803::6]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D4621A0103 for <lisp@ietf.org>; Fri, 16 May 2014 12:15:24 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mail.sintact.nl (Postfix) with ESMTP id A3EED3F; Fri, 16 May 2014 21:15:15 +0200 (CEST)
X-Virus-Scanned: Debian amavisd-new at mail.sintact.nl
Received: from mail.sintact.nl ([127.0.0.1]) by localhost (mail.sintact.nl [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fJiG8364PimH; Fri, 16 May 2014 21:15:07 +0200 (CEST)
Received: from [172.20.10.3] (unknown [172.20.10.3]) by mail.sintact.nl (Postfix) with ESMTPSA id C58C23B; Fri, 16 May 2014 21:13:04 +0200 (CEST)
Content-Type: text/plain; charset=iso-8859-1
Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\))
From: Sander Steffann <sander@steffann.nl>
In-Reply-To: <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com>
Date: Fri, 16 May 2014 21:11:00 +0200
Content-Transfer-Encoding: quoted-printable
Message-Id: <8891A030-B462-48D9-83B4-4E42525F38CE@steffann.nl>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com>
To: Dino Farinacci <farinacci@gmail.com>
X-Mailer: Apple Mail (2.1874)
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/WpZToavdNMxaetJbmQNLUqKlaA4
Cc: Roger Jorgensen <rogerj@gmail.com>, "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 16 May 2014 19:15:26 -0000

Hi Dino,

> If Roger managed to get packets to me with BOTH your EID and RLOC, =
then I really don't know if those packets are coming from Ron.=20
>=20
> Now how Roger does this will be an amazing feat because a lot of ISPs =
between Roger and me would be very broken.

Unfortunately this is not unlikely :(  I certainly wouldn't consider it =
an amazing feat... BCP38 is not implemented as much as it should be.

Cheers,
Sander


From nobody Fri May 16 16:37:39 2014
Return-Path: <farinacci@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BFC651A01AB for <lisp@ietfa.amsl.com>; Fri, 16 May 2014 16:37:36 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level: 
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9,  DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N7oBmXm9kZxV for <lisp@ietfa.amsl.com>; Fri, 16 May 2014 16:37:35 -0700 (PDT)
Received: from mail-yh0-x231.google.com (mail-yh0-x231.google.com [IPv6:2607:f8b0:4002:c01::231]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8E32A1A0195 for <lisp@ietf.org>; Fri, 16 May 2014 16:37:35 -0700 (PDT)
Received: by mail-yh0-f49.google.com with SMTP id c41so5003080yho.36 for <lisp@ietf.org>; Fri, 16 May 2014 16:37:27 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=zyOaaRlGFqyBprtI66lC5OlZaFyEnqfZZClN3cY5qbE=; b=fmcIf/mAj0EhOOALq0aTRNAaLN5rD+RXr0zt2aFf5KVlRgbkStlZQefhjbtRXA68lQ Y5i/p7DooSRh4aFFWKNz80h/pa+IdykIkg7NwIkQBApzzLdcL3fg4eOpFE6K+OgYAsZl Rs2MUMgKHX85ZNrCezf9u+fqKx226jPc8ZdP/oJcMuTx1Rxo4YY7Q584LvOy4NVySNZI UWb2/1HZRnEjeOqMzSuqBAEJua+CNglo2g3nj2gN7mSjG8hIpqp3HQRl4hcDZx3h20E7 e6Ox8G0DHTa05UlEEZ6uA28/Bt19JzCBXqXxQsAsbfZb4Pkiae2hi5DUbMIyIL5g0J5c +OCQ==
X-Received: by 10.236.32.178 with SMTP id o38mr29934489yha.119.1400283447743;  Fri, 16 May 2014 16:37:27 -0700 (PDT)
Received: from [192.168.2.122] ([72.252.14.172]) by mx.google.com with ESMTPSA id z2sm14077434yhm.30.2014.05.16.16.37.20 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 16 May 2014 16:37:26 -0700 (PDT)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (1.0)
From: Dino Farinacci <farinacci@gmail.com>
X-Mailer: iPhone Mail (11D167)
In-Reply-To: <8891A030-B462-48D9-83B4-4E42525F38CE@steffann.nl>
Date: Fri, 16 May 2014 19:37:14 -0400
Content-Transfer-Encoding: quoted-printable
Message-Id: <F1FD0546-65C0-4288-B017-FDA55454A528@gmail.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <8891A030-B462-48D9-83B4-4E42525F38CE@steffann.nl>
To: Sander Steffann <sander@steffann.nl>
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/RqpzJldpHa25yE85yRvLlfqg2WE
Cc: Roger Jorgensen <rogerj@gmail.com>, "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 16 May 2014 23:37:36 -0000

> Unfortunately this is not unlikely :(  I certainly wouldn't consider it an=
 amazing feat... BCP38 is not implemented as much as it should be.

I know there are many cases where BCP38 is not practice but more and more ac=
cess providers due uRPF.=20

You only need one in the path. And the ones that don't do it are using resou=
rces to transit packets to possible black holes.=20

Dino=


From nobody Sat May 17 13:37:03 2014
Return-Path: <rogerj@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D0551A0216 for <lisp@ietfa.amsl.com>; Sat, 17 May 2014 13:37:00 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.7
X-Spam-Level: 
X-Spam-Status: No, score=-1.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, MIME_8BIT_HEADER=0.3, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qLlnyvaeWKpy for <lisp@ietfa.amsl.com>; Sat, 17 May 2014 13:36:56 -0700 (PDT)
Received: from mail-we0-x22b.google.com (mail-we0-x22b.google.com [IPv6:2a00:1450:400c:c03::22b]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 011781A0208 for <lisp@ietf.org>; Sat, 17 May 2014 13:36:55 -0700 (PDT)
Received: by mail-we0-f171.google.com with SMTP id w62so3914328wes.2 for <lisp@ietf.org>; Sat, 17 May 2014 13:36:54 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=p/mXum9l81uwUC6KSDydwqOwb/L3CKSEF8lDZY0jlaI=; b=wFzJkt4x7pO8JTszYFrgOrcJh94fghe08tWlediCMBg9FEqNpB4gEoYbkpfeWMmsTH whdW0EX5lhgHJG8lZuQRmF8aY51vOvqYOLzLnjGDAgwH7kECvx24DVQESt2MMb54qdKt mJ2QYAv0Gqtb7fme0UlBvRXeXuUvpmQdHgsJTjmI1UAguKHJJY/hnfNlycKX5+Efd7FS WX887yGvj3PYu3OeCvyNVlbHKL/t8MZiZqJY4/WBXcB/P7/fEq6bDbBL/NLiB5eEk+Gt qY4pIOFBfd5XWvWE3CIcnnr+iKqS9HTUSFxoM5MyNl/Mq0GBkoPJmT54Ur5+FAqP8rPs M23Q==
MIME-Version: 1.0
X-Received: by 10.194.206.2 with SMTP id lk2mr20685391wjc.33.1400359014394; Sat, 17 May 2014 13:36:54 -0700 (PDT)
Received: by 10.216.210.6 with HTTP; Sat, 17 May 2014 13:36:54 -0700 (PDT)
In-Reply-To: <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com>
Date: Sat, 17 May 2014 22:36:54 +0200
Message-ID: <CAKFn1SEjco4rS9NaAFDGuozw_MvA=h46FU0d_VL9Gezf+7_b9w@mail.gmail.com>
From: =?UTF-8?Q?Roger_J=C3=B8rgensen?= <rogerj@gmail.com>
To: Ronald Bonica <rbonica@juniper.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/VZNASPgKj674_A8JjAnpfCxEMjM
Cc: "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 17 May 2014 20:37:00 -0000

On Thu, May 15, 2014 at 11:02 PM, Ronald Bonica <rbonica@juniper.net> wrote=
:
> Roger,
>
> Having considered this, it appears that the LISP data plane can operate i=
n trusted or untrusted mode. In the trusted mode, when one XTR receives a d=
ata-plane packet from another, it can trust control plane information that =
it might glean from the packet's outer IP header and LISP header. Such trus=
t is based on the assumption that:
>
> - the sending XTR is who it claims to be
> - the sending XTR is not intentionally offering bad mapping information t=
o the receiving XTR
>
> In trusted mode, the receiving XTR can glean control information from the=
 data plane. However, in untrusted mode, the receiving XTR must not do so. =
Alternatively, it must send a verifying MAP-REQUEST to the mapping system.
>
> So far, all of this is covered nicely between RFC 6830 and the LISP threa=
ts document. However, we have yet to explore the threats associated with un=
secured mode operation, where gleaned information cannot be used.
>
> For example, assume that two XTRs and an attacker are connected to the gl=
obal Internet. The attacker is neither an XTR nor contained by a LISP site.=
 The attacker is capable of spoofing its sources address.
>
> The attacker can launch a DoS attack against an XTRs control plan by send=
ing a barrage of crafted packets to the victim XTR. Each crafted packet cau=
se the victim XTR to send a verifying MAP-REQUEST to the mapping system.  T=
he attack stream may be so large that it causes the victim XTR to exceed th=
e rate limit for MAP-REQUEST messages.

Lots of other people that know LISP way better than I do have responded alr=
eady.

Do I understand you correct that you think there is a hole in the
threat draft, or are you talking about another miss, that is what will
happen if the mapping-system fail to reply in time when encryption or
other form for verification of both ends (iTR and eTR) are used?





--=20

Roger Jorgensen           | ROJO9-RIPE
rogerj@gmail.com          | - IPv6 is The Key!
http://www.jorgensen.no   | roger@jorgensen.no


From nobody Mon May 19 07:14:20 2014
Return-Path: <rbonica@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C52FA1A0387 for <lisp@ietfa.amsl.com>; Mon, 19 May 2014 07:14:18 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.601
X-Spam-Level: 
X-Spam-Status: No, score=-102.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V4WDKcuFc-sl for <lisp@ietfa.amsl.com>; Mon, 19 May 2014 07:14:14 -0700 (PDT)
Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2lp0211.outbound.protection.outlook.com [207.46.163.211]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B638D1A0015 for <lisp@ietf.org>; Mon, 19 May 2014 07:14:13 -0700 (PDT)
Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB441.namprd05.prod.outlook.com (10.141.73.147) with Microsoft SMTP Server (TLS) id 15.0.944.11; Mon, 19 May 2014 14:14:05 +0000
Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) with mapi id 15.00.0944.000; Mon, 19 May 2014 14:14:05 +0000
From: Ronald Bonica <rbonica@juniper.net>
To: Dino Farinacci <farinacci@gmail.com>, Sander Steffann <sander@steffann.nl>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEIABfmkAgAAJsgCAAEpiAIAEFPjg
Date: Mon, 19 May 2014 14:14:05 +0000
Message-ID: <df8bf1975fe04834bb7887ae38675983@CO1PR05MB442.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <8891A030-B462-48D9-83B4-4E42525F38CE@steffann.nl> <F1FD0546-65C0-4288-B017-FDA55454A528@gmail.com>
In-Reply-To: <F1FD0546-65C0-4288-B017-FDA55454A528@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.12]
x-forefront-prvs: 021670B4D2
x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(51704005)(13464003)(377454003)(189002)(199002)(46102001)(101416001)(21056001)(31966008)(79102001)(80022001)(66066001)(81342001)(4396001)(74502001)(74662001)(77982001)(76482001)(50986999)(76176999)(2656002)(15202345003)(99396002)(19580395003)(74316001)(54356999)(19580405001)(99286001)(83322001)(86362001)(85852003)(81542001)(83072002)(15975445006)(16799955002)(20776003)(64706001)(76576001)(87936001)(33646001)(92566001)(15188155005)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO1PR05MB441; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; 
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/MCDDiQwnYCqlROm6oecOxyDoXE8
Cc: Roger Jorgensen <rogerj@gmail.com>, "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 19 May 2014 14:14:18 -0000

Dino,

The Spoofer Project (http://spoofer.cmand.org/summary.php) offers a longitu=
dinal view of BCP 38 deployment. I think that the results that they report =
validate Sander's objection. Furthermore, they may suggest that Sander's ob=
jection will remain valid for years to come.

                                                                           =
                                                        Ron


> -----Original Message-----
> From: Dino Farinacci [mailto:farinacci@gmail.com]
> Sent: Friday, May 16, 2014 7:37 PM
> To: Sander Steffann
> Cc: Ronald Bonica; Roger Jorgensen; lisp@ietf.org
> Subject: Re: [lisp] Restarting last call on LISP threats
>=20
> > Unfortunately this is not unlikely :(  I certainly wouldn't consider it=
 an
> amazing feat... BCP38 is not implemented as much as it should be.
>=20
> I know there are many cases where BCP38 is not practice but more and more
> access providers due uRPF.
>=20
> You only need one in the path. And the ones that don't do it are using
> resources to transit packets to possible black holes.
>=20
> Dino


From nobody Mon May 19 10:57:27 2014
Return-Path: <farinacci@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B45B1A00EA for <lisp@ietfa.amsl.com>; Mon, 19 May 2014 10:57:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level: 
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9,  DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ds5saJfUX928 for <lisp@ietfa.amsl.com>; Mon, 19 May 2014 10:57:24 -0700 (PDT)
Received: from mail-pa0-x22f.google.com (mail-pa0-x22f.google.com [IPv6:2607:f8b0:400e:c03::22f]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A654D1A00B1 for <lisp@ietf.org>; Mon, 19 May 2014 10:57:24 -0700 (PDT)
Received: by mail-pa0-f47.google.com with SMTP id lf10so6086424pab.34 for <lisp@ietf.org>; Mon, 19 May 2014 10:57:24 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=+ohcwOzriXIC4mqWempz176njmiluzDMw3e2nBg6OUw=; b=YRF/mSBZMrDLkHvVwpbNSo4EOBsnPaxNpsTI6BvljCILUwpGYQh8A+HNK4e4lBSraa 1Pv7KMlszJoB2fWLbHDJVYfKwAmXSZB0FKtowwjpboAr5ipBOOTtcqEPT+JZqVqzjKoL EDP6LcJs0xBhzr8D3rFVp27Ss7Owrp5Ht/cqxg0lF1pRAY2OKH25hYtqadgjscQhO9ZS 5oy7NQckD1kAClv4RfYsdwB/IgK1eEZbBYkP5zKLiUHY3M+A64IgE/NZitfVKd3kl5uf eLmE8yVC5nfa103LTFuIXT3QGKnmwfdRQsF80yHUtrYH0ARO9I6zWpcLzFocZ5EFLBw4 YKCw==
X-Received: by 10.66.65.169 with SMTP id y9mr44387299pas.145.1400522244476; Mon, 19 May 2014 10:57:24 -0700 (PDT)
Received: from [10.214.44.136] ([166.170.42.80]) by mx.google.com with ESMTPSA id gc3sm31179009pbd.93.2014.05.19.10.57.08 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 19 May 2014 10:57:23 -0700 (PDT)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (1.0)
From: Dino Farinacci <farinacci@gmail.com>
X-Mailer: iPhone Mail (11D167)
In-Reply-To: <df8bf1975fe04834bb7887ae38675983@CO1PR05MB442.namprd05.prod.outlook.com>
Date: Mon, 19 May 2014 13:56:59 -0400
Content-Transfer-Encoding: quoted-printable
Message-Id: <2D126379-BFF8-45FE-B6E1-B7E5E7FA5A6A@gmail.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <8891A030-B462-48D9-83B4-4E42525F38CE@steffann.nl> <F1FD0546-65C0-4288-B017-FDA55454A528@gmail.com> <df8bf1975fe04834bb7887ae38675983@CO1PR05MB442.namprd05.prod.outlook.com>
To: Ronald Bonica <rbonica@juniper.net>
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/74UyYUoLeAYQVmiCK4lNTz47vUk
Cc: Roger Jorgensen <rogerj@gmail.com>, "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 19 May 2014 17:57:26 -0000

In those cases we do mapping database RPF lookups.=20

Dino



> On May 19, 2014, at 10:14 AM, Ronald Bonica <rbonica@juniper.net> wrote:
>=20
> Dino,
>=20
> The Spoofer Project (http://spoofer.cmand.org/summary.php) offers a longit=
udinal view of BCP 38 deployment. I think that the results that they report v=
alidate Sander's objection. Furthermore, they may suggest that Sander's obje=
ction will remain valid for years to come.
>=20
>                                                                           =
                                                        Ron
>=20
>=20
>> -----Original Message-----
>> From: Dino Farinacci [mailto:farinacci@gmail.com]
>> Sent: Friday, May 16, 2014 7:37 PM
>> To: Sander Steffann
>> Cc: Ronald Bonica; Roger Jorgensen; lisp@ietf.org
>> Subject: Re: [lisp] Restarting last call on LISP threats
>>=20
>>> Unfortunately this is not unlikely :(  I certainly wouldn't consider it a=
n
>> amazing feat... BCP38 is not implemented as much as it should be.
>>=20
>> I know there are many cases where BCP38 is not practice but more and more=

>> access providers due uRPF.
>>=20
>> You only need one in the path. And the ones that don't do it are using
>> resources to transit packets to possible black holes.
>>=20
>> Dino


From nobody Mon May 19 15:25:51 2014
Return-Path: <damien.saucez@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 387931A0412 for <lisp@ietfa.amsl.com>; Mon, 19 May 2014 15:25:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.7
X-Spam-Level: 
X-Spam-Status: No, score=0.7 tagged_above=-999 required=5 tests=[BAYES_50=0.8,  DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GxX_faafBma2 for <lisp@ietfa.amsl.com>; Mon, 19 May 2014 15:25:45 -0700 (PDT)
Received: from mail-wg0-x22b.google.com (mail-wg0-x22b.google.com [IPv6:2a00:1450:400c:c00::22b]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 21F041A0195 for <lisp@ietf.org>; Mon, 19 May 2014 15:25:44 -0700 (PDT)
Received: by mail-wg0-f43.google.com with SMTP id l18so8593125wgh.14 for <lisp@ietf.org>; Mon, 19 May 2014 15:25:43 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=/IUsBEprB5Q+vPTkevOMzuiai+ioUurzreuJe3C5pbM=; b=yHO2LoA+IJnof0ERAs2Dj+x9+NrF9E9E1M+86oeQMs+GyQ0KNjqHqr2OQcYFWk6F83 mcx8wj+MWaoGBwdPReq9s5/JP/NuLes0GYXNVWmPZXqG4X8T/t9gwqnXhXoQkYBGQIhn 0LAFRLxIbyxiHk6PFmVp15eBz1ggTAlckm8YVn3zMgxuG82eEcrXkVapZNZmzw4oDROu VYQ7UNPch41pWoU1mgf4wk0X09ThR6CzVjMx6hGCHpwO8nCV2F55NUwSFUxHuPfchVSp SvPvmsvBl4Vh8zR2tC/o9SkLIhZzZ5Dwc5lBrrJlqLxA4Qp3ax4C9YAtWTpbfy0LpRL3 vg+g==
X-Received: by 10.180.13.139 with SMTP id h11mr1057706wic.34.1400538343652; Mon, 19 May 2014 15:25:43 -0700 (PDT)
Received: from [10.207.103.153] (LLagny-156-35-13-133.w80-14.abo.wanadoo.fr. [80.14.125.133]) by mx.google.com with ESMTPSA id j3sm15775428wjw.38.2014.05.19.15.25.40 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 19 May 2014 15:25:42 -0700 (PDT)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.2\))
From: Damien Saucez <damien.saucez@gmail.com>
In-Reply-To: <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com>
Date: Tue, 20 May 2014 00:25:40 +0200
Content-Transfer-Encoding: quoted-printable
Message-Id: <B3FF60AE-ED9D-45E6-BBB5-AE3F6C6172F8@gmail.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com>
To: Ross Callon <rcallon@juniper.net>
X-Mailer: Apple Mail (2.1878.2)
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/Z9KK93Dqr1BmJsmL9ZyJ6xyHJ44
Cc: LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 19 May 2014 22:25:49 -0000

Dear Ross,

Thank you for your time.

Before detailed comments below, we have to remind that the objective
of this document is to identify global threats potentially introduced
by LISP w.r.t.  what exists today in the legacy Internet.  The problem
space is out of the scope of the document.

comments inline.

On 12 May 2014, at 19:11, Ross Callon <rcallon@juniper.net> wrote:

> Thanks Joel;
>=20
> I think that draft-ietf-lisp-threats-09.txt is a start towards a =
threats document, but that it has serious omissions and needs more work =
before being progressed. Here are some specific comments:=20
>=20
>=20
> Section 2 (On-path Attackers), first paragraph:=20
>=20
>   On-path attackers are attackers that are able to capture and modify
>   all the packets exchanged between an Ingress Tunnel Router (ITR) and
>   an Egress Tunnel Router (ETR).  To cope with such an attacker,
>   cryptographic techniques such as those used by IPSec ([RFC4301]) are
>   required.  As with IP, LISP relies on higher layer cryptography to
>   secure packet payloads from on path attacks, so this document does
>   not consider on-path attackers.
>=20
> To me an on-path attacker is one which is on the data path. Such an =
attacker might attack the contents of the data packet. In this case the =
paragraph seems mostly correct to me: You encrypt the contents if you =
don't want someone on the path to the destination to look at the =
contents. However, as is discussed later in the document, LISP allows =
systems which are not in the normal physical path, through a gleaning =
attack, to inject themselves into the data path. This could be applied =
to allow attacker's systems to inject themselves into the path of the =
key management protocol. This implies that a legitimate user could get =
keys supplied by an attacker, just as easily as it could get keys =
supplied by a legitimate Internet site. If you are proposing that end to =
end encryption is the solution to on path attackers then you need to =
understand the implications of LISP on the operation of the protocol =
needed for key management to support end to end encryption.=20

The paragraph you are citing end with this document does _not_
consider on-path attackers..  While you remarks are generally valuable
they do not apply here, the document is not proposing anything, it i
just stating what is _not_ considered.




>=20
> Also, you should mention in this section that a gleaning attack would =
allow at least in the short term for an attacker to become temporarily =
on-path even if they are not on what should be the normal path to the =
destination.=20
>=20
The definition we give about on-path attacker includes your
sub-category.  It does not matter where you attacker physically is.
If it is able to capture and modify packets then it is on-path (does
not matter if physical shorter or not).


> An on-path attacker might choose to only change something about the =
LISP handling details, such as exploding the map cache or redirecting a =
user to a different site. Some of this is mentioned later in the =
document. One thing that is not mentioned: Suppose that the encapsulated =
packet is encrypted. The on-path attacker could however see the LISP =
header, and thus could change the nonce, or add a nonce, or reply to the =
nonce, change versioning information,...  Are you proposing that the =
LISP header be encrypted also? If so, where is this specified and what =
does it do to forwarding performance in the xTR?=20
>=20

The document is just an analysis, hence your question, while valid, is
outside the scope of this document.
>=20
> Section 4.3.1, second paragraph, third sentence:=20
>=20
>   This is not different from today's
>   Internet where a spoofing off-path attacker may inject data packets
>   in any flow.
>=20
> In terms of injecting traffic that the end system receives and acts =
upon, I believe that this sentence is entirely true. However, in terms =
of the effect on the router's control plane, and particularly the =
operation of xTR's, this sentence is not true. Today there is very =
little that a spoofing attacker that is outside of a particular service =
provider can do to exercise the control plane of that provider's =
routers. This is important and intentional (see DOS discussion below).=20=

>=20
>=20
The section actually does not enter in any discussion about
quantifying the damages.  So the second part of your comment is
correct if it does apply to section 4.3.1.

The first half of your comment is, however, unfounded.  Section 4.3.1
is about attacks _not_ leveraging on LISP header, so from this side it
is exactly the same case like any other IP spoofed packet.  In
particular since LISP header is not used, xTR functions are not
actually attacked.

> Minor nit, next sentence:
>=20
>   A non-spoofing off-path attacker (NSA)...
>=20
> Given recent events, I think that "NSA" is an unfortunate acronym to =
use here. How about NSOA?=20
>=20
>=20

This can be fixed before pushing the document to the IESG.


> Section 4.3.1.1 (Gleaning Attacks), last paragraph:
>=20
>   By itself, an attack made solely using gleaning cannot last long,
>   however it should be noted that with current network capacities, a
>   large amount of packets might be exchanged during even a small
>   fraction of time.
>=20
> The amount of damage that might be caused by this may depend upon what =
happens to be exchanged in that "short amount of time". For example, the =
initial handshake between sites (at the application layer) could include =
sign in information (account names and passwords), on the basis that =
this is the sort of information that needs to be exchanged at the =
beginning of, for example, financial transactions. My understanding is =
that for Internet commerce, it is normal for users to be redirected to a =
different site to enter credit card information. This appears to =
constitute a "new session" (or at least may be to an entirely different =
location) and therefore the entire credit card exchange could occur in a =
small period of time. I think it would be worth mentioning here that the =
sensitivity of the information that could be exchanged during this =
"short amount of time" is not known, and could potentially be serious.=20=


Exchanging critical information (e.g.  password) in clear means that
you have a serious problem, but not at the network layer.  Also, the
situation with LISP would not be worse than without LISP.

>=20
> Also, depending upon how long xTR's are willing to store gleaned =
information (before the map request comes back), the time that a user is =
misdirected due to a gleaning attack might be extended by coordinating a =
DDOS attack with the gleaning attack. For example, an attacker may send =
packets to a very large number of sites, with a source EID which is from =
a major stock broker or bank and an RLOC from the attacker's captive =
servers. The many sites glean the EID to RLOC mapping from the arriving =
packets. Each pretty much simultaneously initiates an EID lookup (to =
verify the EID to RLOC mapping). This creates a DOS attack on the =
control plane of the mapping function supporting that stock broker or =
bank. This implies that the responses are going to be delayed (and could =
be greatly delayed), which allows the incorrect mappings to last longer =
than they otherwise would. This allows any systems that actually happen =
to be trying to connect to that stock or banking site to be redirected =
to the a
> ttacker's site. The attacker then becomes a man in the middle and can =
for example can obtain the password and account information for users. =20=

>=20
>=20

Such a scenario would require a lot of synchronisation.  Anyway, our
opinion is that the current text is stating exactly the same thing you
describe just in a succinct way.

As a reminder, the present document studies LISP in a public network
deployment.



> Last paragraph of section 4.3.2.2:=20
>=20
>   If the size of the Map-Request
>   message is larger than the size of the smallest LISP-encapsulated
>   packet that could trigger such a message, this could lead to
>   amplification attacks (see Section 4.4.1) so that more bandwidth is
>   consumed on the target than the bandwidth necessary at the attacker
>   side.
>=20
> The size of the packet is not the only issue. If the amount of =
processing required to send a map-request and deal with the reply is =
greater than the amount of processing that is required to send a packet =
that triggers such a request, then this could also result in an =
amplification attack. In principle it would seem that sending out a =
large number of packets to trigger such a request would be relatively =
straightforward (for example the attacker might be sending out many =
packets only incrementing the EID in order to attack the ITR that will =
need to generate many map requests). We may note that for many systems, =
particularly very high speed routers (which might exist for example as =
PE routers connecting very large enterprise customers), the control =
plane may be several orders of magnitude slower than the data plane, so =
that an attack that requires response from the router's control plane =
would be much more serious than an attack of the same size that can be =
handled in the data plane. I=20
> will say more about this in my comments below regarding DOS attacks.=20=

>=20
>=20

Your first point can be easily fixed by substituting the word
bandwidth with bandwidth and/or processing or "resource"

Your statement on the speed difference between control and data plane
is true and is a general observation not limited to LISP.  Note that
one of the advantages of having the Map-Server/Map-Resolver elements
in the LISPa architecture is exactly to avoid situations you are
describing.

> Section 4.3.2.3, third paragraph (right after the bullets):=20
>=20
>   The first type of packet should not cause any major problem to ITRs.
>   As the reachability test uses a 24 bits nonce, it is unlikely that =
an
>   off-path attacker could send a single packet that causes an ITR to
>   believe that the ETR it is testing is reachable while in reality it
>   is not reachable.  To increase the success likelihood of such =
attack,
>   the attacker should create a massive amount of packets carrying all
>   possible nonce values.
>=20
> However, this could be a problem if there are on-path attackers, since =
they will see the nonce. They could insert nonce's where none are =
present, requiring a response from the ETR. Given that the control plane =
of very high speed PE routers may be much slower than the data plane, =
this could cause a relatively moderate data stream that the data plane =
or the PE could easily handle to turn into a control plane attack that =
the control plane of a PE router could not handle. Also, the on-path =
attacker could see the nonce's and respond "correctly" (or in a way that =
the ITR that sent the nonce *thinks* is correct), thereby "verifying" =
connectivity when none is present. You dismissed on-path attacks earlier =
in the document on the basis that the user data could be encrypted, but =
these are examples of on-path attacks that would be on the LISP header =
and operation, and not on the user data.=20

It is clearly stated at the beginning of the document that on-path
attacks are out of the scope of the document.  Also, Sec.  2 does not
limit cryptography technique to the payload, actually section 2 makes
the distinction saying:

1)
 "To cope with such an attacker, cryptographic techniques such as
 those used by IPSec ([RFC4301 ]) are required."

which is reported to any form of packet manipulation

and 2)
"As with IP, LISP relies on higher layer cryptography to secure packet
payloads from on path attacks, so this document does not consider
on-path attackers."

which is related to attacks targeting the payload.


>=20
>=20
> Section 5.2 (Denial of Service):
>=20
> You need to mention here the relative difference in speed between the =
data plane and the control plane of high speed routers. For example, =
there are plenty of examples currently widely deployed of routers which =
can handle a few terabits of data in the data plane. These routers might =
typically have gigabit Ethernet links to the control processor, but I =
doubt that any of them could handle Map-Requests coming in at line rate =
at a gigabit. Thus the ratio between the speed of the control plane the =
speed of the data plane is significantly greater than 1000. I understand =
that many PE routers have slower data planes (and the CE "wireless =
router" that sits in each of our homes is of course a lot slower than =
this), but large data centers or large enterprise sites could very well =
be connected to their service provider via a few very high speed PE =
routers. Therefore an attack that would be trivial to handle in the data =
plane (say, a few gigabits) could overwhelm the control plane.=20
>=20

You are absolutely right, but why this is specific to LISP?  It is not
specific to LISP, so there is no reason to discuss such an issue in
this document.

> Gleaning allows incoming packets to create map requests, which allows =
a data plane attack to turn into a control plane attack. Given the =
difference in speeds between the data plane and the control plane, this =
makes it much easier to create an effective DOS attack.=20
>=20

RFC6830 already considered rate limiting fo this very reason.

>=20
> Section 8 (Security Considerations).=20
>=20
> I am pleased that you removed the sentence from section 1 of the =
previous (-08) draft that read: "As a result of  the performed analysis, =
the document discusses the severity of the threats and proposes =
recommendations to reach the same level of security in LISP than in =
Internet today (e.g., without LISP)". This sentence was not actually =
correct. However, in looking through the document and in thinking about =
the implications (see the rest of this email) it is quite clear that the =
security of an Internet using LISP would be significantly less than the =
current Internet (at least if you assume that there is *any* security at =
all in the current Internet). I am thinking that there should be a =
sentence at the end of section 8 to the effect that "At the current time =
it appears that LISP would have significant security implications if =
deployed on an Internet-wide scale".
>=20
>=20


Such sentence would not represent the discussions that took place in
the LISP WG in the last four years.

The arguments that you raised in the previous part of this mail are
mainly not LISP-specific, while the experience gathered in the last
years show that LISP is not worst that what we have today (and
actually research work out there shows that it can even be helpful to
use LISP)


> Finally, two items left out:
>=20
> I don't see any discussion on the effect of LISP on firewalls. I am =
assuming that pretty much all currently deployed firewalls are not able =
to look past a LISP header to inspect the contents of packets. At a =
minimum, this would seem to imply that LISP will need to be deployed =
toward the Internet core from the current firewalls, so that the =
firewalls can be looking at normal (unchanged) IP packets.
>=20
>=20

Deployment model is out of the scope of this document and the problem
is not specific to LISP.


> There is another issue which might belong in the section on privacy: =
In the Internet today if you want to attack a network with prefix =
aa.bb/16, and you see this advertisement in the BGP routes, you can pick =
a random address and send a packet and see if anything happens. You get =
little feedback. With LISP you can send a map request to a random =
address in the block and get back a map reply. This gives you an RLOC =
which is in general the actual IP address of a real PE or CE router. Of =
course you can repeat this across the entire /16, or even the Internet =
(given sufficient time and traffic), and get something close to a =
complete list of LISP xTRs. This implies that if service providers =
implement LISP on PE routers, then they will be exposing the identity of =
their PE routers to worldwide inspection. Given the number of PE routers =
in the world (obviously much larger than the number of service =
providers, and given PA address aggregation probably larger than the =
number of routes that show u
> p in the BGP routing table) we should expect that there are lots of PE =
routers that have not been carefully secured, and exposing their =
existence to open worldwide easy discovery would likely open the door to =
a number of attacks that involve compromise of PE routers. Of course if =
LISP is deployed on CE routers then their RLOC would similarly be =
exposed.=20
>=20

If routers are not correctly secured, there is no problem linked to
LISP as today it is already possible to discover the IP address of
theses routers thanks to various techniques.  Moreover, section 6
already clearly states that privacy is not discussed in the document
but that the attacks presented in the document can potentially play a
role in privacy threats.

Regards,

The authors of the threats document.


> Thanks, Ross
>=20
> -----Original Message-----
> From: lisp [mailto:lisp-bounces@ietf.org] On Behalf Of Joel M. Halpern
> Sent: Friday, May 09, 2014 11:54 AM
> To: lisp@ietf.org
> Subject: [lisp] Restarting last call on LISP threats
>=20
> Sorry for the delay getting this out.
> This email starts a new (and hopefully final) last call on=20
> draft-ietf-lisp-threats, version 9:
> http://datatracker.ietf.org/doc/draft-ietf-lisp-threats/
>=20
> The last call will end in two weeks, close of business 23-May-2014.
>=20
> Thank you,
> Joel
>=20
> _______________________________________________
> lisp mailing list
> lisp@ietf.org
> https://www.ietf.org/mailman/listinfo/lisp
>=20
> _______________________________________________
> lisp mailing list
> lisp@ietf.org
> https://www.ietf.org/mailman/listinfo/lisp


From nobody Wed May 21 08:16:16 2014
Return-Path: <rcallon@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E40C1A06D7 for <lisp@ietfa.amsl.com>; Wed, 21 May 2014 08:16:13 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Level: 
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u748h4uFhT1X for <lisp@ietfa.amsl.com>; Wed, 21 May 2014 08:16:09 -0700 (PDT)
Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1blp0181.outbound.protection.outlook.com [207.46.163.181]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5EBC31A085B for <lisp@ietf.org>; Wed, 21 May 2014 08:16:09 -0700 (PDT)
Received: from CO2PR05MB636.namprd05.prod.outlook.com (10.141.199.24) by CO2PR05MB636.namprd05.prod.outlook.com (10.141.199.24) with Microsoft SMTP Server (TLS) id 15.0.944.11; Wed, 21 May 2014 15:16:06 +0000
Received: from CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) by CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) with mapi id 15.00.0944.000; Wed, 21 May 2014 15:16:06 +0000
From: Ross Callon <rcallon@juniper.net>
To: Damien Saucez <damien.saucez@gmail.com>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58M9eFhkxJvMEaw1MEc+Ryfdps9FMJAgAt2hwCAAqNu4A==
Date: Wed, 21 May 2014 15:16:05 +0000
Message-ID: <082ae04715e5432c9bf5b2d9fd00d568@CO2PR05MB636.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <B3FF60AE-ED9D-45E6-BBB5-AE3F6C6172F8@gmail.com>
In-Reply-To: <B3FF60AE-ED9D-45E6-BBB5-AE3F6C6172F8@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.15]
x-forefront-prvs: 0218A015FA
x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(189002)(199002)(13464003)(51744003)(24454002)(377454003)(51704005)(51444003)(164054003)(19580405001)(86362001)(4396001)(15202345003)(92566001)(19580395003)(80022001)(15975445006)(76482001)(77982001)(79102001)(64706001)(20776003)(85852003)(66066001)(33646001)(83072002)(87936001)(2656002)(77096999)(46102001)(54356999)(76576001)(74502001)(81542001)(31966008)(74316001)(99286001)(81342001)(21056001)(74662001)(99396002)(101416001)(50986999)(551544002)(76176999)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO2PR05MB636; H:CO2PR05MB636.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rcallon@juniper.net; 
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/n0_vSnns4Knp6DfWBXeYYnbZ5OA
Cc: LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 21 May 2014 15:16:13 -0000

I will respond to your email in detail (in a separate email), but I also=20
have one higher level meta-comment which is important which I think that=20
we should discuss first.=20

Specifically, we need to remember what LISP is proposed to do. LISP=20
has been proposed as a new routing and addressing architecture for the=20
Internet. If we believe this goal is realistic, and if we believe that=20
LISP could actually end up being deployed as the routing and addressing=20
architecture for the Internet, then the Internet could someday be entirely=
=20
dependent upon LISP actually working and actually being secure when=20
deployed at scale.=20

The Internet has been described as the control plane for the world. The=20
Internet is of enormous importance for the world's economy (and all of=20
our jobs, and millions of others). IT HAS TO WORK.

As such, any attack that might have the potential of disrupting the=20
operation of LISP, or that can be made worse by LISP, MUST be taken=20
seriously. If you declare some attacks as "outside of the scope of=20
LISP threats document" then either you are saying that the LISP WG is=20
not serious about widespread deployment of LISP, or you are putting the=20
world's economy at risk.=20

If there are any threats which is likely to be waged against the operation=
=20
of LISP, then it is not acceptable to declare these threats as out of scope=
,
unless we are also going to agree that LISP must not be deployed on a wide
scale. As such, as currently written the threats document is not ready for
publication.=20

Sincerely,=20
Ross

-----Original Message-----
From: Damien Saucez [mailto:damien.saucez@gmail.com]=20
Sent: Monday, May 19, 2014 6:26 PM
To: Ross Callon
Cc: Joel M. Halpern; LISP mailing list list; Luigi Iannone
Subject: Re: [lisp] Restarting last call on LISP threats

Dear Ross,

Thank you for your time.

Before detailed comments below, we have to remind that the objective
of this document is to identify global threats potentially introduced
by LISP w.r.t.  what exists today in the legacy Internet.  The problem
space is out of the scope of the document.

comments inline.

On 12 May 2014, at 19:11, Ross Callon <rcallon@juniper.net> wrote:

> Thanks Joel;
>=20
> I think that draft-ietf-lisp-threats-09.txt is a start towards a threats =
document, but that it has serious omissions and needs more work before bein=
g progressed. Here are some specific comments:=20
>=20
>=20
> Section 2 (On-path Attackers), first paragraph:=20
>=20
>   On-path attackers are attackers that are able to capture and modify
>   all the packets exchanged between an Ingress Tunnel Router (ITR) and
>   an Egress Tunnel Router (ETR).  To cope with such an attacker,
>   cryptographic techniques such as those used by IPSec ([RFC4301]) are
>   required.  As with IP, LISP relies on higher layer cryptography to
>   secure packet payloads from on path attacks, so this document does
>   not consider on-path attackers.
>=20
> To me an on-path attacker is one which is on the data path. Such an attac=
ker might attack the contents of the data packet. In this case the paragrap=
h seems mostly correct to me: You encrypt the contents if you don't want so=
meone on the path to the destination to look at the contents. However, as i=
s discussed later in the document, LISP allows systems which are not in the=
 normal physical path, through a gleaning attack, to inject themselves into=
 the data path. This could be applied to allow attacker's systems to inject=
 themselves into the path of the key management protocol. This implies that=
 a legitimate user could get keys supplied by an attacker, just as easily a=
s it could get keys supplied by a legitimate Internet site. If you are prop=
osing that end to end encryption is the solution to on path attackers then =
you need to understand the implications of LISP on the operation of the pro=
tocol needed for key management to support end to end encryption.=20

The paragraph you are citing end with this document does _not_
consider on-path attackers..  While you remarks are generally valuable
they do not apply here, the document is not proposing anything, it i
just stating what is _not_ considered.




>=20
> Also, you should mention in this section that a gleaning attack would all=
ow at least in the short term for an attacker to become temporarily on-path=
 even if they are not on what should be the normal path to the destination.=
=20
>=20
The definition we give about on-path attacker includes your
sub-category.  It does not matter where you attacker physically is.
If it is able to capture and modify packets then it is on-path (does
not matter if physical shorter or not).


> An on-path attacker might choose to only change something about the LISP =
handling details, such as exploding the map cache or redirecting a user to =
a different site. Some of this is mentioned later in the document. One thin=
g that is not mentioned: Suppose that the encapsulated packet is encrypted.=
 The on-path attacker could however see the LISP header, and thus could cha=
nge the nonce, or add a nonce, or reply to the nonce, change versioning inf=
ormation,...  Are you proposing that the LISP header be encrypted also? If =
so, where is this specified and what does it do to forwarding performance i=
n the xTR?=20
>=20

The document is just an analysis, hence your question, while valid, is
outside the scope of this document.
>=20
> Section 4.3.1, second paragraph, third sentence:=20
>=20
>   This is not different from today's
>   Internet where a spoofing off-path attacker may inject data packets
>   in any flow.
>=20
> In terms of injecting traffic that the end system receives and acts upon,=
 I believe that this sentence is entirely true. However, in terms of the ef=
fect on the router's control plane, and particularly the operation of xTR's=
, this sentence is not true. Today there is very little that a spoofing att=
acker that is outside of a particular service provider can do to exercise t=
he control plane of that provider's routers. This is important and intentio=
nal (see DOS discussion below).=20
>=20
>=20
The section actually does not enter in any discussion about
quantifying the damages.  So the second part of your comment is
correct if it does apply to section 4.3.1.

The first half of your comment is, however, unfounded.  Section 4.3.1
is about attacks _not_ leveraging on LISP header, so from this side it
is exactly the same case like any other IP spoofed packet.  In
particular since LISP header is not used, xTR functions are not
actually attacked.

> Minor nit, next sentence:
>=20
>   A non-spoofing off-path attacker (NSA)...
>=20
> Given recent events, I think that "NSA" is an unfortunate acronym to use =
here. How about NSOA?=20
>=20
>=20

This can be fixed before pushing the document to the IESG.


> Section 4.3.1.1 (Gleaning Attacks), last paragraph:
>=20
>   By itself, an attack made solely using gleaning cannot last long,
>   however it should be noted that with current network capacities, a
>   large amount of packets might be exchanged during even a small
>   fraction of time.
>=20
> The amount of damage that might be caused by this may depend upon what ha=
ppens to be exchanged in that "short amount of time". For example, the init=
ial handshake between sites (at the application layer) could include sign i=
n information (account names and passwords), on the basis that this is the =
sort of information that needs to be exchanged at the beginning of, for exa=
mple, financial transactions. My understanding is that for Internet commerc=
e, it is normal for users to be redirected to a different site to enter cre=
dit card information. This appears to constitute a "new session" (or at lea=
st may be to an entirely different location) and therefore the entire credi=
t card exchange could occur in a small period of time. I think it would be =
worth mentioning here that the sensitivity of the information that could be=
 exchanged during this "short amount of time" is not known, and could poten=
tially be serious.=20

Exchanging critical information (e.g.  password) in clear means that
you have a serious problem, but not at the network layer.  Also, the
situation with LISP would not be worse than without LISP.

>=20
> Also, depending upon how long xTR's are willing to store gleaned informat=
ion (before the map request comes back), the time that a user is misdirecte=
d due to a gleaning attack might be extended by coordinating a DDOS attack =
with the gleaning attack. For example, an attacker may send packets to a ve=
ry large number of sites, with a source EID which is from a major stock bro=
ker or bank and an RLOC from the attacker's captive servers. The many sites=
 glean the EID to RLOC mapping from the arriving packets. Each pretty much =
simultaneously initiates an EID lookup (to verify the EID to RLOC mapping).=
 This creates a DOS attack on the control plane of the mapping function sup=
porting that stock broker or bank. This implies that the responses are goin=
g to be delayed (and could be greatly delayed), which allows the incorrect =
mappings to last longer than they otherwise would. This allows any systems =
that actually happen to be trying to connect to that stock or banking site =
to be redirected to the a
> ttacker's site. The attacker then becomes a man in the middle and can for=
 example can obtain the password and account information for users. =20
>=20
>=20

Such a scenario would require a lot of synchronisation.  Anyway, our
opinion is that the current text is stating exactly the same thing you
describe just in a succinct way.

As a reminder, the present document studies LISP in a public network
deployment.



> Last paragraph of section 4.3.2.2:=20
>=20
>   If the size of the Map-Request
>   message is larger than the size of the smallest LISP-encapsulated
>   packet that could trigger such a message, this could lead to
>   amplification attacks (see Section 4.4.1) so that more bandwidth is
>   consumed on the target than the bandwidth necessary at the attacker
>   side.
>=20
> The size of the packet is not the only issue. If the amount of processing=
 required to send a map-request and deal with the reply is greater than the=
 amount of processing that is required to send a packet that triggers such =
a request, then this could also result in an amplification attack. In princ=
iple it would seem that sending out a large number of packets to trigger su=
ch a request would be relatively straightforward (for example the attacker =
might be sending out many packets only incrementing the EID in order to att=
ack the ITR that will need to generate many map requests). We may note that=
 for many systems, particularly very high speed routers (which might exist =
for example as PE routers connecting very large enterprise customers), the =
control plane may be several orders of magnitude slower than the data plane=
, so that an attack that requires response from the router's control plane =
would be much more serious than an attack of the same size that can be hand=
led in the data plane. I=20
> will say more about this in my comments below regarding DOS attacks.=20
>=20
>=20

Your first point can be easily fixed by substituting the word
bandwidth with bandwidth and/or processing or "resource"

Your statement on the speed difference between control and data plane
is true and is a general observation not limited to LISP.  Note that
one of the advantages of having the Map-Server/Map-Resolver elements
in the LISPa architecture is exactly to avoid situations you are
describing.

> Section 4.3.2.3, third paragraph (right after the bullets):=20
>=20
>   The first type of packet should not cause any major problem to ITRs.
>   As the reachability test uses a 24 bits nonce, it is unlikely that an
>   off-path attacker could send a single packet that causes an ITR to
>   believe that the ETR it is testing is reachable while in reality it
>   is not reachable.  To increase the success likelihood of such attack,
>   the attacker should create a massive amount of packets carrying all
>   possible nonce values.
>=20
> However, this could be a problem if there are on-path attackers, since th=
ey will see the nonce. They could insert nonce's where none are present, re=
quiring a response from the ETR. Given that the control plane of very high =
speed PE routers may be much slower than the data plane, this could cause a=
 relatively moderate data stream that the data plane or the PE could easily=
 handle to turn into a control plane attack that the control plane of a PE =
router could not handle. Also, the on-path attacker could see the nonce's a=
nd respond "correctly" (or in a way that the ITR that sent the nonce *think=
s* is correct), thereby "verifying" connectivity when none is present. You =
dismissed on-path attacks earlier in the document on the basis that the use=
r data could be encrypted, but these are examples of on-path attacks that w=
ould be on the LISP header and operation, and not on the user data.=20

It is clearly stated at the beginning of the document that on-path
attacks are out of the scope of the document.  Also, Sec.  2 does not
limit cryptography technique to the payload, actually section 2 makes
the distinction saying:

1)
 "To cope with such an attacker, cryptographic techniques such as
 those used by IPSec ([RFC4301 ]) are required."

which is reported to any form of packet manipulation

and 2)
"As with IP, LISP relies on higher layer cryptography to secure packet
payloads from on path attacks, so this document does not consider
on-path attackers."

which is related to attacks targeting the payload.


>=20
>=20
> Section 5.2 (Denial of Service):
>=20
> You need to mention here the relative difference in speed between the dat=
a plane and the control plane of high speed routers. For example, there are=
 plenty of examples currently widely deployed of routers which can handle a=
 few terabits of data in the data plane. These routers might typically have=
 gigabit Ethernet links to the control processor, but I doubt that any of t=
hem could handle Map-Requests coming in at line rate at a gigabit. Thus the=
 ratio between the speed of the control plane the speed of the data plane i=
s significantly greater than 1000. I understand that many PE routers have s=
lower data planes (and the CE "wireless router" that sits in each of our ho=
mes is of course a lot slower than this), but large data centers or large e=
nterprise sites could very well be connected to their service provider via =
a few very high speed PE routers. Therefore an attack that would be trivial=
 to handle in the data plane (say, a few gigabits) could overwhelm the cont=
rol plane.=20
>=20

You are absolutely right, but why this is specific to LISP?  It is not
specific to LISP, so there is no reason to discuss such an issue in
this document.

> Gleaning allows incoming packets to create map requests, which allows a d=
ata plane attack to turn into a control plane attack. Given the difference =
in speeds between the data plane and the control plane, this makes it much =
easier to create an effective DOS attack.=20
>=20

RFC6830 already considered rate limiting fo this very reason.

>=20
> Section 8 (Security Considerations).=20
>=20
> I am pleased that you removed the sentence from section 1 of the previous=
 (-08) draft that read: "As a result of  the performed analysis, the docume=
nt discusses the severity of the threats and proposes recommendations to re=
ach the same level of security in LISP than in Internet today (e.g., withou=
t LISP)". This sentence was not actually correct. However, in looking throu=
gh the document and in thinking about the implications (see the rest of thi=
s email) it is quite clear that the security of an Internet using LISP woul=
d be significantly less than the current Internet (at least if you assume t=
hat there is *any* security at all in the current Internet). I am thinking =
that there should be a sentence at the end of section 8 to the effect that =
"At the current time it appears that LISP would have significant security i=
mplications if deployed on an Internet-wide scale".
>=20
>=20


Such sentence would not represent the discussions that took place in
the LISP WG in the last four years.

The arguments that you raised in the previous part of this mail are
mainly not LISP-specific, while the experience gathered in the last
years show that LISP is not worst that what we have today (and
actually research work out there shows that it can even be helpful to
use LISP)


> Finally, two items left out:
>=20
> I don't see any discussion on the effect of LISP on firewalls. I am assum=
ing that pretty much all currently deployed firewalls are not able to look =
past a LISP header to inspect the contents of packets. At a minimum, this w=
ould seem to imply that LISP will need to be deployed toward the Internet c=
ore from the current firewalls, so that the firewalls can be looking at nor=
mal (unchanged) IP packets.
>=20
>=20

Deployment model is out of the scope of this document and the problem
is not specific to LISP.


> There is another issue which might belong in the section on privacy: In t=
he Internet today if you want to attack a network with prefix aa.bb/16, and=
 you see this advertisement in the BGP routes, you can pick a random addres=
s and send a packet and see if anything happens. You get little feedback. W=
ith LISP you can send a map request to a random address in the block and ge=
t back a map reply. This gives you an RLOC which is in general the actual I=
P address of a real PE or CE router. Of course you can repeat this across t=
he entire /16, or even the Internet (given sufficient time and traffic), an=
d get something close to a complete list of LISP xTRs. This implies that if=
 service providers implement LISP on PE routers, then they will be exposing=
 the identity of their PE routers to worldwide inspection. Given the number=
 of PE routers in the world (obviously much larger than the number of servi=
ce providers, and given PA address aggregation probably larger than the num=
ber of routes that show u
> p in the BGP routing table) we should expect that there are lots of PE ro=
uters that have not been carefully secured, and exposing their existence to=
 open worldwide easy discovery would likely open the door to a number of at=
tacks that involve compromise of PE routers. Of course if LISP is deployed =
on CE routers then their RLOC would similarly be exposed.=20
>=20

If routers are not correctly secured, there is no problem linked to
LISP as today it is already possible to discover the IP address of
theses routers thanks to various techniques.  Moreover, section 6
already clearly states that privacy is not discussed in the document
but that the attacks presented in the document can potentially play a
role in privacy threats.

Regards,

The authors of the threats document.


> Thanks, Ross
>=20
> -----Original Message-----
> From: lisp [mailto:lisp-bounces@ietf.org] On Behalf Of Joel M. Halpern
> Sent: Friday, May 09, 2014 11:54 AM
> To: lisp@ietf.org
> Subject: [lisp] Restarting last call on LISP threats
>=20
> Sorry for the delay getting this out.
> This email starts a new (and hopefully final) last call on=20
> draft-ietf-lisp-threats, version 9:
> http://datatracker.ietf.org/doc/draft-ietf-lisp-threats/
>=20
> The last call will end in two weeks, close of business 23-May-2014.
>=20
> Thank you,
> Joel
>=20
> _______________________________________________
> lisp mailing list
> lisp@ietf.org
> https://www.ietf.org/mailman/listinfo/lisp
>=20
> _______________________________________________
> lisp mailing list
> lisp@ietf.org
> https://www.ietf.org/mailman/listinfo/lisp


From nobody Wed May 21 08:40:49 2014
Return-Path: <rbonica@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 90C411A03DD for <lisp@ietfa.amsl.com>; Wed, 21 May 2014 08:40:47 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.601
X-Spam-Level: 
X-Spam-Status: No, score=-102.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZU5PVgULz63n for <lisp@ietfa.amsl.com>; Wed, 21 May 2014 08:40:45 -0700 (PDT)
Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2lp0204.outbound.protection.outlook.com [207.46.163.204]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 028D61A0135 for <lisp@ietf.org>; Wed, 21 May 2014 08:40:44 -0700 (PDT)
Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB444.namprd05.prod.outlook.com (10.141.73.140) with Microsoft SMTP Server (TLS) id 15.0.944.11; Wed, 21 May 2014 15:40:42 +0000
Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) with mapi id 15.00.0944.000; Wed, 21 May 2014 15:40:42 +0000
From: Ronald Bonica <rbonica@juniper.net>
To: Dino Farinacci <farinacci@gmail.com>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEIABfmkAgAefyVA=
Date: Wed, 21 May 2014 15:40:41 +0000
Message-ID: <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com>
In-Reply-To: <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.12]
x-forefront-prvs: 0218A015FA
x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(189002)(199002)(51704005)(87936001)(85852003)(101416001)(2656002)(99396002)(74662001)(74502001)(76576001)(83072002)(21056001)(31966008)(50986999)(99286001)(33646001)(81342001)(74316001)(86362001)(66066001)(54356999)(4396001)(80022001)(76176999)(1411001)(76482001)(81542001)(79102001)(64706001)(77982001)(20776003)(92566001)(46102001)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO1PR05MB444; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; 
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/eny07rBvBSYvYTximpJ72Qd__ig
Cc: Roger Jorgensen <rogerj@gmail.com>, "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 21 May 2014 15:40:47 -0000

Dino,

I don't understand your response. So, I will ask the question another way.

Imagine a scenario in which a victim XTR and an attacker are attached to th=
e global Internet. The attacker is neither an XTR nor contained by a LISP s=
ite.

The attacker sends a flow of crafted packets to the victim XTR. Each packet=
 is a well-formed LISP data packet. It contains:

- an outer IP header (LOC->LOC)
- a UDP header
- a LISP Header
- an IP header (EID->EID)
- payload

Each packet contains control plane information that is new to the victim XT=
R. For example, the victim XTR has no mapping information regarding either =
the source LOC or source EID prefix. Rather than gleaning this mapping info=
rmation from the crafted packet, the victim XTR sends a verifying MAP-REQUE=
ST to the mapping system.

Assume that the attack flow is large (N packets per second). Assume also th=
at the XTRs rate limit for MAP-REQUEST messages is less than N packets per =
second. Has the attack not effectively DoS'd the victim XTR?

To make this attack work, every packet in the attack flow may need to have =
a unique, spoofed, source LOC.

                                                                           =
                                             Ron



> > The attacker can launch a DoS attack against an XTRs control plan by
> sending a barrage of crafted packets to the victim XTR. Each crafted pack=
et
> cause the victim XTR to send a verifying MAP-REQUEST to the mapping
> system.  The attack stream may be so large that it causes the victim XTR =
to
> exceed the rate limit for MAP-REQUEST messages.
>=20
> You can trust sources less if they ARE NOT in the mapping database. That =
is, if
> you are a LISP site, you have more tools be verify trust.
>=20
> Dino
>=20


From nobody Wed May 21 08:41:50 2014
Return-Path: <damien.saucez@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 371FE1A0847 for <lisp@ietfa.amsl.com>; Wed, 21 May 2014 08:41:43 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level: 
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9,  DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cK1seIsCN-DA for <lisp@ietfa.amsl.com>; Wed, 21 May 2014 08:41:36 -0700 (PDT)
Received: from mail-ee0-x22b.google.com (mail-ee0-x22b.google.com [IPv6:2a00:1450:4013:c00::22b]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 632D31A0445 for <lisp@ietf.org>; Wed, 21 May 2014 08:41:32 -0700 (PDT)
Received: by mail-ee0-f43.google.com with SMTP id d17so1728776eek.2 for <lisp@ietf.org>; Wed, 21 May 2014 08:41:30 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=references:mime-version:in-reply-to:content-type :content-transfer-encoding:message-id:cc:from:subject:date:to; bh=ZDdXggYILFrwRC5kBwGzm6mMMyx2RQr+/l7FENOB8Zw=; b=NRDESC9kqVvGak2H0yV4w9oPay6hjOEp6n7I1XJviGnKtaTP9MOnbA7tDpUFl2MOma 2UziPCxvu3QUtfb4DaEkfY1LWe3u5FyUNw+xd+FzFmkMeIBILfWnOQwD03MXGHu2yKVq 33FOMbW0xy84pGyjaenvQYUbhZ3WEHRJeOoZUXx9grHyKrYsGpTjHK870AZPeJeqz+QZ EBLcV9IQcT5srg89ewenzwjBWt1AGm2LvsMKTlSXy0b9gVU8K1s3yOFAw/sJTODG/DI7 1/7GE8GdqgGNx/o5WXlm8w5NjaPasMYSQ05y5WBa9lh7EK3SFV53QHo8JMpBw91R1Fb9 BMBQ==
X-Received: by 10.14.178.195 with SMTP id f43mr5101137eem.58.1400686890352; Wed, 21 May 2014 08:41:30 -0700 (PDT)
Received: from [10.226.144.78] (80-254-69-14.dynamic.monzoon.net. [80.254.69.14]) by mx.google.com with ESMTPSA id v47sm12760186eel.22.2014.05.21.08.41.29 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 21 May 2014 08:41:29 -0700 (PDT)
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <B3FF60AE-ED9D-45E6-BBB5-AE3F6C6172F8@gmail.com> <082ae04715e5432c9bf5b2d9fd00d568@CO2PR05MB636.namprd05.prod.outlook.com>
Mime-Version: 1.0 (1.0)
In-Reply-To: <082ae04715e5432c9bf5b2d9fd00d568@CO2PR05MB636.namprd05.prod.outlook.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Message-Id: <975D55AB-0489-4CA7-B690-0A7A45EF5588@gmail.com>
X-Mailer: iPod touch Mail (11D201)
From: Damien Saucez <damien.saucez@gmail.com>
Date: Wed, 21 May 2014 17:41:25 +0200
To: Ross Callon <rcallon@juniper.net>
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/qjbbLUZc3GrfrjISTlnD_w-i3vs
Cc: LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 21 May 2014 15:41:44 -0000

Hello,

I fully agree with your argument that security breach could have impact at l=
arge scale.=20

However we have to consider this document at the light of what is in the cha=
rter. As a matter of fact the charter states lisp as a mean to make the inte=
rnet more scalable. =46rom that point if view I think lisp is very well desi=
gned. =46rom this angle, the document only aim to show if the proposition ma=
kes security worst, same, or better than the system lisp is supposed to repl=
ace: the legacy internet. For that I think the document is complete as it fo=
cuses on what are the risks introduced by the new architecture, ignoring pro=
blems that are not lisp specific.=20

Despite this, we see many activities around high security features leveragin=
g lisp. Unfortunately these propositions are still out if the scope if the c=
harter as security improvement is not part if current charter. For these pro=
position to become part of lisp we first have to finish what the charter is a=
sking us. Then we will be able to discuss whether or not we want lisp to be a=
lso a solution for security issues currently in the internet.

Thank you,

Damien Saucez=20
> On 21 May 2014, at 17:16, Ross Callon <rcallon@juniper.net> wrote:
>=20
> I will respond to your email in detail (in a separate email), but I also=20=

> have one higher level meta-comment which is important which I think that=20=

> we should discuss first.=20
>=20
> Specifically, we need to remember what LISP is proposed to do. LISP=20
> has been proposed as a new routing and addressing architecture for the=20
> Internet. If we believe this goal is realistic, and if we believe that=20
> LISP could actually end up being deployed as the routing and addressing=20=

> architecture for the Internet, then the Internet could someday be entirely=
=20
> dependent upon LISP actually working and actually being secure when=20
> deployed at scale.=20
>=20
> The Internet has been described as the control plane for the world. The=20=

> Internet is of enormous importance for the world's economy (and all of=20
> our jobs, and millions of others). IT HAS TO WORK.
>=20
> As such, any attack that might have the potential of disrupting the=20
> operation of LISP, or that can be made worse by LISP, MUST be taken=20
> seriously. If you declare some attacks as "outside of the scope of=20
> LISP threats document" then either you are saying that the LISP WG is=20
> not serious about widespread deployment of LISP, or you are putting the=20=

> world's economy at risk.=20
>=20
> If there are any threats which is likely to be waged against the operation=
=20
> of LISP, then it is not acceptable to declare these threats as out of scop=
e,
> unless we are also going to agree that LISP must not be deployed on a wide=

> scale. As such, as currently written the threats document is not ready for=

> publication.=20
>=20
> Sincerely,=20
> Ross
>=20
> -----Original Message-----
> From: Damien Saucez [mailto:damien.saucez@gmail.com]=20
> Sent: Monday, May 19, 2014 6:26 PM
> To: Ross Callon
> Cc: Joel M. Halpern; LISP mailing list list; Luigi Iannone
> Subject: Re: [lisp] Restarting last call on LISP threats
>=20
> Dear Ross,
>=20
> Thank you for your time.
>=20
> Before detailed comments below, we have to remind that the objective
> of this document is to identify global threats potentially introduced
> by LISP w.r.t.  what exists today in the legacy Internet.  The problem
> space is out of the scope of the document.
>=20
> comments inline.
>=20
>> On 12 May 2014, at 19:11, Ross Callon <rcallon@juniper.net> wrote:
>>=20
>> Thanks Joel;
>>=20
>> I think that draft-ietf-lisp-threats-09.txt is a start towards a threats d=
ocument, but that it has serious omissions and needs more work before being p=
rogressed. Here are some specific comments:=20
>>=20
>>=20
>> Section 2 (On-path Attackers), first paragraph:=20
>>=20
>>  On-path attackers are attackers that are able to capture and modify
>>  all the packets exchanged between an Ingress Tunnel Router (ITR) and
>>  an Egress Tunnel Router (ETR).  To cope with such an attacker,
>>  cryptographic techniques such as those used by IPSec ([RFC4301]) are
>>  required.  As with IP, LISP relies on higher layer cryptography to
>>  secure packet payloads from on path attacks, so this document does
>>  not consider on-path attackers.
>>=20
>> To me an on-path attacker is one which is on the data path. Such an attac=
ker might attack the contents of the data packet. In this case the paragraph=
 seems mostly correct to me: You encrypt the contents if you don't want some=
one on the path to the destination to look at the contents. However, as is d=
iscussed later in the document, LISP allows systems which are not in the nor=
mal physical path, through a gleaning attack, to inject themselves into the d=
ata path. This could be applied to allow attacker's systems to inject themse=
lves into the path of the key management protocol. This implies that a legit=
imate user could get keys supplied by an attacker, just as easily as it coul=
d get keys supplied by a legitimate Internet site. If you are proposing that=
 end to end encryption is the solution to on path attackers then you need to=
 understand the implications of LISP on the operation of the protocol needed=
 for key management to support end to end encryption.
>=20
> The paragraph you are citing end with this document does _not_
> consider on-path attackers..  While you remarks are generally valuable
> they do not apply here, the document is not proposing anything, it i
> just stating what is _not_ considered.
>=20
>=20
>=20
>=20
>>=20
>> Also, you should mention in this section that a gleaning attack would all=
ow at least in the short term for an attacker to become temporarily on-path e=
ven if they are not on what should be the normal path to the destination.
> The definition we give about on-path attacker includes your
> sub-category.  It does not matter where you attacker physically is.
> If it is able to capture and modify packets then it is on-path (does
> not matter if physical shorter or not).
>=20
>=20
>> An on-path attacker might choose to only change something about the LISP h=
andling details, such as exploding the map cache or redirecting a user to a d=
ifferent site. Some of this is mentioned later in the document. One thing th=
at is not mentioned: Suppose that the encapsulated packet is encrypted. The o=
n-path attacker could however see the LISP header, and thus could change the=
 nonce, or add a nonce, or reply to the nonce, change versioning information=
,...  Are you proposing that the LISP header be encrypted also? If so, where=
 is this specified and what does it do to forwarding performance in the xTR?=

>=20
> The document is just an analysis, hence your question, while valid, is
> outside the scope of this document.
>>=20
>> Section 4.3.1, second paragraph, third sentence:=20
>>=20
>>  This is not different from today's
>>  Internet where a spoofing off-path attacker may inject data packets
>>  in any flow.
>>=20
>> In terms of injecting traffic that the end system receives and acts upon,=
 I believe that this sentence is entirely true. However, in terms of the eff=
ect on the router's control plane, and particularly the operation of xTR's, t=
his sentence is not true. Today there is very little that a spoofing attacke=
r that is outside of a particular service provider can do to exercise the co=
ntrol plane of that provider's routers. This is important and intentional (s=
ee DOS discussion below).
> The section actually does not enter in any discussion about
> quantifying the damages.  So the second part of your comment is
> correct if it does apply to section 4.3.1.
>=20
> The first half of your comment is, however, unfounded.  Section 4.3.1
> is about attacks _not_ leveraging on LISP header, so from this side it
> is exactly the same case like any other IP spoofed packet.  In
> particular since LISP header is not used, xTR functions are not
> actually attacked.
>=20
>> Minor nit, next sentence:
>>=20
>>  A non-spoofing off-path attacker (NSA)...
>>=20
>> Given recent events, I think that "NSA" is an unfortunate acronym to use h=
ere. How about NSOA?
>=20
> This can be fixed before pushing the document to the IESG.
>=20
>=20
>> Section 4.3.1.1 (Gleaning Attacks), last paragraph:
>>=20
>>  By itself, an attack made solely using gleaning cannot last long,
>>  however it should be noted that with current network capacities, a
>>  large amount of packets might be exchanged during even a small
>>  fraction of time.
>>=20
>> The amount of damage that might be caused by this may depend upon what ha=
ppens to be exchanged in that "short amount of time". For example, the initi=
al handshake between sites (at the application layer) could include sign in i=
nformation (account names and passwords), on the basis that this is the sort=
 of information that needs to be exchanged at the beginning of, for example,=
 financial transactions. My understanding is that for Internet commerce, it i=
s normal for users to be redirected to a different site to enter credit card=
 information. This appears to constitute a "new session" (or at least may be=
 to an entirely different location) and therefore the entire credit card exc=
hange could occur in a small period of time. I think it would be worth menti=
oning here that the sensitivity of the information that could be exchanged d=
uring this "short amount of time" is not known, and could potentially be ser=
ious.
>=20
> Exchanging critical information (e.g.  password) in clear means that
> you have a serious problem, but not at the network layer.  Also, the
> situation with LISP would not be worse than without LISP.
>=20
>>=20
>> Also, depending upon how long xTR's are willing to store gleaned informat=
ion (before the map request comes back), the time that a user is misdirected=
 due to a gleaning attack might be extended by coordinating a DDOS attack wi=
th the gleaning attack. For example, an attacker may send packets to a very l=
arge number of sites, with a source EID which is from a major stock broker o=
r bank and an RLOC from the attacker's captive servers. The many sites glean=
 the EID to RLOC mapping from the arriving packets. Each pretty much simulta=
neously initiates an EID lookup (to verify the EID to RLOC mapping). This cr=
eates a DOS attack on the control plane of the mapping function supporting t=
hat stock broker or bank. This implies that the responses are going to be de=
layed (and could be greatly delayed), which allows the incorrect mappings to=
 last longer than they otherwise would. This allows any systems that actuall=
y happen to be trying to connect to that stock or banking site to be redirec=
ted to the a
>> ttacker's site. The attacker then becomes a man in the middle and can for=
 example can obtain the password and account information for users. =20
>=20
> Such a scenario would require a lot of synchronisation.  Anyway, our
> opinion is that the current text is stating exactly the same thing you
> describe just in a succinct way.
>=20
> As a reminder, the present document studies LISP in a public network
> deployment.
>=20
>=20
>=20
>> Last paragraph of section 4.3.2.2:=20
>>=20
>>  If the size of the Map-Request
>>  message is larger than the size of the smallest LISP-encapsulated
>>  packet that could trigger such a message, this could lead to
>>  amplification attacks (see Section 4.4.1) so that more bandwidth is
>>  consumed on the target than the bandwidth necessary at the attacker
>>  side.
>>=20
>> The size of the packet is not the only issue. If the amount of processing=
 required to send a map-request and deal with the reply is greater than the a=
mount of processing that is required to send a packet that triggers such a r=
equest, then this could also result in an amplification attack. In principle=
 it would seem that sending out a large number of packets to trigger such a r=
equest would be relatively straightforward (for example the attacker might b=
e sending out many packets only incrementing the EID in order to attack the I=
TR that will need to generate many map requests). We may note that for many s=
ystems, particularly very high speed routers (which might exist for example a=
s PE routers connecting very large enterprise customers), the control plane m=
ay be several orders of magnitude slower than the data plane, so that an att=
ack that requires response from the router's control plane would be much mor=
e serious than an attack of the same size that can be handled in the data pl=
ane. I=20
>> will say more about this in my comments below regarding DOS attacks.
>=20
> Your first point can be easily fixed by substituting the word
> bandwidth with bandwidth and/or processing or "resource"
>=20
> Your statement on the speed difference between control and data plane
> is true and is a general observation not limited to LISP.  Note that
> one of the advantages of having the Map-Server/Map-Resolver elements
> in the LISPa architecture is exactly to avoid situations you are
> describing.
>=20
>> Section 4.3.2.3, third paragraph (right after the bullets):=20
>>=20
>>  The first type of packet should not cause any major problem to ITRs.
>>  As the reachability test uses a 24 bits nonce, it is unlikely that an
>>  off-path attacker could send a single packet that causes an ITR to
>>  believe that the ETR it is testing is reachable while in reality it
>>  is not reachable.  To increase the success likelihood of such attack,
>>  the attacker should create a massive amount of packets carrying all
>>  possible nonce values.
>>=20
>> However, this could be a problem if there are on-path attackers, since th=
ey will see the nonce. They could insert nonce's where none are present, req=
uiring a response from the ETR. Given that the control plane of very high sp=
eed PE routers may be much slower than the data plane, this could cause a re=
latively moderate data stream that the data plane or the PE could easily han=
dle to turn into a control plane attack that the control plane of a PE route=
r could not handle. Also, the on-path attacker could see the nonce's and res=
pond "correctly" (or in a way that the ITR that sent the nonce *thinks* is c=
orrect), thereby "verifying" connectivity when none is present. You dismisse=
d on-path attacks earlier in the document on the basis that the user data co=
uld be encrypted, but these are examples of on-path attacks that would be on=
 the LISP header and operation, and not on the user data.
>=20
> It is clearly stated at the beginning of the document that on-path
> attacks are out of the scope of the document.  Also, Sec.  2 does not
> limit cryptography technique to the payload, actually section 2 makes
> the distinction saying:
>=20
> 1)
> "To cope with such an attacker, cryptographic techniques such as
> those used by IPSec ([RFC4301 ]) are required."
>=20
> which is reported to any form of packet manipulation
>=20
> and 2)
> "As with IP, LISP relies on higher layer cryptography to secure packet
> payloads from on path attacks, so this document does not consider
> on-path attackers."
>=20
> which is related to attacks targeting the payload.
>=20
>=20
>>=20
>>=20
>> Section 5.2 (Denial of Service):
>>=20
>> You need to mention here the relative difference in speed between the dat=
a plane and the control plane of high speed routers. For example, there are p=
lenty of examples currently widely deployed of routers which can handle a fe=
w terabits of data in the data plane. These routers might typically have gig=
abit Ethernet links to the control processor, but I doubt that any of them c=
ould handle Map-Requests coming in at line rate at a gigabit. Thus the ratio=
 between the speed of the control plane the speed of the data plane is signi=
ficantly greater than 1000. I understand that many PE routers have slower da=
ta planes (and the CE "wireless router" that sits in each of our homes is of=
 course a lot slower than this), but large data centers or large enterprise s=
ites could very well be connected to their service provider via a few very h=
igh speed PE routers. Therefore an attack that would be trivial to handle in=
 the data plane (say, a few gigabits) could overwhelm the control plane.
>=20
> You are absolutely right, but why this is specific to LISP?  It is not
> specific to LISP, so there is no reason to discuss such an issue in
> this document.
>=20
>> Gleaning allows incoming packets to create map requests, which allows a d=
ata plane attack to turn into a control plane attack. Given the difference i=
n speeds between the data plane and the control plane, this makes it much ea=
sier to create an effective DOS attack.
>=20
> RFC6830 already considered rate limiting fo this very reason.
>=20
>>=20
>> Section 8 (Security Considerations).=20
>>=20
>> I am pleased that you removed the sentence from section 1 of the previous=
 (-08) draft that read: "As a result of  the performed analysis, the documen=
t discusses the severity of the threats and proposes recommendations to reac=
h the same level of security in LISP than in Internet today (e.g., without L=
ISP)". This sentence was not actually correct. However, in looking through t=
he document and in thinking about the implications (see the rest of this ema=
il) it is quite clear that the security of an Internet using LISP would be s=
ignificantly less than the current Internet (at least if you assume that the=
re is *any* security at all in the current Internet). I am thinking that the=
re should be a sentence at the end of section 8 to the effect that "At the c=
urrent time it appears that LISP would have significant security implication=
s if deployed on an Internet-wide scale".
>=20
>=20
> Such sentence would not represent the discussions that took place in
> the LISP WG in the last four years.
>=20
> The arguments that you raised in the previous part of this mail are
> mainly not LISP-specific, while the experience gathered in the last
> years show that LISP is not worst that what we have today (and
> actually research work out there shows that it can even be helpful to
> use LISP)
>=20
>=20
>> Finally, two items left out:
>>=20
>> I don't see any discussion on the effect of LISP on firewalls. I am assum=
ing that pretty much all currently deployed firewalls are not able to look p=
ast a LISP header to inspect the contents of packets. At a minimum, this wou=
ld seem to imply that LISP will need to be deployed toward the Internet core=
 from the current firewalls, so that the firewalls can be looking at normal (=
unchanged) IP packets.
>=20
> Deployment model is out of the scope of this document and the problem
> is not specific to LISP.
>=20
>=20
>> There is another issue which might belong in the section on privacy: In t=
he Internet today if you want to attack a network with prefix aa.bb/16, and y=
ou see this advertisement in the BGP routes, you can pick a random address a=
nd send a packet and see if anything happens. You get little feedback. With L=
ISP you can send a map request to a random address in the block and get back=
 a map reply. This gives you an RLOC which is in general the actual IP addre=
ss of a real PE or CE router. Of course you can repeat this across the entir=
e /16, or even the Internet (given sufficient time and traffic), and get som=
ething close to a complete list of LISP xTRs. This implies that if service p=
roviders implement LISP on PE routers, then they will be exposing the identi=
ty of their PE routers to worldwide inspection. Given the number of PE route=
rs in the world (obviously much larger than the number of service providers,=
 and given PA address aggregation probably larger than the number of routes t=
hat show u
>> p in the BGP routing table) we should expect that there are lots of PE ro=
uters that have not been carefully secured, and exposing their existence to o=
pen worldwide easy discovery would likely open the door to a number of attac=
ks that involve compromise of PE routers. Of course if LISP is deployed on C=
E routers then their RLOC would similarly be exposed.
>=20
> If routers are not correctly secured, there is no problem linked to
> LISP as today it is already possible to discover the IP address of
> theses routers thanks to various techniques.  Moreover, section 6
> already clearly states that privacy is not discussed in the document
> but that the attacks presented in the document can potentially play a
> role in privacy threats.
>=20
> Regards,
>=20
> The authors of the threats document.
>=20
>=20
>> Thanks, Ross
>>=20
>> -----Original Message-----
>> From: lisp [mailto:lisp-bounces@ietf.org] On Behalf Of Joel M. Halpern
>> Sent: Friday, May 09, 2014 11:54 AM
>> To: lisp@ietf.org
>> Subject: [lisp] Restarting last call on LISP threats
>>=20
>> Sorry for the delay getting this out.
>> This email starts a new (and hopefully final) last call on=20
>> draft-ietf-lisp-threats, version 9:
>> http://datatracker.ietf.org/doc/draft-ietf-lisp-threats/
>>=20
>> The last call will end in two weeks, close of business 23-May-2014.
>>=20
>> Thank you,
>> Joel
>>=20
>> _______________________________________________
>> lisp mailing list
>> lisp@ietf.org
>> https://www.ietf.org/mailman/listinfo/lisp
>>=20
>> _______________________________________________
>> lisp mailing list
>> lisp@ietf.org
>> https://www.ietf.org/mailman/listinfo/lisp
>=20


From nobody Wed May 21 09:45:37 2014
Return-Path: <rcallon@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B4091A06D3 for <lisp@ietfa.amsl.com>; Wed, 21 May 2014 09:45:36 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.601
X-Spam-Level: 
X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rMflaCChGJGC for <lisp@ietfa.amsl.com>; Wed, 21 May 2014 09:45:32 -0700 (PDT)
Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2lp0209.outbound.protection.outlook.com [207.46.163.209]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 070FA1A06B3 for <lisp@ietf.org>; Wed, 21 May 2014 09:45:31 -0700 (PDT)
Received: from CO2PR05MB636.namprd05.prod.outlook.com (10.141.199.24) by CO2PR05MB633.namprd05.prod.outlook.com (10.141.199.12) with Microsoft SMTP Server (TLS) id 15.0.944.11; Wed, 21 May 2014 16:45:28 +0000
Received: from CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) by CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) with mapi id 15.00.0944.000; Wed, 21 May 2014 16:45:28 +0000
From: Ross Callon <rcallon@juniper.net>
To: Damien Saucez <damien.saucez@gmail.com>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58M9eFhkxJvMEaw1MEc+Ryfdps9FMJAgAt2hwCAAqNu4IAAEEmAgAAP+dA=
Date: Wed, 21 May 2014 16:45:28 +0000
Message-ID: <d90b4ab22b0b40a4ac912bd214e96a8e@CO2PR05MB636.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <B3FF60AE-ED9D-45E6-BBB5-AE3F6C6172F8@gmail.com> <082ae04715e5432c9bf5b2d9fd00d568@CO2PR05MB636.namprd05.prod.outlook.com> <975D55AB-0489-4CA7-B690-0A7A45EF5588@gmail.com>
In-Reply-To: <975D55AB-0489-4CA7-B690-0A7A45EF5588@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.15]
x-forefront-prvs: 0218A015FA
x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(13464003)(51744003)(51704005)(24454002)(51444003)(164054003)(189002)(199002)(377454003)(74662001)(20776003)(76576001)(74502001)(77096999)(31966008)(66066001)(83072002)(79102001)(64706001)(76482001)(80022001)(46102001)(50986999)(99286001)(76176999)(54356999)(81542001)(99396002)(33646001)(81342001)(86362001)(74316001)(15975445006)(85852003)(92566001)(19580395003)(101416001)(2656002)(21056001)(551544002)(87936001)(77982001)(15202345003)(19580405001)(4396001)(24736002)(579004); DIR:OUT; SFP:; SCL:1; SRVR:CO2PR05MB633; H:CO2PR05MB636.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rcallon@juniper.net; 
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/3JeeGmWJFezj3n64kHm2B9ylSq4
Cc: LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 21 May 2014 16:45:36 -0000

To get the charter to say "fix these security holes" we need to know what t=
he security holes are. The point of the threats document is to understand w=
hat threats are there, not to limit ourselves to only discuss threats that =
we are already chartered to fix. I am pretty sure that a thorough and compl=
ete threats document is in the charter.

There were multiple items in my original comments that point to places wher=
e LISP makes security worse than what we have today in the current Internet=
. I could point these out again in my detailed reply to your email (which m=
ight take me a couple of work days to complete, and I am off on Friday and =
for the long weekend).=20

Thanks, Ross

-----Original Message-----
From: Damien Saucez [mailto:damien.saucez@gmail.com]=20
Sent: Wednesday, May 21, 2014 11:41 AM
To: Ross Callon
Cc: Joel M. Halpern; LISP mailing list list; Luigi Iannone
Subject: Re: [lisp] Restarting last call on LISP threats

Hello,

I fully agree with your argument that security breach could have impact at =
large scale.=20

However we have to consider this document at the light of what is in the ch=
arter. As a matter of fact the charter states lisp as a mean to make the in=
ternet more scalable. From that point if view I think lisp is very well des=
igned. From this angle, the document only aim to show if the proposition ma=
kes security worst, same, or better than the system lisp is supposed to rep=
lace: the legacy internet. For that I think the document is complete as it =
focuses on what are the risks introduced by the new architecture, ignoring =
problems that are not lisp specific.=20

Despite this, we see many activities around high security features leveragi=
ng lisp. Unfortunately these propositions are still out if the scope if the=
 charter as security improvement is not part if current charter. For these =
proposition to become part of lisp we first have to finish what the charter=
 is asking us. Then we will be able to discuss whether or not we want lisp =
to be also a solution for security issues currently in the internet.

Thank you,

Damien Saucez=20
> On 21 May 2014, at 17:16, Ross Callon <rcallon@juniper.net> wrote:
>=20
> I will respond to your email in detail (in a separate email), but I also=
=20
> have one higher level meta-comment which is important which I think that=
=20
> we should discuss first.=20
>=20
> Specifically, we need to remember what LISP is proposed to do. LISP=20
> has been proposed as a new routing and addressing architecture for the=20
> Internet. If we believe this goal is realistic, and if we believe that=20
> LISP could actually end up being deployed as the routing and addressing=20
> architecture for the Internet, then the Internet could someday be entirel=
y=20
> dependent upon LISP actually working and actually being secure when=20
> deployed at scale.=20
>=20
> The Internet has been described as the control plane for the world. The=20
> Internet is of enormous importance for the world's economy (and all of=20
> our jobs, and millions of others). IT HAS TO WORK.
>=20
> As such, any attack that might have the potential of disrupting the=20
> operation of LISP, or that can be made worse by LISP, MUST be taken=20
> seriously. If you declare some attacks as "outside of the scope of=20
> LISP threats document" then either you are saying that the LISP WG is=20
> not serious about widespread deployment of LISP, or you are putting the=20
> world's economy at risk.=20
>=20
> If there are any threats which is likely to be waged against the operatio=
n=20
> of LISP, then it is not acceptable to declare these threats as out of sco=
pe,
> unless we are also going to agree that LISP must not be deployed on a wid=
e
> scale. As such, as currently written the threats document is not ready fo=
r
> publication.=20
>=20
> Sincerely,=20
> Ross
>=20
> -----Original Message-----
> From: Damien Saucez [mailto:damien.saucez@gmail.com]=20
> Sent: Monday, May 19, 2014 6:26 PM
> To: Ross Callon
> Cc: Joel M. Halpern; LISP mailing list list; Luigi Iannone
> Subject: Re: [lisp] Restarting last call on LISP threats
>=20
> Dear Ross,
>=20
> Thank you for your time.
>=20
> Before detailed comments below, we have to remind that the objective
> of this document is to identify global threats potentially introduced
> by LISP w.r.t.  what exists today in the legacy Internet.  The problem
> space is out of the scope of the document.
>=20
> comments inline.
>=20
>> On 12 May 2014, at 19:11, Ross Callon <rcallon@juniper.net> wrote:
>>=20
>> Thanks Joel;
>>=20
>> I think that draft-ietf-lisp-threats-09.txt is a start towards a threats=
 document, but that it has serious omissions and needs more work before bei=
ng progressed. Here are some specific comments:=20
>>=20
>>=20
>> Section 2 (On-path Attackers), first paragraph:=20
>>=20
>>  On-path attackers are attackers that are able to capture and modify
>>  all the packets exchanged between an Ingress Tunnel Router (ITR) and
>>  an Egress Tunnel Router (ETR).  To cope with such an attacker,
>>  cryptographic techniques such as those used by IPSec ([RFC4301]) are
>>  required.  As with IP, LISP relies on higher layer cryptography to
>>  secure packet payloads from on path attacks, so this document does
>>  not consider on-path attackers.
>>=20
>> To me an on-path attacker is one which is on the data path. Such an atta=
cker might attack the contents of the data packet. In this case the paragra=
ph seems mostly correct to me: You encrypt the contents if you don't want s=
omeone on the path to the destination to look at the contents. However, as =
is discussed later in the document, LISP allows systems which are not in th=
e normal physical path, through a gleaning attack, to inject themselves int=
o the data path. This could be applied to allow attacker's systems to injec=
t themselves into the path of the key management protocol. This implies tha=
t a legitimate user could get keys supplied by an attacker, just as easily =
as it could get keys supplied by a legitimate Internet site. If you are pro=
posing that end to end encryption is the solution to on path attackers then=
 you need to understand the implications of LISP on the operation of the pr=
otocol needed for key management to support end to end encryption.
>=20
> The paragraph you are citing end with this document does _not_
> consider on-path attackers..  While you remarks are generally valuable
> they do not apply here, the document is not proposing anything, it i
> just stating what is _not_ considered.
>=20
>=20
>=20
>=20
>>=20
>> Also, you should mention in this section that a gleaning attack would al=
low at least in the short term for an attacker to become temporarily on-pat=
h even if they are not on what should be the normal path to the destination=
.
> The definition we give about on-path attacker includes your
> sub-category.  It does not matter where you attacker physically is.
> If it is able to capture and modify packets then it is on-path (does
> not matter if physical shorter or not).
>=20
>=20
>> An on-path attacker might choose to only change something about the LISP=
 handling details, such as exploding the map cache or redirecting a user to=
 a different site. Some of this is mentioned later in the document. One thi=
ng that is not mentioned: Suppose that the encapsulated packet is encrypted=
. The on-path attacker could however see the LISP header, and thus could ch=
ange the nonce, or add a nonce, or reply to the nonce, change versioning in=
formation,...  Are you proposing that the LISP header be encrypted also? If=
 so, where is this specified and what does it do to forwarding performance =
in the xTR?
>=20
> The document is just an analysis, hence your question, while valid, is
> outside the scope of this document.
>>=20
>> Section 4.3.1, second paragraph, third sentence:=20
>>=20
>>  This is not different from today's
>>  Internet where a spoofing off-path attacker may inject data packets
>>  in any flow.
>>=20
>> In terms of injecting traffic that the end system receives and acts upon=
, I believe that this sentence is entirely true. However, in terms of the e=
ffect on the router's control plane, and particularly the operation of xTR'=
s, this sentence is not true. Today there is very little that a spoofing at=
tacker that is outside of a particular service provider can do to exercise =
the control plane of that provider's routers. This is important and intenti=
onal (see DOS discussion below).
> The section actually does not enter in any discussion about
> quantifying the damages.  So the second part of your comment is
> correct if it does apply to section 4.3.1.
>=20
> The first half of your comment is, however, unfounded.  Section 4.3.1
> is about attacks _not_ leveraging on LISP header, so from this side it
> is exactly the same case like any other IP spoofed packet.  In
> particular since LISP header is not used, xTR functions are not
> actually attacked.
>=20
>> Minor nit, next sentence:
>>=20
>>  A non-spoofing off-path attacker (NSA)...
>>=20
>> Given recent events, I think that "NSA" is an unfortunate acronym to use=
 here. How about NSOA?
>=20
> This can be fixed before pushing the document to the IESG.
>=20
>=20
>> Section 4.3.1.1 (Gleaning Attacks), last paragraph:
>>=20
>>  By itself, an attack made solely using gleaning cannot last long,
>>  however it should be noted that with current network capacities, a
>>  large amount of packets might be exchanged during even a small
>>  fraction of time.
>>=20
>> The amount of damage that might be caused by this may depend upon what h=
appens to be exchanged in that "short amount of time". For example, the ini=
tial handshake between sites (at the application layer) could include sign =
in information (account names and passwords), on the basis that this is the=
 sort of information that needs to be exchanged at the beginning of, for ex=
ample, financial transactions. My understanding is that for Internet commer=
ce, it is normal for users to be redirected to a different site to enter cr=
edit card information. This appears to constitute a "new session" (or at le=
ast may be to an entirely different location) and therefore the entire cred=
it card exchange could occur in a small period of time. I think it would be=
 worth mentioning here that the sensitivity of the information that could b=
e exchanged during this "short amount of time" is not known, and could pote=
ntially be serious.
>=20
> Exchanging critical information (e.g.  password) in clear means that
> you have a serious problem, but not at the network layer.  Also, the
> situation with LISP would not be worse than without LISP.
>=20
>>=20
>> Also, depending upon how long xTR's are willing to store gleaned informa=
tion (before the map request comes back), the time that a user is misdirect=
ed due to a gleaning attack might be extended by coordinating a DDOS attack=
 with the gleaning attack. For example, an attacker may send packets to a v=
ery large number of sites, with a source EID which is from a major stock br=
oker or bank and an RLOC from the attacker's captive servers. The many site=
s glean the EID to RLOC mapping from the arriving packets. Each pretty much=
 simultaneously initiates an EID lookup (to verify the EID to RLOC mapping)=
. This creates a DOS attack on the control plane of the mapping function su=
pporting that stock broker or bank. This implies that the responses are goi=
ng to be delayed (and could be greatly delayed), which allows the incorrect=
 mappings to last longer than they otherwise would. This allows any systems=
 that actually happen to be trying to connect to that stock or banking site=
 to be redirected to the a
>> ttacker's site. The attacker then becomes a man in the middle and can fo=
r example can obtain the password and account information for users. =20
>=20
> Such a scenario would require a lot of synchronisation.  Anyway, our
> opinion is that the current text is stating exactly the same thing you
> describe just in a succinct way.
>=20
> As a reminder, the present document studies LISP in a public network
> deployment.
>=20
>=20
>=20
>> Last paragraph of section 4.3.2.2:=20
>>=20
>>  If the size of the Map-Request
>>  message is larger than the size of the smallest LISP-encapsulated
>>  packet that could trigger such a message, this could lead to
>>  amplification attacks (see Section 4.4.1) so that more bandwidth is
>>  consumed on the target than the bandwidth necessary at the attacker
>>  side.
>>=20
>> The size of the packet is not the only issue. If the amount of processin=
g required to send a map-request and deal with the reply is greater than th=
e amount of processing that is required to send a packet that triggers such=
 a request, then this could also result in an amplification attack. In prin=
ciple it would seem that sending out a large number of packets to trigger s=
uch a request would be relatively straightforward (for example the attacker=
 might be sending out many packets only incrementing the EID in order to at=
tack the ITR that will need to generate many map requests). We may note tha=
t for many systems, particularly very high speed routers (which might exist=
 for example as PE routers connecting very large enterprise customers), the=
 control plane may be several orders of magnitude slower than the data plan=
e, so that an attack that requires response from the router's control plane=
 would be much more serious than an attack of the same size that can be han=
dled in the data plane. I=20
>> will say more about this in my comments below regarding DOS attacks.
>=20
> Your first point can be easily fixed by substituting the word
> bandwidth with bandwidth and/or processing or "resource"
>=20
> Your statement on the speed difference between control and data plane
> is true and is a general observation not limited to LISP.  Note that
> one of the advantages of having the Map-Server/Map-Resolver elements
> in the LISPa architecture is exactly to avoid situations you are
> describing.
>=20
>> Section 4.3.2.3, third paragraph (right after the bullets):=20
>>=20
>>  The first type of packet should not cause any major problem to ITRs.
>>  As the reachability test uses a 24 bits nonce, it is unlikely that an
>>  off-path attacker could send a single packet that causes an ITR to
>>  believe that the ETR it is testing is reachable while in reality it
>>  is not reachable.  To increase the success likelihood of such attack,
>>  the attacker should create a massive amount of packets carrying all
>>  possible nonce values.
>>=20
>> However, this could be a problem if there are on-path attackers, since t=
hey will see the nonce. They could insert nonce's where none are present, r=
equiring a response from the ETR. Given that the control plane of very high=
 speed PE routers may be much slower than the data plane, this could cause =
a relatively moderate data stream that the data plane or the PE could easil=
y handle to turn into a control plane attack that the control plane of a PE=
 router could not handle. Also, the on-path attacker could see the nonce's =
and respond "correctly" (or in a way that the ITR that sent the nonce *thin=
ks* is correct), thereby "verifying" connectivity when none is present. You=
 dismissed on-path attacks earlier in the document on the basis that the us=
er data could be encrypted, but these are examples of on-path attacks that =
would be on the LISP header and operation, and not on the user data.
>=20
> It is clearly stated at the beginning of the document that on-path
> attacks are out of the scope of the document.  Also, Sec.  2 does not
> limit cryptography technique to the payload, actually section 2 makes
> the distinction saying:
>=20
> 1)
> "To cope with such an attacker, cryptographic techniques such as
> those used by IPSec ([RFC4301 ]) are required."
>=20
> which is reported to any form of packet manipulation
>=20
> and 2)
> "As with IP, LISP relies on higher layer cryptography to secure packet
> payloads from on path attacks, so this document does not consider
> on-path attackers."
>=20
> which is related to attacks targeting the payload.
>=20
>=20
>>=20
>>=20
>> Section 5.2 (Denial of Service):
>>=20
>> You need to mention here the relative difference in speed between the da=
ta plane and the control plane of high speed routers. For example, there ar=
e plenty of examples currently widely deployed of routers which can handle =
a few terabits of data in the data plane. These routers might typically hav=
e gigabit Ethernet links to the control processor, but I doubt that any of =
them could handle Map-Requests coming in at line rate at a gigabit. Thus th=
e ratio between the speed of the control plane the speed of the data plane =
is significantly greater than 1000. I understand that many PE routers have =
slower data planes (and the CE "wireless router" that sits in each of our h=
omes is of course a lot slower than this), but large data centers or large =
enterprise sites could very well be connected to their service provider via=
 a few very high speed PE routers. Therefore an attack that would be trivia=
l to handle in the data plane (say, a few gigabits) could overwhelm the con=
trol plane.
>=20
> You are absolutely right, but why this is specific to LISP?  It is not
> specific to LISP, so there is no reason to discuss such an issue in
> this document.
>=20
>> Gleaning allows incoming packets to create map requests, which allows a =
data plane attack to turn into a control plane attack. Given the difference=
 in speeds between the data plane and the control plane, this makes it much=
 easier to create an effective DOS attack.
>=20
> RFC6830 already considered rate limiting fo this very reason.
>=20
>>=20
>> Section 8 (Security Considerations).=20
>>=20
>> I am pleased that you removed the sentence from section 1 of the previou=
s (-08) draft that read: "As a result of  the performed analysis, the docum=
ent discusses the severity of the threats and proposes recommendations to r=
each the same level of security in LISP than in Internet today (e.g., witho=
ut LISP)". This sentence was not actually correct. However, in looking thro=
ugh the document and in thinking about the implications (see the rest of th=
is email) it is quite clear that the security of an Internet using LISP wou=
ld be significantly less than the current Internet (at least if you assume =
that there is *any* security at all in the current Internet). I am thinking=
 that there should be a sentence at the end of section 8 to the effect that=
 "At the current time it appears that LISP would have significant security =
implications if deployed on an Internet-wide scale".
>=20
>=20
> Such sentence would not represent the discussions that took place in
> the LISP WG in the last four years.
>=20
> The arguments that you raised in the previous part of this mail are
> mainly not LISP-specific, while the experience gathered in the last
> years show that LISP is not worst that what we have today (and
> actually research work out there shows that it can even be helpful to
> use LISP)
>=20
>=20
>> Finally, two items left out:
>>=20
>> I don't see any discussion on the effect of LISP on firewalls. I am assu=
ming that pretty much all currently deployed firewalls are not able to look=
 past a LISP header to inspect the contents of packets. At a minimum, this =
would seem to imply that LISP will need to be deployed toward the Internet =
core from the current firewalls, so that the firewalls can be looking at no=
rmal (unchanged) IP packets.
>=20
> Deployment model is out of the scope of this document and the problem
> is not specific to LISP.
>=20
>=20
>> There is another issue which might belong in the section on privacy: In =
the Internet today if you want to attack a network with prefix aa.bb/16, an=
d you see this advertisement in the BGP routes, you can pick a random addre=
ss and send a packet and see if anything happens. You get little feedback. =
With LISP you can send a map request to a random address in the block and g=
et back a map reply. This gives you an RLOC which is in general the actual =
IP address of a real PE or CE router. Of course you can repeat this across =
the entire /16, or even the Internet (given sufficient time and traffic), a=
nd get something close to a complete list of LISP xTRs. This implies that i=
f service providers implement LISP on PE routers, then they will be exposin=
g the identity of their PE routers to worldwide inspection. Given the numbe=
r of PE routers in the world (obviously much larger than the number of serv=
ice providers, and given PA address aggregation probably larger than the nu=
mber of routes that show u
>> p in the BGP routing table) we should expect that there are lots of PE r=
outers that have not been carefully secured, and exposing their existence t=
o open worldwide easy discovery would likely open the door to a number of a=
ttacks that involve compromise of PE routers. Of course if LISP is deployed=
 on CE routers then their RLOC would similarly be exposed.
>=20
> If routers are not correctly secured, there is no problem linked to
> LISP as today it is already possible to discover the IP address of
> theses routers thanks to various techniques.  Moreover, section 6
> already clearly states that privacy is not discussed in the document
> but that the attacks presented in the document can potentially play a
> role in privacy threats.
>=20
> Regards,
>=20
> The authors of the threats document.
>=20
>=20
>> Thanks, Ross
>>=20
>> -----Original Message-----
>> From: lisp [mailto:lisp-bounces@ietf.org] On Behalf Of Joel M. Halpern
>> Sent: Friday, May 09, 2014 11:54 AM
>> To: lisp@ietf.org
>> Subject: [lisp] Restarting last call on LISP threats
>>=20
>> Sorry for the delay getting this out.
>> This email starts a new (and hopefully final) last call on=20
>> draft-ietf-lisp-threats, version 9:
>> http://datatracker.ietf.org/doc/draft-ietf-lisp-threats/
>>=20
>> The last call will end in two weeks, close of business 23-May-2014.
>>=20
>> Thank you,
>> Joel
>>=20
>> _______________________________________________
>> lisp mailing list
>> lisp@ietf.org
>> https://www.ietf.org/mailman/listinfo/lisp
>>=20
>> _______________________________________________
>> lisp mailing list
>> lisp@ietf.org
>> https://www.ietf.org/mailman/listinfo/lisp
>=20


From nobody Wed May 21 10:25:24 2014
Return-Path: <damien.saucez@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 077211A089B for <lisp@ietfa.amsl.com>; Wed, 21 May 2014 10:25:24 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level: 
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, MIME_QP_LONG_LINE=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zWCW--3g3Mkc for <lisp@ietfa.amsl.com>; Wed, 21 May 2014 10:25:16 -0700 (PDT)
Received: from mail-ee0-x236.google.com (mail-ee0-x236.google.com [IPv6:2a00:1450:4013:c00::236]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CFF681A0895 for <lisp@ietf.org>; Wed, 21 May 2014 10:25:15 -0700 (PDT)
Received: by mail-ee0-f54.google.com with SMTP id b57so1865068eek.27 for <lisp@ietf.org>; Wed, 21 May 2014 10:25:13 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=references:mime-version:in-reply-to:content-type :content-transfer-encoding:message-id:cc:from:subject:date:to; bh=FKcsydKejmd740VHXXt/dymxIj7ZcvNP9V6215KawSs=; b=Ez6rhjXpB7OPDEKYmfas6l+syvNpNg1mKegLJj6KQlZhYuZEhSbikxoKATxo+4saKu cv4xTqCS3NIwZD7mxEkMhdR1vgngpzJmXfb0dqo6RwzkVnsAtrD4t7+qKc07pKEXqX6P MX49T1mA+KLXipiIrBNYj6HTXxZPLEaeUNF7ig4bjI64wtzTywNw5jHrl5M4BdvWSL0M AeOQtXka5EmLxLe4cxSb9yF82n4oMS0dn2HHgYyWG4yoSon1xMO4b7D+AFHyN3NerrbW 6AbBRoMqZSwF1Kk1pYbMHm32QtIiGx3uPxBKZIWkq3qXPy/srasn76aVJi2jhRvQpyk5 3EGQ==
X-Received: by 10.14.101.70 with SMTP id a46mr5506940eeg.113.1400693113767; Wed, 21 May 2014 10:25:13 -0700 (PDT)
Received: from [10.226.144.78] (80-254-69-14.dynamic.monzoon.net. [80.254.69.14]) by mx.google.com with ESMTPSA id b12sm13359207eeh.45.2014.05.21.10.25.12 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 21 May 2014 10:25:12 -0700 (PDT)
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <B3FF60AE-ED9D-45E6-BBB5-AE3F6C6172F8@gmail.com> <082ae04715e5432c9bf5b2d9fd00d568@CO2PR05MB636.namprd05.prod.outlook.com> <975D55AB-0489-4CA7-B690-0A7A45EF5588@gmail.com> <d90b4ab22b0b40a4ac912bd214e96a8e@CO2PR05MB636.namprd05.prod.outlook.com>
Mime-Version: 1.0 (1.0)
In-Reply-To: <d90b4ab22b0b40a4ac912bd214e96a8e@CO2PR05MB636.namprd05.prod.outlook.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Message-Id: <006D3CFC-E8D9-4592-B753-C0456A4E18A9@gmail.com>
X-Mailer: iPod touch Mail (11D201)
From: Damien Saucez <damien.saucez@gmail.com>
Date: Wed, 21 May 2014 19:25:09 +0200
To: Ross Callon <rcallon@juniper.net>
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/9-aDioXootgbqsDVxMHARF8NND4
Cc: LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 21 May 2014 17:25:24 -0000

For me the wg is working on "LISP for improving Internet routing=20
scalability. " not lisp to improve security.=20

There are threats of course and they are listed in the document. Actually ex=
cept the on path attacks all the points you discuss are variations of the ge=
neral categories and vectors listed in the document. So that unless you can g=
ive one case not covered by the document, I don't see the need to argue. =20=


Regarding on-path attacks the risk is at least as high on today's Internet a=
nd is for me out of the scope of the draft. Nevertheless, the draft does not=
 say that the problem does not exist it just says that it is not a problem s=
pecific to lisp. Nothing precludes to fix the problem and we can even use th=
e draft to justify the necessity to solve the problem! Also it is worth to n=
otice that what you consider as off path attack is already covered in the do=
cument as it is a particular instance of subversion attack (see sec 5.3) whe=
re the sensitive information the attacker gains access is the packet itself a=
nd that can be achieved with vectors listed in 5.3.2.=20

I would like to have the feedback from the list to know if really there is a=
 problem with section 2.=20


Thank you,=20
Damien Saucez
Ps: happy holidays :)

> On 21 May 2014, at 18:45, Ross Callon <rcallon@juniper.net> wrote:
>=20
> To get the charter to say "fix these security holes" we need to know what t=
he security holes are. The point of the threats document is to understand wh=
at threats are there, not to limit ourselves to only discuss threats that we=
 are already chartered to fix. I am pretty sure that a thorough and complete=
 threats document is in the charter.
>=20
> There were multiple items in my original comments that point to places whe=
re LISP makes security worse than what we have today in the current Internet=
. I could point these out again in my detailed reply to your email (which mi=
ght take me a couple of work days to complete, and I am off on Friday and fo=
r the long weekend).=20
>=20
> Thanks, Ross
>=20
> -----Original Message-----
> From: Damien Saucez [mailto:damien.saucez@gmail.com]=20
> Sent: Wednesday, May 21, 2014 11:41 AM
> To: Ross Callon
> Cc: Joel M. Halpern; LISP mailing list list; Luigi Iannone
> Subject: Re: [lisp] Restarting last call on LISP threats
>=20
> Hello,
>=20
> I fully agree with your argument that security breach could have impact at=
 large scale.=20
>=20
> However we have to consider this document at the light of what is in the c=
harter. As a matter of fact the charter states lisp as a mean to make the in=
ternet more scalable. =46rom that point if view I think lisp is very well de=
signed. =46rom this angle, the document only aim to show if the proposition m=
akes security worst, same, or better than the system lisp is supposed to rep=
lace: the legacy internet. For that I think the document is complete as it f=
ocuses on what are the risks introduced by the new architecture, ignoring pr=
oblems that are not lisp specific.=20
>=20
> Despite this, we see many activities around high security features leverag=
ing lisp. Unfortunately these propositions are still out if the scope if the=
 charter as security improvement is not part if current charter. For these p=
roposition to become part of lisp we first have to finish what the charter i=
s asking us. Then we will be able to discuss whether or not we want lisp to b=
e also a solution for security issues currently in the internet.
>=20
> Thank you,
>=20
> Damien Saucez=20
>> On 21 May 2014, at 17:16, Ross Callon <rcallon@juniper.net> wrote:
>>=20
>> I will respond to your email in detail (in a separate email), but I also=20=

>> have one higher level meta-comment which is important which I think that=20=

>> we should discuss first.=20
>>=20
>> Specifically, we need to remember what LISP is proposed to do. LISP=20
>> has been proposed as a new routing and addressing architecture for the=20=

>> Internet. If we believe this goal is realistic, and if we believe that=20=

>> LISP could actually end up being deployed as the routing and addressing=20=

>> architecture for the Internet, then the Internet could someday be entirel=
y=20
>> dependent upon LISP actually working and actually being secure when=20
>> deployed at scale.=20
>>=20
>> The Internet has been described as the control plane for the world. The=20=

>> Internet is of enormous importance for the world's economy (and all of=20=

>> our jobs, and millions of others). IT HAS TO WORK.
>>=20
>> As such, any attack that might have the potential of disrupting the=20
>> operation of LISP, or that can be made worse by LISP, MUST be taken=20
>> seriously. If you declare some attacks as "outside of the scope of=20
>> LISP threats document" then either you are saying that the LISP WG is=20
>> not serious about widespread deployment of LISP, or you are putting the=20=

>> world's economy at risk.=20
>>=20
>> If there are any threats which is likely to be waged against the operatio=
n=20
>> of LISP, then it is not acceptable to declare these threats as out of sco=
pe,
>> unless we are also going to agree that LISP must not be deployed on a wid=
e
>> scale. As such, as currently written the threats document is not ready fo=
r
>> publication.=20
>>=20
>> Sincerely,=20
>> Ross
>>=20
>> -----Original Message-----
>> From: Damien Saucez [mailto:damien.saucez@gmail.com]=20
>> Sent: Monday, May 19, 2014 6:26 PM
>> To: Ross Callon
>> Cc: Joel M. Halpern; LISP mailing list list; Luigi Iannone
>> Subject: Re: [lisp] Restarting last call on LISP threats
>>=20
>> Dear Ross,
>>=20
>> Thank you for your time.
>>=20
>> Before detailed comments below, we have to remind that the objective
>> of this document is to identify global threats potentially introduced
>> by LISP w.r.t.  what exists today in the legacy Internet.  The problem
>> space is out of the scope of the document.
>>=20
>> comments inline.
>>=20
>>> On 12 May 2014, at 19:11, Ross Callon <rcallon@juniper.net> wrote:
>>>=20
>>> Thanks Joel;
>>>=20
>>> I think that draft-ietf-lisp-threats-09.txt is a start towards a threats=
 document, but that it has serious omissions and needs more work before bein=
g progressed. Here are some specific comments:=20
>>>=20
>>>=20
>>> Section 2 (On-path Attackers), first paragraph:=20
>>>=20
>>> On-path attackers are attackers that are able to capture and modify
>>> all the packets exchanged between an Ingress Tunnel Router (ITR) and
>>> an Egress Tunnel Router (ETR).  To cope with such an attacker,
>>> cryptographic techniques such as those used by IPSec ([RFC4301]) are
>>> required.  As with IP, LISP relies on higher layer cryptography to
>>> secure packet payloads from on path attacks, so this document does
>>> not consider on-path attackers.
>>>=20
>>> To me an on-path attacker is one which is on the data path. Such an atta=
cker might attack the contents of the data packet. In this case the paragrap=
h seems mostly correct to me: You encrypt the contents if you don't want som=
eone on the path to the destination to look at the contents. However, as is d=
iscussed later in the document, LISP allows systems which are not in the nor=
mal physical path, through a gleaning attack, to inject themselves into the d=
ata path. This could be applied to allow attacker's systems to inject themse=
lves into the path of the key management protocol. This implies that a legit=
imate user could get keys supplied by an attacker, just as easily as it coul=
d get keys supplied by a legitimate Internet site. If you are proposing that=
 end to end encryption is the solution to on path attackers then you need to=
 understand the implications of LISP on the operation of the protocol needed=
 for key management to support end to end encryption.
>>=20
>> The paragraph you are citing end with this document does _not_
>> consider on-path attackers..  While you remarks are generally valuable
>> they do not apply here, the document is not proposing anything, it i
>> just stating what is _not_ considered.
>>=20
>>=20
>>=20
>>=20
>>>=20
>>> Also, you should mention in this section that a gleaning attack would al=
low at least in the short term for an attacker to become temporarily on-path=
 even if they are not on what should be the normal path to the destination.
>> The definition we give about on-path attacker includes your
>> sub-category.  It does not matter where you attacker physically is.
>> If it is able to capture and modify packets then it is on-path (does
>> not matter if physical shorter or not).
>>=20
>>=20
>>> An on-path attacker might choose to only change something about the LISP=
 handling details, such as exploding the map cache or redirecting a user to a=
 different site. Some of this is mentioned later in the document. One thing t=
hat is not mentioned: Suppose that the encapsulated packet is encrypted. The=
 on-path attacker could however see the LISP header, and thus could change t=
he nonce, or add a nonce, or reply to the nonce, change versioning informati=
on,...  Are you proposing that the LISP header be encrypted also? If so, whe=
re is this specified and what does it do to forwarding performance in the xT=
R?
>>=20
>> The document is just an analysis, hence your question, while valid, is
>> outside the scope of this document.
>>>=20
>>> Section 4.3.1, second paragraph, third sentence:=20
>>>=20
>>> This is not different from today's
>>> Internet where a spoofing off-path attacker may inject data packets
>>> in any flow.
>>>=20
>>> In terms of injecting traffic that the end system receives and acts upon=
, I believe that this sentence is entirely true. However, in terms of the ef=
fect on the router's control plane, and particularly the operation of xTR's,=
 this sentence is not true. Today there is very little that a spoofing attac=
ker that is outside of a particular service provider can do to exercise the c=
ontrol plane of that provider's routers. This is important and intentional (=
see DOS discussion below).
>> The section actually does not enter in any discussion about
>> quantifying the damages.  So the second part of your comment is
>> correct if it does apply to section 4.3.1.
>>=20
>> The first half of your comment is, however, unfounded.  Section 4.3.1
>> is about attacks _not_ leveraging on LISP header, so from this side it
>> is exactly the same case like any other IP spoofed packet.  In
>> particular since LISP header is not used, xTR functions are not
>> actually attacked.
>>=20
>>> Minor nit, next sentence:
>>>=20
>>> A non-spoofing off-path attacker (NSA)...
>>>=20
>>> Given recent events, I think that "NSA" is an unfortunate acronym to use=
 here. How about NSOA?
>>=20
>> This can be fixed before pushing the document to the IESG.
>>=20
>>=20
>>> Section 4.3.1.1 (Gleaning Attacks), last paragraph:
>>>=20
>>> By itself, an attack made solely using gleaning cannot last long,
>>> however it should be noted that with current network capacities, a
>>> large amount of packets might be exchanged during even a small
>>> fraction of time.
>>>=20
>>> The amount of damage that might be caused by this may depend upon what h=
appens to be exchanged in that "short amount of time". For example, the init=
ial handshake between sites (at the application layer) could include sign in=
 information (account names and passwords), on the basis that this is the so=
rt of information that needs to be exchanged at the beginning of, for exampl=
e, financial transactions. My understanding is that for Internet commerce, i=
t is normal for users to be redirected to a different site to enter credit c=
ard information. This appears to constitute a "new session" (or at least may=
 be to an entirely different location) and therefore the entire credit card e=
xchange could occur in a small period of time. I think it would be worth men=
tioning here that the sensitivity of the information that could be exchanged=
 during this "short amount of time" is not known, and could potentially be s=
erious.
>>=20
>> Exchanging critical information (e.g.  password) in clear means that
>> you have a serious problem, but not at the network layer.  Also, the
>> situation with LISP would not be worse than without LISP.
>>=20
>>>=20
>>> Also, depending upon how long xTR's are willing to store gleaned informa=
tion (before the map request comes back), the time that a user is misdirecte=
d due to a gleaning attack might be extended by coordinating a DDOS attack w=
ith the gleaning attack. For example, an attacker may send packets to a very=
 large number of sites, with a source EID which is from a major stock broker=
 or bank and an RLOC from the attacker's captive servers. The many sites gle=
an the EID to RLOC mapping from the arriving packets. Each pretty much simul=
taneously initiates an EID lookup (to verify the EID to RLOC mapping). This c=
reates a DOS attack on the control plane of the mapping function supporting t=
hat stock broker or bank. This implies that the responses are going to be de=
layed (and could be greatly delayed), which allows the incorrect mappings to=
 last longer than they otherwise would. This allows any systems that actuall=
y happen to be trying to connect to that stock or banking site to be redirec=
ted to the a
>>> ttacker's site. The attacker then becomes a man in the middle and can fo=
r example can obtain the password and account information for users. =20
>>=20
>> Such a scenario would require a lot of synchronisation.  Anyway, our
>> opinion is that the current text is stating exactly the same thing you
>> describe just in a succinct way.
>>=20
>> As a reminder, the present document studies LISP in a public network
>> deployment.
>>=20
>>=20
>>=20
>>> Last paragraph of section 4.3.2.2:=20
>>>=20
>>> If the size of the Map-Request
>>> message is larger than the size of the smallest LISP-encapsulated
>>> packet that could trigger such a message, this could lead to
>>> amplification attacks (see Section 4.4.1) so that more bandwidth is
>>> consumed on the target than the bandwidth necessary at the attacker
>>> side.
>>>=20
>>> The size of the packet is not the only issue. If the amount of processin=
g required to send a map-request and deal with the reply is greater than the=
 amount of processing that is required to send a packet that triggers such a=
 request, then this could also result in an amplification attack. In princip=
le it would seem that sending out a large number of packets to trigger such a=
 request would be relatively straightforward (for example the attacker might=
 be sending out many packets only incrementing the EID in order to attack th=
e ITR that will need to generate many map requests). We may note that for ma=
ny systems, particularly very high speed routers (which might exist for exam=
ple as PE routers connecting very large enterprise customers), the control p=
lane may be several orders of magnitude slower than the data plane, so that a=
n attack that requires response from the router's control plane would be muc=
h more serious than an attack of the same size that can be handled in the da=
ta plane. I=20
>>> will say more about this in my comments below regarding DOS attacks.
>>=20
>> Your first point can be easily fixed by substituting the word
>> bandwidth with bandwidth and/or processing or "resource"
>>=20
>> Your statement on the speed difference between control and data plane
>> is true and is a general observation not limited to LISP.  Note that
>> one of the advantages of having the Map-Server/Map-Resolver elements
>> in the LISPa architecture is exactly to avoid situations you are
>> describing.
>>=20
>>> Section 4.3.2.3, third paragraph (right after the bullets):=20
>>>=20
>>> The first type of packet should not cause any major problem to ITRs.
>>> As the reachability test uses a 24 bits nonce, it is unlikely that an
>>> off-path attacker could send a single packet that causes an ITR to
>>> believe that the ETR it is testing is reachable while in reality it
>>> is not reachable.  To increase the success likelihood of such attack,
>>> the attacker should create a massive amount of packets carrying all
>>> possible nonce values.
>>>=20
>>> However, this could be a problem if there are on-path attackers, since t=
hey will see the nonce. They could insert nonce's where none are present, re=
quiring a response from the ETR. Given that the control plane of very high s=
peed PE routers may be much slower than the data plane, this could cause a r=
elatively moderate data stream that the data plane or the PE could easily ha=
ndle to turn into a control plane attack that the control plane of a PE rout=
er could not handle. Also, the on-path attacker could see the nonce's and re=
spond "correctly" (or in a way that the ITR that sent the nonce *thinks* is c=
orrect), thereby "verifying" connectivity when none is present. You dismisse=
d on-path attacks earlier in the document on the basis that the user data co=
uld be encrypted, but these are examples of on-path attacks that would be on=
 the LISP header and operation, and not on the user data.
>>=20
>> It is clearly stated at the beginning of the document that on-path
>> attacks are out of the scope of the document.  Also, Sec.  2 does not
>> limit cryptography technique to the payload, actually section 2 makes
>> the distinction saying:
>>=20
>> 1)
>> "To cope with such an attacker, cryptographic techniques such as
>> those used by IPSec ([RFC4301 ]) are required."
>>=20
>> which is reported to any form of packet manipulation
>>=20
>> and 2)
>> "As with IP, LISP relies on higher layer cryptography to secure packet
>> payloads from on path attacks, so this document does not consider
>> on-path attackers."
>>=20
>> which is related to attacks targeting the payload.
>>=20
>>=20
>>>=20
>>>=20
>>> Section 5.2 (Denial of Service):
>>>=20
>>> You need to mention here the relative difference in speed between the da=
ta plane and the control plane of high speed routers. For example, there are=
 plenty of examples currently widely deployed of routers which can handle a f=
ew terabits of data in the data plane. These routers might typically have gi=
gabit Ethernet links to the control processor, but I doubt that any of them c=
ould handle Map-Requests coming in at line rate at a gigabit. Thus the ratio=
 between the speed of the control plane the speed of the data plane is signi=
ficantly greater than 1000. I understand that many PE routers have slower da=
ta planes (and the CE "wireless router" that sits in each of our homes is of=
 course a lot slower than this), but large data centers or large enterprise s=
ites could very well be connected to their service provider via a few very h=
igh speed PE routers. Therefore an attack that would be trivial to handle in=
 the data plane (say, a few gigabits) could overwhelm the control plane.
>>=20
>> You are absolutely right, but why this is specific to LISP?  It is not
>> specific to LISP, so there is no reason to discuss such an issue in
>> this document.
>>=20
>>> Gleaning allows incoming packets to create map requests, which allows a d=
ata plane attack to turn into a control plane attack. Given the difference i=
n speeds between the data plane and the control plane, this makes it much ea=
sier to create an effective DOS attack.
>>=20
>> RFC6830 already considered rate limiting fo this very reason.
>>=20
>>>=20
>>> Section 8 (Security Considerations).=20
>>>=20
>>> I am pleased that you removed the sentence from section 1 of the previou=
s (-08) draft that read: "As a result of  the performed analysis, the docume=
nt discusses the severity of the threats and proposes recommendations to rea=
ch the same level of security in LISP than in Internet today (e.g., without L=
ISP)". This sentence was not actually correct. However, in looking through t=
he document and in thinking about the implications (see the rest of this ema=
il) it is quite clear that the security of an Internet using LISP would be s=
ignificantly less than the current Internet (at least if you assume that the=
re is *any* security at all in the current Internet). I am thinking that the=
re should be a sentence at the end of section 8 to the effect that "At the c=
urrent time it appears that LISP would have significant security implication=
s if deployed on an Internet-wide scale".
>>=20
>>=20
>> Such sentence would not represent the discussions that took place in
>> the LISP WG in the last four years.
>>=20
>> The arguments that you raised in the previous part of this mail are
>> mainly not LISP-specific, while the experience gathered in the last
>> years show that LISP is not worst that what we have today (and
>> actually research work out there shows that it can even be helpful to
>> use LISP)
>>=20
>>=20
>>> Finally, two items left out:
>>>=20
>>> I don't see any discussion on the effect of LISP on firewalls. I am assu=
ming that pretty much all currently deployed firewalls are not able to look p=
ast a LISP header to inspect the contents of packets. At a minimum, this wou=
ld seem to imply that LISP will need to be deployed toward the Internet core=
 from the current firewalls, so that the firewalls can be looking at normal (=
unchanged) IP packets.
>>=20
>> Deployment model is out of the scope of this document and the problem
>> is not specific to LISP.
>>=20
>>=20
>>> There is another issue which might belong in the section on privacy: In t=
he Internet today if you want to attack a network with prefix aa.bb/16, and y=
ou see this advertisement in the BGP routes, you can pick a random address a=
nd send a packet and see if anything happens. You get little feedback. With L=
ISP you can send a map request to a random address in the block and get back=
 a map reply. This gives you an RLOC which is in general the actual IP addre=
ss of a real PE or CE router. Of course you can repeat this across the entir=
e /16, or even the Internet (given sufficient time and traffic), and get som=
ething close to a complete list of LISP xTRs. This implies that if service p=
roviders implement LISP on PE routers, then they will be exposing the identi=
ty of their PE routers to worldwide inspection. Given the number of PE route=
rs in the world (obviously much larger than the number of service providers,=
 and given PA address aggregation probably larger than the number of routes t=
hat show u
>>> p in the BGP routing table) we should expect that there are lots of PE r=
outers that have not been carefully secured, and exposing their existence to=
 open worldwide easy discovery would likely open the door to a number of att=
acks that involve compromise of PE routers. Of course if LISP is deployed on=
 CE routers then their RLOC would similarly be exposed.
>>=20
>> If routers are not correctly secured, there is no problem linked to
>> LISP as today it is already possible to discover the IP address of
>> theses routers thanks to various techniques.  Moreover, section 6
>> already clearly states that privacy is not discussed in the document
>> but that the attacks presented in the document can potentially play a
>> role in privacy threats.
>>=20
>> Regards,
>>=20
>> The authors of the threats document.
>>=20
>>=20
>>> Thanks, Ross
>>>=20
>>> -----Original Message-----
>>> From: lisp [mailto:lisp-bounces@ietf.org] On Behalf Of Joel M. Halpern
>>> Sent: Friday, May 09, 2014 11:54 AM
>>> To: lisp@ietf.org
>>> Subject: [lisp] Restarting last call on LISP threats
>>>=20
>>> Sorry for the delay getting this out.
>>> This email starts a new (and hopefully final) last call on=20
>>> draft-ietf-lisp-threats, version 9:
>>> http://datatracker.ietf.org/doc/draft-ietf-lisp-threats/
>>>=20
>>> The last call will end in two weeks, close of business 23-May-2014.
>>>=20
>>> Thank you,
>>> Joel
>>>=20
>>> _______________________________________________
>>> lisp mailing list
>>> lisp@ietf.org
>>> https://www.ietf.org/mailman/listinfo/lisp
>>>=20
>>> _______________________________________________
>>> lisp mailing list
>>> lisp@ietf.org
>>> https://www.ietf.org/mailman/listinfo/lisp
>>=20


From nobody Wed May 21 10:41:44 2014
Return-Path: <rbonica@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A83B01A00E9 for <lisp@ietfa.amsl.com>; Wed, 21 May 2014 10:41:43 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.902
X-Spam-Level: 
X-Spam-Status: No, score=-101.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id df-Aw-egJUNk for <lisp@ietfa.amsl.com>; Wed, 21 May 2014 10:41:39 -0700 (PDT)
Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1blp0185.outbound.protection.outlook.com [207.46.163.185]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A11C11A0379 for <lisp@ietf.org>; Wed, 21 May 2014 10:41:38 -0700 (PDT)
Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB443.namprd05.prod.outlook.com (10.141.73.152) with Microsoft SMTP Server (TLS) id 15.0.944.11; Wed, 21 May 2014 17:41:35 +0000
Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) with mapi id 15.00.0944.000; Wed, 21 May 2014 17:41:35 +0000
From: Ronald Bonica <rbonica@juniper.net>
To: Dino Farinacci <farinacci@gmail.com>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEIABfmkAgAAJsgCAAEpiAIAEFPjggABC9oCAAx/20A==
Date: Wed, 21 May 2014 17:41:34 +0000
Message-ID: <7053cf2c81534f84975013346c618ca8@CO1PR05MB442.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <8891A030-B462-48D9-83B4-4E42525F38CE@steffann.nl> <F1FD0546-65C0-4288-B017-FDA55454A528@gmail.com> <df8bf1975fe04834bb7887ae38675983@CO1PR05MB442.namprd05.prod.outlook.com> <2D126379-BFF8-45FE-B6E1-B7E5E7FA5A6A@gmail.com>
In-Reply-To: <2D126379-BFF8-45FE-B6E1-B7E5E7FA5A6A@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.12]
x-forefront-prvs: 0218A015FA
x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(13464003)(199002)(189002)(24454002)(377454003)(51704005)(51444003)(46102001)(99396002)(99286001)(85852003)(83072002)(1411001)(15975445006)(33646001)(86362001)(76482001)(92566001)(54356999)(50986999)(76176999)(101416001)(66066001)(74316001)(64706001)(79102001)(74662001)(80022001)(19580405001)(19580395003)(2656002)(15202345003)(76576001)(15188155005)(87936001)(77982001)(74502001)(20776003)(81542001)(81342001)(31966008)(21056001)(4396001)(16799955002)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO1PR05MB443; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; 
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/9Bznd_KEfg5g-t2_jN7O5Vk1YSU
Cc: Roger Jorgensen <rogerj@gmail.com>, "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 21 May 2014 17:41:43 -0000

Dino,

Aren't we talking about a scenario where the victim XTR has no information =
regarding the EID or LOC in its map-cache?

                                    Ron

> -----Original Message-----
> From: Dino Farinacci [mailto:farinacci@gmail.com]
> Sent: Monday, May 19, 2014 1:57 PM
> To: Ronald Bonica
> Cc: Sander Steffann; Roger Jorgensen; lisp@ietf.org
> Subject: Re: [lisp] Restarting last call on LISP threats
>=20
> In those cases we do mapping database RPF lookups.
>=20
> Dino
>=20
>=20
>=20
> > On May 19, 2014, at 10:14 AM, Ronald Bonica <rbonica@juniper.net>
> wrote:
> >
> > Dino,
> >
> > The Spoofer Project (http://spoofer.cmand.org/summary.php) offers a
> longitudinal view of BCP 38 deployment. I think that the results that the=
y
> report validate Sander's objection. Furthermore, they may suggest that
> Sander's objection will remain valid for years to come.
> >
> >
> > Ron
> >
> >
> >> -----Original Message-----
> >> From: Dino Farinacci [mailto:farinacci@gmail.com]
> >> Sent: Friday, May 16, 2014 7:37 PM
> >> To: Sander Steffann
> >> Cc: Ronald Bonica; Roger Jorgensen; lisp@ietf.org
> >> Subject: Re: [lisp] Restarting last call on LISP threats
> >>
> >>> Unfortunately this is not unlikely :(  I certainly wouldn't consider
> >>> it an
> >> amazing feat... BCP38 is not implemented as much as it should be.
> >>
> >> I know there are many cases where BCP38 is not practice but more and
> >> more access providers due uRPF.
> >>
> >> You only need one in the path. And the ones that don't do it are
> >> using resources to transit packets to possible black holes.
> >>
> >> Dino


From nobody Wed May 21 15:57:47 2014
Return-Path: <farinacci@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 270F61A00B1 for <lisp@ietfa.amsl.com>; Wed, 21 May 2014 15:57:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level: 
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9,  DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id paYqjWCT94w9 for <lisp@ietfa.amsl.com>; Wed, 21 May 2014 15:57:44 -0700 (PDT)
Received: from mail-qg0-x22e.google.com (mail-qg0-x22e.google.com [IPv6:2607:f8b0:400d:c04::22e]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 610821A03C7 for <lisp@ietf.org>; Wed, 21 May 2014 15:57:44 -0700 (PDT)
Received: by mail-qg0-f46.google.com with SMTP id q108so4228289qgd.19 for <lisp@ietf.org>; Wed, 21 May 2014 15:57:43 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=7Y+M/WmdWJH+Uewl9JIhtT4J4va2kOSI5DrDWLA10OY=; b=e85p5tMY05/jBrIfip7A99AxDe6rPd22D90IoSN5NMZLyB6Q7swLWsKcRTFGlsCQzp PBHj1FrjBJl6ZyWpNAWcQ1GhMfV9JEBOSyc47F+Tq0nHaiqWzxzyFQnfV2RK/e7aNiJM Cax1Ue5NdfQLfkCkoZPMOy1oHhcRKotfEIlqLDN4m3P4UdfanbCWwVUU6SmNbCYg8Zb1 UrSjnHQHdRCw5uFi/n1SqSZFddWWmtS+ygTj3waLn9jFgzgaro7CHzA8cY+QfwKD5B2V EaVdj7l/iEZBAQJXuKhH/zVuL6pnFrlkvGezc/p9LFXpgd34fO1BdShStMJ0DKZwJEx2 KDLg==
X-Received: by 10.140.97.55 with SMTP id l52mr71106883qge.19.1400713062946; Wed, 21 May 2014 15:57:42 -0700 (PDT)
Received: from [10.77.0.78] (mobile-198-228-204-213.mycingular.net. [198.228.204.213]) by mx.google.com with ESMTPSA id r14sm1564074qga.4.2014.05.21.15.57.41 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 21 May 2014 15:57:41 -0700 (PDT)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (1.0)
From: Dino Farinacci <farinacci@gmail.com>
X-Mailer: iPhone Mail (11D167)
In-Reply-To: <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com>
Date: Wed, 21 May 2014 18:57:41 -0400
Content-Transfer-Encoding: quoted-printable
Message-Id: <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com>
To: Ronald Bonica <rbonica@juniper.net>
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/HJubi05yrCogC98o3_96e8KspOw
Cc: Roger Jorgensen <rogerj@gmail.com>, "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 21 May 2014 22:57:46 -0000

> The attacker sends a flow of crafted packets to the victim XTR. Each packe=
t is a well-formed LISP data packet. It contains:
>=20
> - an outer IP header (LOC->LOC)
> - a UDP header
> - a LISP Header
> - an IP header (EID->EID)
> - payload

Just like a regular packet I can send to your home router today. So yes okay=
. So let's continue. See comments below.=20

> Each packet contains control plane information that is new to the victim

Be more specific about what control information are in these encapsulated pa=
ckets.=20

> XTR. For example, the victim XTR has no mapping information regarding eith=
er the source LOC or source EID prefix. Rather than gleaning this mapping in=
formation from the crafted packet, the victim XTR sends a verifying MAP-REQU=
EST to the mapping system.
>=20
> Assume that the attack flow is large (N packets per second). Assume also t=
hat the XTRs rate limit for MAP-REQUEST messages is less than N packets per s=
econd. Has the attack not effectively DoS'd the victim XTR?

It caches the rate the rate the packets are coming in and eventually stops s=
ending Map-Requests completely.=20

It cannot stop the incoming rate of packets today just like a roque BGP atta=
cker can send millions of packets per second to a peer regardless if it does=
 or does not have the peer authentication key.=20

> To make this attack work, every packet in the attack flow may need to have=
 a unique, spoofed, source LOC.

An implementation can detect that after rate limiting 1000s of such requests=
 are happening that it just stops operation.=20

What if I sent a Juniper 20 million routes today?

The Internet is very fragile and LISP IS NOT making it worse. And in some ca=
ses it is making it better with integrated techniques.=20

Dino=


From nobody Thu May 22 13:57:24 2014
Return-Path: <rbonica@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B6D491A0305 for <lisp@ietfa.amsl.com>; Thu, 22 May 2014 13:57:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.902
X-Spam-Level: 
X-Spam-Status: No, score=-101.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r4cF_mHFgMAj for <lisp@ietfa.amsl.com>; Thu, 22 May 2014 13:57:20 -0700 (PDT)
Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0141.outbound.protection.outlook.com [207.46.163.141]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 385CE1A02A9 for <lisp@ietf.org>; Thu, 22 May 2014 13:57:20 -0700 (PDT)
Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB443.namprd05.prod.outlook.com (10.141.73.152) with Microsoft SMTP Server (TLS) id 15.0.944.11; Thu, 22 May 2014 20:57:16 +0000
Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.206]) with mapi id 15.00.0944.000; Thu, 22 May 2014 20:57:15 +0000
From: Ronald Bonica <rbonica@juniper.net>
To: Dino Farinacci <farinacci@gmail.com>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEIABfmkAgAefyVCAAITngIABbBJg
Date: Thu, 22 May 2014 20:57:15 +0000
Message-ID: <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com>
In-Reply-To: <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.16]
x-forefront-prvs: 021975AE46
x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(51704005)(13464003)(199002)(189002)(377454003)(76576001)(87936001)(74502001)(77982001)(21056001)(19580395003)(19580405001)(83322001)(2656002)(4396001)(31966008)(81342001)(20776003)(81542001)(74662001)(80022001)(86362001)(92566001)(76482001)(85852003)(1411001)(83072002)(46102001)(33646001)(99396002)(101416001)(79102001)(64706001)(66066001)(74316001)(54356999)(50986999)(76176999)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO1PR05MB443; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; 
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/iFvMDZ_qtzNeAmyzxLwOrD5MJIQ
Cc: Roger Jorgensen <rogerj@gmail.com>, "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 22 May 2014 20:57:22 -0000

Dino,

Today's Internet is not as fragile as you think. This mail traversed many r=
outers between my house and yours. If those routers are well-managed, there=
 is nothing that I can do from my house that will cause any of those router=
s to consume control plane resources. Therefore, there is nothing that I ca=
n do from my house that will cause a DoS attack against those routers' cont=
rol planes.

In LISP, separation between the forwarding and control plane is lost. As a =
matter of course, forwarding plane activity causes control plane activity. =
Since forwarding plane bandwidth exceeds control plane bandwidth, DoS attac=
ks against the control plane are possible.

In order to be complete, the threats document must describe the DoS threat.=
 It should also describe mitigations, if any exist.

                                                                           =
                    Ron


> -----Original Message-----
> From: Dino Farinacci [mailto:farinacci@gmail.com]
> Sent: Wednesday, May 21, 2014 6:58 PM
> To: Ronald Bonica
> Cc: Roger Jorgensen; lisp@ietf.org
> Subject: Re: [lisp] Restarting last call on LISP threats
>=20
> > The attacker sends a flow of crafted packets to the victim XTR. Each pa=
cket
> is a well-formed LISP data packet. It contains:
> >
> > - an outer IP header (LOC->LOC)
> > - a UDP header
> > - a LISP Header
> > - an IP header (EID->EID)
> > - payload
>=20
> Just like a regular packet I can send to your home router today. So yes o=
kay.
> So let's continue. See comments below.
>=20
> > Each packet contains control plane information that is new to the victi=
m
>=20
> Be more specific about what control information are in these encapsulated
> packets.
>=20
> > XTR. For example, the victim XTR has no mapping information regarding
> either the source LOC or source EID prefix. Rather than gleaning this map=
ping
> information from the crafted packet, the victim XTR sends a verifying MAP=
-
> REQUEST to the mapping system.
> >
> > Assume that the attack flow is large (N packets per second). Assume als=
o
> that the XTRs rate limit for MAP-REQUEST messages is less than N packets
> per second. Has the attack not effectively DoS'd the victim XTR?
>=20
> It caches the rate the rate the packets are coming in and eventually stop=
s
> sending Map-Requests completely.
>=20
> It cannot stop the incoming rate of packets today just like a roque BGP
> attacker can send millions of packets per second to a peer regardless if =
it
> does or does not have the peer authentication key.
>=20
> > To make this attack work, every packet in the attack flow may need to h=
ave
> a unique, spoofed, source LOC.
>=20
> An implementation can detect that after rate limiting 1000s of such reque=
sts
> are happening that it just stops operation.
>=20
> What if I sent a Juniper 20 million routes today?
>=20
> The Internet is very fragile and LISP IS NOT making it worse. And in some
> cases it is making it better with integrated techniques.
>=20
> Dino


From nobody Thu May 22 15:50:18 2014
Return-Path: <jmh@joelhalpern.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D1BC1A0270 for <lisp@ietfa.amsl.com>; Thu, 22 May 2014 15:50:13 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Level: 
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JdcEK0nZobLR for <lisp@ietfa.amsl.com>; Thu, 22 May 2014 15:50:11 -0700 (PDT)
Received: from mailc2.tigertech.net (mailc2.tigertech.net [208.80.4.156]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5E9561A029C for <lisp@ietf.org>; Thu, 22 May 2014 15:50:11 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mailc2.tigertech.net (Postfix) with ESMTP id 0965B4374C for <lisp@ietf.org>; Thu, 22 May 2014 15:50:10 -0700 (PDT)
X-Virus-Scanned: Debian amavisd-new at c2.tigertech.net
Received: from Joels-MacBook-Pro.local (unknown [129.192.170.160]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mailc2.tigertech.net (Postfix) with ESMTPSA id DFF9B4373C for <lisp@ietf.org>; Thu, 22 May 2014 15:50:09 -0700 (PDT)
Message-ID: <537E7F21.6070206@joelhalpern.com>
Date: Thu, 22 May 2014 18:50:09 -0400
From: "Joel M. Halpern" <jmh@joelhalpern.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.5.0
MIME-Version: 1.0
To: "lisp@ietf.org" <lisp@ietf.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/gBwJj67FPirgXZCrBOCdWGVs9_A
Subject: Re: [lisp] https://datatracker.ietf.org/doc/draft-ietf-lisp-eid-block/
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 22 May 2014 22:50:13 -0000

Having been reminded by my co-chair that the WG LC ended many weeks ago...

The chairs determination is that this document received sufficient WG 
support, and seeing no objections the shepherd will begin the writeup 
process for delivery to the AD.

Authors, please confirm to the list (and thus the shepherd) that all 
relevant IPR you know of has been disclosed (or conversely that you do 
not know of any relevant IPR that has not been disclosed.)

Thank you,
Joel


From nobody Fri May 23 06:06:53 2014
Return-Path: <damien.saucez@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8AFD01A01CD for <lisp@ietfa.amsl.com>; Fri, 23 May 2014 06:06:41 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.649
X-Spam-Level: 
X-Spam-Status: No, score=-1.649 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HELO_EQ_FR=0.35, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PCHwzTlXU2ak for <lisp@ietfa.amsl.com>; Fri, 23 May 2014 06:06:40 -0700 (PDT)
Received: from mail-wi0-x22d.google.com (mail-wi0-x22d.google.com [IPv6:2a00:1450:400c:c05::22d]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 868DD1A0484 for <lisp@ietf.org>; Fri, 23 May 2014 06:06:39 -0700 (PDT)
Received: by mail-wi0-f173.google.com with SMTP id bs8so804996wib.12 for <lisp@ietf.org>; Fri, 23 May 2014 06:06:36 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=content-type:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=4YdRuRKN6Drg1ZwWtnUwSGfYfUEf91aFpHNkOY4UXok=; b=ST1u918IMWo/jNH9czdYP01OkyHtPfMklup3NZnARr1wxK8g0cPqfEX9rpGNtaaMNk xjLd5X95wvwUV3WCgDM4pXEG405UKwMwarSqe07W2vTInhdZ9aODysfHNxVoAc21sall VESxomU6QlMeUdWEF8F+l7hWP0yqjN7Pbe7ty8PqOE3or8yKlVImuLySEOr/Ff1+dBjp eMwKf0SZgxGTIxwfCp9aRcq7EPtKMrATBWz+jc0L4+ZOPVgA4XD0XBh3rrfdIhyxDRDn Xa5Q9MB5N+xqVjAZU9PZ8ph3IzFinGEHErg9dib3rxmb19+IfvxaLpm55Tf8vECxb+bo DUfQ==
X-Received: by 10.194.5.5 with SMTP id o5mr4236320wjo.16.1400850396761; Fri, 23 May 2014 06:06:36 -0700 (PDT)
Received: from faucon.inria.fr (faucon.inria.fr. [138.96.201.73]) by mx.google.com with ESMTPSA id ln3sm3859894wjc.8.2014.05.23.06.06.35 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 23 May 2014 06:06:35 -0700 (PDT)
Content-Type: multipart/alternative; boundary="Apple-Mail=_DE9C606C-A0FF-4BD8-9BBD-9983ACDA443C"
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.2\))
From: Damien Saucez <damien.saucez@gmail.com>
In-Reply-To: <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com>
Date: Fri, 23 May 2014 15:06:34 +0200
Message-Id: <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com>
To: Ronald Bonica <rbonica@juniper.net>
X-Mailer: Apple Mail (2.1878.2)
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/q719iS5HLIl6gIT1dIKzwHWMqUI
Cc: Roger Jorgensen <rogerj@gmail.com>, LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 23 May 2014 13:06:42 -0000

--Apple-Mail=_DE9C606C-A0FF-4BD8-9BBD-9983ACDA443C
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

Hello Ronald,


On 22 May 2014, at 22:57, Ronald Bonica <rbonica@juniper.net> wrote:

> Dino,
>=20
> Today's Internet is not as fragile as you think. This mail traversed =
many routers between my house and yours. If those routers are =
well-managed, there is nothing that I can do from my house that will =
cause any of those routers to consume control plane resources. =
Therefore, there is nothing that I can do from my house that will cause =
a DoS attack against those routers' control planes.
>=20
We tend to disagree with that, for example you have ICMP today...

> In LISP, separation between the forwarding and control plane is lost. =
As a matter of course, forwarding plane activity causes control plane =
activity. Since forwarding plane bandwidth exceeds control plane =
bandwidth, DoS attacks against the control plane are possible.
>=20
> In order to be complete, the threats document must describe the DoS =
threat. It should also describe mitigations, if any exist.
>=20

DoS is already explained and the definition given:

" A Denial of Service (DoS) attack aims at disrupting a specific
   targeted service either by exhausting the resources of the victim up
   to the point that it is not able to provide a reliable service to
   legit traffic and/or systems or by exploiting vulnerabilities to make
   the targeted service unable to operate properly.
"

is covering the case you mention.

Damien Saucez=20

>                                                                        =
                       Ron
>=20
>=20
>> -----Original Message-----
>> From: Dino Farinacci [mailto:farinacci@gmail.com]
>> Sent: Wednesday, May 21, 2014 6:58 PM
>> To: Ronald Bonica
>> Cc: Roger Jorgensen; lisp@ietf.org
>> Subject: Re: [lisp] Restarting last call on LISP threats
>>=20
>>> The attacker sends a flow of crafted packets to the victim XTR. Each =
packet
>> is a well-formed LISP data packet. It contains:
>>>=20
>>> - an outer IP header (LOC->LOC)
>>> - a UDP header
>>> - a LISP Header
>>> - an IP header (EID->EID)
>>> - payload
>>=20
>> Just like a regular packet I can send to your home router today. So =
yes okay.
>> So let's continue. See comments below.
>>=20
>>> Each packet contains control plane information that is new to the =
victim
>>=20
>> Be more specific about what control information are in these =
encapsulated
>> packets.
>>=20
>>> XTR. For example, the victim XTR has no mapping information =
regarding
>> either the source LOC or source EID prefix. Rather than gleaning this =
mapping
>> information from the crafted packet, the victim XTR sends a verifying =
MAP-
>> REQUEST to the mapping system.
>>>=20
>>> Assume that the attack flow is large (N packets per second). Assume =
also
>> that the XTRs rate limit for MAP-REQUEST messages is less than N =
packets
>> per second. Has the attack not effectively DoS'd the victim XTR?
>>=20
>> It caches the rate the rate the packets are coming in and eventually =
stops
>> sending Map-Requests completely.
>>=20
>> It cannot stop the incoming rate of packets today just like a roque =
BGP
>> attacker can send millions of packets per second to a peer regardless =
if it
>> does or does not have the peer authentication key.
>>=20
>>> To make this attack work, every packet in the attack flow may need =
to have
>> a unique, spoofed, source LOC.
>>=20
>> An implementation can detect that after rate limiting 1000s of such =
requests
>> are happening that it just stops operation.
>>=20
>> What if I sent a Juniper 20 million routes today?
>>=20
>> The Internet is very fragile and LISP IS NOT making it worse. And in =
some
>> cases it is making it better with integrated techniques.
>>=20
>> Dino
>=20
> _______________________________________________
> lisp mailing list
> lisp@ietf.org
> https://www.ietf.org/mailman/listinfo/lisp


--Apple-Mail=_DE9C606C-A0FF-4BD8-9BBD-9983ACDA443C
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=us-ascii

<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html =
charset=3Dus-ascii"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Hello =
Ronald,<div><br></div><div><br><div><div>On 22 May 2014, at 22:57, =
Ronald Bonica &lt;<a =
href=3D"mailto:rbonica@juniper.net">rbonica@juniper.net</a>&gt; =
wrote:</div><br class=3D"Apple-interchange-newline"><blockquote =
type=3D"cite">Dino,<br><br>Today's Internet is not as fragile as you =
think. This mail traversed many routers between my house and yours. If =
those routers are well-managed, there is nothing that I can do from my =
house that will cause any of those routers to consume control plane =
resources. Therefore, there is nothing that I can do from my house that =
will cause a DoS attack against those routers' control =
planes.<br><br></blockquote><div>We tend to disagree with that, for =
example you have ICMP today...</div><br><blockquote type=3D"cite">In =
LISP, separation between the forwarding and control plane is lost. As a =
matter of course, forwarding plane activity causes control plane =
activity. Since forwarding plane bandwidth exceeds control plane =
bandwidth, DoS attacks against the control plane are possible.<br><br>In =
order to be complete, the threats document must describe the DoS threat. =
It should also describe mitigations, if any =
exist.<br><br></blockquote><div><br></div><div>DoS is already explained =
and the definition given:</div><div><br></div><div>"<span =
style=3D"font-size: 1em;"> A Denial of Service (DoS) attack aims at =
disrupting a specific</span></div><pre class=3D"newpage" =
style=3D"font-size: 1em; margin-top: 0px; margin-bottom: 0px; =
page-break-before: always;">   targeted service either by exhausting the =
resources of the victim up
   to the point that it is not able to provide a reliable service to
   legit traffic and/or systems or by exploiting vulnerabilities to make
   the targeted service unable to operate =
properly.</pre><div>"</div><div><br></div><div>is covering the case you =
mention.</div><div><br></div><div>Damien =
Saucez&nbsp;</div><br><blockquote type=3D"cite"> =
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n=
bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n=
bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n=
bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Ron<br><br><br><blockquote =
type=3D"cite">-----Original Message-----<br>From: Dino Farinacci [<a =
href=3D"mailto:farinacci@gmail.com">mailto:farinacci@gmail.com</a>]<br>Sen=
t: Wednesday, May 21, 2014 6:58 PM<br>To: Ronald Bonica<br>Cc: Roger =
Jorgensen; <a href=3D"mailto:lisp@ietf.org">lisp@ietf.org</a><br>Subject: =
Re: [lisp] Restarting last call on LISP threats<br><br><blockquote =
type=3D"cite">The attacker sends a flow of crafted packets to the victim =
XTR. Each packet<br></blockquote>is a well-formed LISP data packet. It =
contains:<br><blockquote type=3D"cite"><br>- an outer IP header =
(LOC-&gt;LOC)<br>- a UDP header<br>- a LISP Header<br>- an IP header =
(EID-&gt;EID)<br>- payload<br></blockquote><br>Just like a regular =
packet I can send to your home router today. So yes okay.<br>So let's =
continue. See comments below.<br><br><blockquote type=3D"cite">Each =
packet contains control plane information that is new to the =
victim<br></blockquote><br>Be more specific about what control =
information are in these encapsulated<br>packets.<br><br><blockquote =
type=3D"cite">XTR. For example, the victim XTR has no mapping =
information regarding<br></blockquote>either the source LOC or source =
EID prefix. Rather than gleaning this mapping<br>information from the =
crafted packet, the victim XTR sends a verifying MAP-<br>REQUEST to the =
mapping system.<br><blockquote type=3D"cite"><br>Assume that the attack =
flow is large (N packets per second). Assume also<br></blockquote>that =
the XTRs rate limit for MAP-REQUEST messages is less than N =
packets<br>per second. Has the attack not effectively DoS'd the victim =
XTR?<br><br>It caches the rate the rate the packets are coming in and =
eventually stops<br>sending Map-Requests completely.<br><br>It cannot =
stop the incoming rate of packets today just like a roque =
BGP<br>attacker can send millions of packets per second to a peer =
regardless if it<br>does or does not have the peer authentication =
key.<br><br><blockquote type=3D"cite">To make this attack work, every =
packet in the attack flow may need to have<br></blockquote>a unique, =
spoofed, source LOC.<br><br>An implementation can detect that after rate =
limiting 1000s of such requests<br>are happening that it just stops =
operation.<br><br>What if I sent a Juniper 20 million routes =
today?<br><br>The Internet is very fragile and LISP IS NOT making it =
worse. And in some<br>cases it is making it better with integrated =
techniques.<br><br>Dino<br></blockquote><br>______________________________=
_________________<br>lisp mailing list<br><a =
href=3D"mailto:lisp@ietf.org">lisp@ietf.org</a><br>https://www.ietf.org/ma=
ilman/listinfo/lisp<br></blockquote></div><br></div></body></html>=

--Apple-Mail=_DE9C606C-A0FF-4BD8-9BBD-9983ACDA443C--


From nobody Fri May 23 06:30:11 2014
Return-Path: <farinacci@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A54D81A01C0 for <lisp@ietfa.amsl.com>; Fri, 23 May 2014 06:30:09 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level: 
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9,  DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o4PCLUGOC3yO for <lisp@ietfa.amsl.com>; Fri, 23 May 2014 06:30:03 -0700 (PDT)
Received: from mail-qc0-x235.google.com (mail-qc0-x235.google.com [IPv6:2607:f8b0:400d:c01::235]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BC69E1A01AF for <lisp@ietf.org>; Fri, 23 May 2014 06:30:02 -0700 (PDT)
Received: by mail-qc0-f181.google.com with SMTP id m20so8044266qcx.40 for <lisp@ietf.org>; Fri, 23 May 2014 06:30:00 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=1G5JfrVGe+MwszB/ZQqDfZS/njaVxIeBqn3Dn5leqTM=; b=RVBzcA97zttPu4EKbe2X+kRmE03K55S8lu+f8mDLfZhcvg1kJb31M6SCN13KN1iLeu WuNuwYqeW2BjJpadoK3X5rKcqX5AbSe9Ytq21BpNf27k8yNIZDjDkWZDZ66FarBOpiNT tyZg8cIvqJu78HPu7DHKhY0Blu1h+6Pk/VJ3N/xOqi6lgjXFac+UNJuhFoH+XKC0mB2A YcTHlMFk3hMeac9vF1xxhsdObD0aAprBo8See1PnWghQEfmRbPYUxHB0zyyJiVwPWcG/ wnXFZA1RxZ4o7R3sfnRFwzBFj+wFiaC0kYiEPYIJTkuCkzMg3ht6H8r2UWvV6nYdcfer tntw==
X-Received: by 10.229.234.67 with SMTP id kb3mr6816508qcb.6.1400851800691; Fri, 23 May 2014 06:30:00 -0700 (PDT)
Received: from [10.5.50.34] (pool-96-224-2-33.nycmny.east.verizon.net. [96.224.2.33]) by mx.google.com with ESMTPSA id j88sm1937628qgf.39.2014.05.23.06.29.58 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 23 May 2014 06:29:59 -0700 (PDT)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\))
From: Dino Farinacci <farinacci@gmail.com>
In-Reply-To: <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com>
Date: Fri, 23 May 2014 06:29:57 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <E5D58037-2EDE-47F6-9089-9B6E04393B41@gmail.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com>
To: Ronald Bonica <rbonica@juniper.net>
X-Mailer: Apple Mail (2.1874)
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/gUkC38J5dehwdcBAD7sNhFkbFAM
Cc: Roger Jorgensen <rogerj@gmail.com>, "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 23 May 2014 13:30:09 -0000

> Dino,
>=20
> Today's Internet is not as fragile as you think. This mail traversed =
many routers between my house and yours.=20

Ron, I know for a fact, it is fragile. I know most of the code that runs =
the Internet. And you said yourself that uRPF is not used in many =
places, so that, in and of itself, makes it fragile for spoofing.

> If those routers are well-managed, there is nothing that I can do from =
my house that will cause any of those routers to consume control plane =
resources. Therefore, there is nothing that I can do from my house that =
will cause a DoS attack against those routers' control planes.

My example, I wanted to take you out, not the PE router at AT&T that =
could take out all customers attached to that PE. Which has happned =
before by bad vendor code. LOL. So I don't have to play there.=20

But I can use up all your resources at your house so your kids can get =
their homework assignments done on time.

It happens to me all the time at Starbucks when 15 people are watching =
videos and all I want is some decent response in my emacs window.  ;-)  =
That is not a DoS, in this case but normal usage. So DoSing something is =
as simple as bringing up an innocent applicaiton and lauching UDP =
streams to your home router.

> In LISP, separation between the forwarding and control plane is lost. =
As a matter of course, forwarding plane=20

That is not true. And in most cases, when xTRs are behind NATs, there is =
NEVER a map-cache miss. I assume you are referring to that when you =
claim there is lost separation. If not, please clarify.

> activity causes control plane activity. Since forwarding plane =
bandwidth exceeds control plane bandwidth, DoS attacks against the =
control plane are possible.

Yes, for every protocol we have invented. But like I said, there are =
better ways to solve this with LISP. If you look at all the drafts in =
totality, you will see we have a decent toolbox of solutions that COULD =
fight this traditional problem.

You are merely (and continually) looking ONLY at the map-cache miss =
problem.

> In order to be complete, the threats document must describe the DoS =
threat. It should also describe mitigations, if any exist.

I agree with that. No one is arguing your point or Ross point. But =
rather than just documenting what they are, we want to fix them. So that =
is were we should put our attention. So let's have all of us work =
together and identify the problems and brainstorm about fixes.=20

Rather than just saying what is wrong.

Dino



From nobody Fri May 23 07:37:15 2014
Return-Path: <rcallon@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AA6421A017A for <lisp@ietfa.amsl.com>; Fri, 23 May 2014 07:37:13 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.601
X-Spam-Level: 
X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WRp1xAFD8UgA for <lisp@ietfa.amsl.com>; Fri, 23 May 2014 07:37:08 -0700 (PDT)
Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2lp0208.outbound.protection.outlook.com [207.46.163.208]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C77331A0168 for <lisp@ietf.org>; Fri, 23 May 2014 07:37:07 -0700 (PDT)
Received: from CO2PR05MB636.namprd05.prod.outlook.com (10.141.199.24) by CO2PR05MB635.namprd05.prod.outlook.com (10.141.199.22) with Microsoft SMTP Server (TLS) id 15.0.944.11; Fri, 23 May 2014 14:36:57 +0000
Received: from CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) by CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) with mapi id 15.00.0944.000; Fri, 23 May 2014 14:36:57 +0000
From: Ross Callon <rcallon@juniper.net>
To: Damien Saucez <damien.saucez@gmail.com>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58M9eFhkxJvMEaw1MEc+Ryfdps9FMJAgAt2hwCABcOvgA==
Date: Fri, 23 May 2014 14:36:56 +0000
Message-ID: <16a14e1029954a9cb74c6115dd3c1a71@CO2PR05MB636.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <B3FF60AE-ED9D-45E6-BBB5-AE3F6C6172F8@gmail.com>
In-Reply-To: <B3FF60AE-ED9D-45E6-BBB5-AE3F6C6172F8@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.13]
x-forefront-prvs: 0220D4B98D
x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(51704005)(13464003)(37854004)(199002)(189002)(377454003)(51444003)(164054003)(52314003)(76482001)(33646001)(77982001)(83322001)(19580405001)(19580395003)(81542001)(81342001)(4396001)(99396002)(99286001)(46102001)(551544002)(92566001)(21056001)(86362001)(74662001)(31966008)(101416001)(80022001)(74316001)(74502001)(15975445006)(66066001)(87936001)(76576001)(20776003)(85852003)(64706001)(50986999)(54356999)(15202345003)(76176999)(77096999)(83072002)(79102001)(2656002)(24736002)(559001)(579004); DIR:OUT; SFP:; SCL:1; SRVR:CO2PR05MB635; H:CO2PR05MB636.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rcallon@juniper.net; 
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/Rnous0PB9D09q12mF0SL0vinFUk
Cc: LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 23 May 2014 14:37:13 -0000

Detailed comments below. To summarize, these details include three threats =
which are new to LISP and which are not adequately explained in the current=
 threats document:

 (1) The Control Plane Threat: LISP allows a dataplane DOS attack (lots of =
packets sent to overwhelm a site) to turn into a control plane attack (the =
router is forced to respond to the attack in the control plane, which is of=
 course frequently multiple orders of magnitude slower than the data plane,=
 particularly for very high speed routers).=20

 (2) The Privacy Threat: LISP provides an attacker with a relatively easy w=
ay to determine the identity of large numbers of PE and/or CE routers (glob=
ally, if LISP is deployed on that level) .

 (3) the Traffic Gleaning Threat: If an xTR gleans EID -> RLOC mappings fro=
m incoming packets, this provides an easy way for hackers to intercept traf=
fic. I put this threat third because gleaning can be turned off, and thus t=
his threat can be defeated simply by not gleaning EID -> RLOC mappings.=20

WRT the first of these, Dino has pointed out that the control plane of rout=
ers already receive BGP packets from sources outside their domain. Thus a D=
OS attack on the control plane of routers can be launched through BGP. Howe=
ver, the number of BGP peers that a router has is limited, and can be known=
 a priori. Thus it is possible, and relatively common, for a router to be c=
onfigured to only accept BGP updates from a very limited number of identifi=
ed other routers (in many cases a moderate number of external peers plus a =
few internal route reflectors). Each of these known BGP sessions can be ind=
ividually rate limited, and no other source can be allowed to send BGP upda=
tes to the router. Also, other control traffic to the router can be limited=
 to internal peers (eg, OSPF, IS-IS, LDP, and/or RSVP from other internal r=
outers, plus network management traffic from internal sources only). Thus t=
oday every source of control plane traffic to the router can be controlled =
and rate limited. For CE routers the number of BGP peers can be even more l=
imited, possibly to one (the PE) or even none (for stub domains use manuall=
y configured static routes).=20

If LISP were ubiquitously and globally deployed across the Internet, then m=
apping requests could come from pretty much anywhere. Similarly incoming da=
ta plane traffic which contains EID's that are not currently listed in your=
 EID -> RLOC mapping would cause a mapping request to be generated in the c=
ontrol plane. I understand that mapping requests (both incoming and outgoin=
g) can be rate limited, but this simply turns a "shut down the router's con=
trol plane" attack to turn into a "shut down the router's mapping function"=
 attack. If correct operation relies on the mapping function, then you have=
 still broken the router.=20

The second of these is a big deal which has not been talked about much. We =
don't want hackers to know the identity of all PE and/or CE routers. It is =
difficult to fully anticipate what attacks will occur, but there certainly =
have already been intrusions of various kinds against routers and making it=
 fundamentally easier for hackers to know the identity of a large number of=
 routers is something that it at least important enough to mention.=20

Regarding the third of these, there have already been attacks which mis-rou=
te traffic. Eg:
http://www.wired.com/2013/12/bgp-hijacking-belarus-iceland/  =20

However, we don't want to make it easier to launch attacks of this kind, an=
d there is other work currently underway to make BGP more difficult to hija=
ck (but of course, gleaning can be turned off).=20

More details in-line below, marked with "RWC>" in the left margin...

-----Original Message-----
From: Damien Saucez [mailto:damien.saucez@gmail.com]=20
Sent: Monday, May 19, 2014 6:26 PM
To: Ross Callon
Cc: Joel M. Halpern; LISP mailing list list; Luigi Iannone
Subject: Re: [lisp] Restarting last call on LISP threats

Dear Ross,

Thank you for your time.

Before detailed comments below, we have to remind that the objective
of this document is to identify global threats potentially introduced
by LISP w.r.t.  what exists today in the legacy Internet.  The problem
space is out of the scope of the document.

comments inline.

On 12 May 2014, at 19:11, Ross Callon <rcallon@juniper.net> wrote:

> Thanks Joel;
>=20
> I think that draft-ietf-lisp-threats-09.txt is a start towards a threats =
document, but that it has serious omissions and needs more work before bein=
g progressed. Here are some specific comments:=20
>=20
>=20
> Section 2 (On-path Attackers), first paragraph:=20
>=20
>   On-path attackers are attackers that are able to capture and modify
>   all the packets exchanged between an Ingress Tunnel Router (ITR) and
>   an Egress Tunnel Router (ETR).  To cope with such an attacker,
>   cryptographic techniques such as those used by IPSec ([RFC4301]) are
>   required.  As with IP, LISP relies on higher layer cryptography to
>   secure packet payloads from on path attacks, so this document does
>   not consider on-path attackers.
>=20
> To me an on-path attacker is one which is on the data path. Such an attac=
ker might attack the contents of the data packet. In this case the paragrap=
h seems mostly correct to me: You encrypt the contents if you don't want so=
meone on the path to the destination to look at the contents. However, as i=
s discussed later in the document, LISP allows systems which are not in the=
 normal physical path, through a gleaning attack, to inject themselves into=
 the data path. This could be applied to allow attacker's systems to inject=
 themselves into the path of the key management protocol. This implies that=
 a legitimate user could get keys supplied by an attacker, just as easily a=
s it could get keys supplied by a legitimate Internet site. If you are prop=
osing that end to end encryption is the solution to on path attackers then =
you need to understand the implications of LISP on the operation of the pro=
tocol needed for key management to support end to end encryption.=20

The paragraph you are citing end with this document does _not_
consider on-path attackers..  While you remarks are generally valuable
they do not apply here, the document is not proposing anything, it i
just stating what is _not_ considered.

RWC>  The existing paragraph clearly states "LISP relies on higher layer
RWC>  cryptography to secure packet payloads from on path attacks".
RWC>  However, higher layer cryptography does not protect the LISP header.
RWC>  Thus LISP cannot rely on higher layer cryptography to protect the=20
RWC>  LISP header. There is an real attack here that you have just ruled=20
RWC>  out of scope without justification. More on this below...

>=20
> Also, you should mention in this section that a gleaning attack would all=
ow at least in the short term for an attacker to become temporarily on-path=
 even if they are not on what should be the normal path to the destination.=
=20
>=20
The definition we give about on-path attacker includes your
sub-category.  It does not matter where you attacker physically is.
If it is able to capture and modify packets then it is on-path (does
not matter if physical shorter or not).

RWC>  Okay, we are agreed that if a gleaning attack allows an attacker to
RWC>  put themselves on-path, then they are considered to be an on-path
RWC>  attacker. LISP therefore makes it easier to launch on-path attacks.
RWC>  This is not a justification to refuse to consider such attacks and=20
RWC>  simply rule them "out of scope".=20

> An on-path attacker might choose to only change something about the LISP =
handling details, such as exploding the map cache or redirecting a user to =
a different site. Some of this is mentioned later in the document. One thin=
g that is not mentioned: Suppose that the encapsulated packet is encrypted.=
 The on-path attacker could however see the LISP header, and thus could cha=
nge the nonce, or add a nonce, or reply to the nonce, change versioning inf=
ormation,...  Are you proposing that the LISP header be encrypted also? If =
so, where is this specified and what does it do to forwarding performance i=
n the xTR?=20
>=20

The document is just an analysis, hence your question, while valid, is
outside the scope of this document.

RWC>  If I understand your reasoning: You don't know how to handle such=20
RWC>  attacks. Therefore you don't discuss them and you rule these attacks
RWC>  as "out of scope". Since you don't discuss them, therefore LISP is
RWC>  secure. I must not have understood your reasoning.=20

>
> Section 4.3.1, second paragraph, third sentence:=20
>=20
>   This is not different from today's
>   Internet where a spoofing off-path attacker may inject data packets
>   in any flow.
>=20
> In terms of injecting traffic that the end system receives and acts upon,=
 I believe that this sentence is entirely true. However, in terms of the ef=
fect on the router's control plane, and particularly the operation of xTR's=
, this sentence is not true. Today there is very little that a spoofing att=
acker that is outside of a particular service provider can do to exercise t=
he control plane of that provider's routers. This is important and intentio=
nal (see DOS discussion below).=20
>=20
>=20
The section actually does not enter in any discussion about
quantifying the damages.  So the second part of your comment is
correct if it does apply to section 4.3.1.

The first half of your comment is, however, unfounded.  Section 4.3.1
is about attacks _not_ leveraging on LISP header, so from this side it
is exactly the same case like any other IP spoofed packet.  In
particular since LISP header is not used, xTR functions are not
actually attacked.

RWC>  This gets back to my meta-comment that I sent earlier in an separate
RWC>  email. We need to understand the attacks that might actually occur.
RWC>  It is not acceptable to just rule an attack out of scope without=20
RWC>  considering it, and then decide that LISP is secure because the=20
RWC>  attacks that you did consider can be handled.=20


> (deleted nit about abbreviation for A non-spoofing off-path attacker)


> Section 4.3.1.1 (Gleaning Attacks), last paragraph:
>=20
>   By itself, an attack made solely using gleaning cannot last long,
>   however it should be noted that with current network capacities, a
>   large amount of packets might be exchanged during even a small
>   fraction of time.
>=20
> The amount of damage that might be caused by this may depend upon what ha=
ppens to be exchanged in that "short amount of time". For example, the init=
ial handshake between sites (at the application layer) could include sign i=
n information (account names and passwords), on the basis that this is the =
sort of information that needs to be exchanged at the beginning of, for exa=
mple, financial transactions. My understanding is that for Internet commerc=
e, it is normal for users to be redirected to a different site to enter cre=
dit card information. This appears to constitute a "new session" (or at lea=
st may be to an entirely different location) and therefore the entire credi=
t card exchange could occur in a small period of time. I think it would be =
worth mentioning here that the sensitivity of the information that could be=
 exchanged during this "short amount of time" is not known, and could poten=
tially be serious.=20

Exchanging critical information (e.g.  password) in clear means that
you have a serious problem, but not at the network layer.  Also, the
situation with LISP would not be worse than without LISP.

RWC>  You are correct that exchanging passwords or other login credentials =
in =20
RWC>  the clear is a bad idea, and not LISP's problem. I had a rather long=
=20
RWC>  discussion with a security expert over this, and the bottom line seem=
s
RWC>  to be a bit muddled: The primary security for critical sensitive data
RWC>  (such as passwords) is at the application layer, but this is not perf=
ect
RWC>  -- attacks on the certificates are conceivable -- and thus it is not=
=20
RWC>  ideal to remove another imperfect layer of security. My conclusion fr=
om
RWC>  this is that I am not comfortable with the risks of gleaning, but at=
=20
RWC>  worse it just needs to be turned off for operation over non-trusted=20
RWC>  environments (such as the Internet).=20

>=20
> Also, depending upon how long xTR's are willing to store gleaned informat=
ion (before the map request comes back), the time that a user is misdirecte=
d due to a gleaning attack might be extended by coordinating a DDOS attack =
with the gleaning attack. For example, an attacker may send packets to a ve=
ry large number of sites, with a source EID which is from a major stock bro=
ker or bank and an RLOC from the attacker's captive servers. The many sites=
 glean the EID to RLOC mapping from the arriving packets. Each pretty much =
simultaneously initiates an EID lookup (to verify the EID to RLOC mapping).=
 This creates a DOS attack on the control plane of the mapping function sup=
porting that stock broker or bank. This implies that the responses are goin=
g to be delayed (and could be greatly delayed), which allows the incorrect =
mappings to last longer than they otherwise would. This allows any systems =
that actually happen to be trying to connect to that stock or banking site =
to be redirected to the a
> ttacker's site. The attacker then becomes a man in the middle and can for=
 example can obtain the password and account information for users. =20
>=20
>=20

Such a scenario would require a lot of synchronisation.  Anyway, our
opinion is that the current text is stating exactly the same thing you
describe just in a succinct way.

RWC>  No. Synchronization is trivial because the attack that inserts wrong=
=20
RWC>  information into the EID -> RLOC mappings **is the same attack** that=
=20
RWC>  creates a DDOS attack against the mapping system.  I believe that the
RWC>  current text understates the risk (which appears to be the purpose=20
RWC>  of the entire document).=20

As a reminder, the present document studies LISP in a public network
deployment.

RWC>  As it should.=20

> Last paragraph of section 4.3.2.2:=20
>=20
>   If the size of the Map-Request
>   message is larger than the size of the smallest LISP-encapsulated
>   packet that could trigger such a message, this could lead to
>   amplification attacks (see Section 4.4.1) so that more bandwidth is
>   consumed on the target than the bandwidth necessary at the attacker
>   side.
>=20
> The size of the packet is not the only issue. If the amount of processing=
 required to send a map-request and deal with the reply is greater than the=
 amount of processing that is required to send a packet that triggers such =
a request, then this could also result in an amplification attack. In princ=
iple it would seem that sending out a large number of packets to trigger su=
ch a request would be relatively straightforward (for example the attacker =
might be sending out many packets only incrementing the EID in order to att=
ack the ITR that will need to generate many map requests). We may note that=
 for many systems, particularly very high speed routers (which might exist =
for example as PE routers connecting very large enterprise customers), the =
control plane may be several orders of magnitude slower than the data plane=
, so that an attack that requires response from the router's control plane =
would be much more serious than an attack of the same size that can be hand=
led in the data plane. I=20
> will say more about this in my comments below regarding DOS attacks.=20
>=20

Your first point can be easily fixed by substituting the word
bandwidth with bandwidth and/or processing or "resource"

Your statement on the speed difference between control and data plane
is true and is a general observation not limited to LISP. =20

RWC>  of course. But other aspects of router operations are carefully set u=
p
RWC>  to avoid overloading the control plane.=20

Note that
one of the advantages of having the Map-Server/Map-Resolver elements
in the LISPa architecture is exactly to avoid situations you are
describing.

RWC>  I don't think that this has succeeded.=20

> Section 4.3.2.3, third paragraph (right after the bullets):=20
>=20
>   The first type of packet should not cause any major problem to ITRs.
>   As the reachability test uses a 24 bits nonce, it is unlikely that an
>   off-path attacker could send a single packet that causes an ITR to
>   believe that the ETR it is testing is reachable while in reality it
>   is not reachable.  To increase the success likelihood of such attack,
>   the attacker should create a massive amount of packets carrying all
>   possible nonce values.
>=20
> However, this could be a problem if there are on-path attackers, since th=
ey will see the nonce. They could insert nonce's where none are present, re=
quiring a response from the ETR. Given that the control plane of very high =
speed PE routers may be much slower than the data plane, this could cause a=
 relatively moderate data stream that the data plane or the PE could easily=
 handle to turn into a control plane attack that the control plane of a PE =
router could not handle. Also, the on-path attacker could see the nonce's a=
nd respond "correctly" (or in a way that the ITR that sent the nonce *think=
s* is correct), thereby "verifying" connectivity when none is present. You =
dismissed on-path attacks earlier in the document on the basis that the use=
r data could be encrypted, but these are examples of on-path attacks that w=
ould be on the LISP header and operation, and not on the user data.=20

It is clearly stated at the beginning of the document that on-path
attacks are out of the scope of the document.=20

RWC>  True. But since you have agreed that gleaning attacks that cause=20
RWC>  traffic to be mis-routed cause additional systems to be on-path=20
RWC>  and that this constitutes an on-path attack, and since you have=20
RWC>  ruled out on-path attacks against the LISP headers, therefore you
RWC>  have failed to adequately consider LISP security. You can't just=20
RWC>  rule important attacks out of scope and then claim that you have=20
RWC>  any valid conclusion regarding the overall security of LISP.=20

 Also, Sec.  2 does not
limit cryptography technique to the payload, actually section 2 makes
the distinction saying:

1)
 "To cope with such an attacker, cryptographic techniques such as
 those used by IPSec ([RFC4301 ]) are required."

which is reported to any form of packet manipulation

and 2)
"As with IP, LISP relies on higher layer cryptography to secure packet
payloads from on path attacks, so this document does not consider
on-path attackers."

which is related to attacks targeting the payload.

RWC> But doesn't address the issue of on-path attacks on the LISP header.=20


>=20
>=20
> Section 5.2 (Denial of Service):
>=20
> You need to mention here the relative difference in speed between the dat=
a plane and the control plane of high speed routers. For example, there are=
 plenty of examples currently widely deployed of routers which can handle a=
 few terabits of data in the data plane. These routers might typically have=
 gigabit Ethernet links to the control processor, but I doubt that any of t=
hem could handle Map-Requests coming in at line rate at a gigabit. Thus the=
 ratio between the speed of the control plane the speed of the data plane i=
s significantly greater than 1000. I understand that many PE routers have s=
lower data planes (and the CE "wireless router" that sits in each of our ho=
mes is of course a lot slower than this), but large data centers or large e=
nterprise sites could very well be connected to their service provider via =
a few very high speed PE routers. Therefore an attack that would be trivial=
 to handle in the data plane (say, a few gigabits) could overwhelm the cont=
rol plane.=20
>=20

You are absolutely right, but why this is specific to LISP?  It is not
specific to LISP, so there is no reason to discuss such an issue in
this document.

RWC>  Discussed elsewhere, but this is specific to LISP because with=20
RWC>  LISP data-plane traffic can trigger control-plane map requests.=20

> Gleaning allows incoming packets to create map requests, which allows a d=
ata plane attack to turn into a control plane attack. Given the difference =
in speeds between the data plane and the control plane, this makes it much =
easier to create an effective DOS attack.=20
>=20

RFC6830 already considered rate limiting fo this very reason.

RWC>  Of course you can rate limit map requests and responses and thus=20
RWC>  turn a "shut the control-plane" attack into a "shut the mapping=20
RWC>  system" attack, but this still can take out the mapping system (or a
RWC>  part thereof).

>=20
> Section 8 (Security Considerations).=20
>=20
> I am pleased that you removed the sentence from section 1 of the previous=
 (-08) draft that read: "As a result of  the performed analysis, the docume=
nt discusses the severity of the threats and proposes recommendations to re=
ach the same level of security in LISP than in Internet today (e.g., withou=
t LISP)". This sentence was not actually correct. However, in looking throu=
gh the document and in thinking about the implications (see the rest of thi=
s email) it is quite clear that the security of an Internet using LISP woul=
d be significantly less than the current Internet (at least if you assume t=
hat there is *any* security at all in the current Internet). I am thinking =
that there should be a sentence at the end of section 8 to the effect that =
"At the current time it appears that LISP would have significant security i=
mplications if deployed on an Internet-wide scale".
>=20
>=20


Such sentence would not represent the discussions that took place in
the LISP WG in the last four years.

The arguments that you raised in the previous part of this mail are
mainly not LISP-specific, while the experience gathered in the last
years show that LISP is not worst that what we have today (and
actually research work out there shows that it can even be helpful to
use LISP)

RWC>  LISP has not been sufficiently widely deployed to be of interest to=20
RWC>  serious professional attackers. My concerns are LISP-specific and I
RWC>  would hope that you would make an honest attempt to adequately=20
RWC>  understand the security aspects of it, rather than just trying to=20
RWC>  whitewash the approach.=20


> Finally, two items left out:
>=20
> I don't see any discussion on the effect of LISP on firewalls. I am assum=
ing that pretty much all currently deployed firewalls are not able to look =
past a LISP header to inspect the contents of packets. At a minimum, this w=
ould seem to imply that LISP will need to be deployed toward the Internet c=
ore from the current firewalls, so that the firewalls can be looking at nor=
mal (unchanged) IP packets.
>=20
>=20

Deployment model is out of the scope of this document and the problem
is not specific to LISP.

RWC>  This would be a trivial update to the document that would make it=20
RWC>  more complete, but is not a major point.=20

> There is another issue which might belong in the section on privacy: In t=
he Internet today if you want to attack a network with prefix aa.bb/16, and=
 you see this advertisement in the BGP routes, you can pick a random addres=
s and send a packet and see if anything happens. You get little feedback. W=
ith LISP you can send a map request to a random address in the block and ge=
t back a map reply. This gives you an RLOC which is in general the actual I=
P address of a real PE or CE router. Of course you can repeat this across t=
he entire /16, or even the Internet (given sufficient time and traffic), an=
d get something close to a complete list of LISP xTRs. This implies that if=
 service providers implement LISP on PE routers, then they will be exposing=
 the identity of their PE routers to worldwide inspection. Given the number=
 of PE routers in the world (obviously much larger than the number of servi=
ce providers, and given PA address aggregation probably larger than the num=
ber of routes that show u
> p in the BGP routing table) we should expect that there are lots of PE ro=
uters that have not been carefully secured, and exposing their existence to=
 open worldwide easy discovery would likely open the door to a number of at=
tacks that involve compromise of PE routers. Of course if LISP is deployed =
on CE routers then their RLOC would similarly be exposed.=20
>=20

If routers are not correctly secured, there is no problem linked to
LISP as today it is already possible to discover the IP address of
theses routers thanks to various techniques.  Moreover, section 6
already clearly states that privacy is not discussed in the document
but that the attacks presented in the document can potentially play a
role in privacy threats.

RWC>  Again, saying in the document that some important security aspects
RWC>  are not considered is not a valid way to produce a sound analysis
RWC>  of the security implications of LISP. Privacy is a valid issue that=20
RWC>  needs to be considered.=20

Thanks, Ross

> -----Original Message-----
> From: lisp [mailto:lisp-bounces@ietf.org] On Behalf Of Joel M. Halpern
> Sent: Friday, May 09, 2014 11:54 AM
> To: lisp@ietf.org
> Subject: [lisp] Restarting last call on LISP threats
>=20
> Sorry for the delay getting this out.
> This email starts a new (and hopefully final) last call on=20
> draft-ietf-lisp-threats, version 9:
> http://datatracker.ietf.org/doc/draft-ietf-lisp-threats/
>=20
> The last call will end in two weeks, close of business 23-May-2014.
>=20
> Thank you,
> Joel
>=20
> _______________________________________________
> lisp mailing list
> lisp@ietf.org
> https://www.ietf.org/mailman/listinfo/lisp


From nobody Sat May 24 00:56:23 2014
Return-Path: <ietf@bartschnet.de>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D74271A01DF for <lisp@ietfa.amsl.com>; Sat, 24 May 2014 00:56:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.551
X-Spam-Level: 
X-Spam-Status: No, score=-1.551 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8wJ70W18NU9a for <lisp@ietfa.amsl.com>; Sat, 24 May 2014 00:56:19 -0700 (PDT)
Received: from triangulum.uberspace.de (triangulum.uberspace.de [95.143.172.227]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 89E171A00F2 for <lisp@ietf.org>; Sat, 24 May 2014 00:56:19 -0700 (PDT)
Received: (qmail 15508 invoked from network); 24 May 2014 07:56:15 -0000
Received: from localhost (HELO webmail.triangulum.uberspace.de) (127.0.0.1) by localhost with SMTP; 24 May 2014 07:56:15 -0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Date: Sat, 24 May 2014 09:56:14 +0200
From: Rene Bartsch <ietf@bartschnet.de>
To: lisp@ietf.org
Message-ID: <46de27bbedcf27377ee534a942874d6d@triangulum.uberspace.de>
X-Sender: ietf@bartschnet.de
User-Agent: Roundcube Webmail/0.9.5
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/d-ALq-HLNDPdrhTjWwEnNsC6xnk
Subject: [lisp] NAT status of beta network and LISPmob
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 24 May 2014 07:56:21 -0000

Hi,

last year there were intentions to upgrade all proxy tunnel routers to 
NAT capability at the beginning of this year. There's also a version 0.4 
of LISPmob, meanwhile.

Ist it possible to use router mode with multiple EIDs/EID-prefixes (e.g. 
IPv4 and IPv6 at the same time) with LISPmob and beta network, now?

-- 
Best regards,

Rene Bartsch, B. Sc. Informatics


From nobody Sat May 24 03:22:08 2014
Return-Path: <lori@lispmob.org>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D7B3C1A0157 for <lisp@ietfa.amsl.com>; Sat, 24 May 2014 03:22:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level: 
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0TzzMkwB_h3P for <lisp@ietfa.amsl.com>; Sat, 24 May 2014 03:22:05 -0700 (PDT)
Received: from roura.ac.upc.es (roura.ac.upc.edu [147.83.33.10]) by ietfa.amsl.com (Postfix) with ESMTP id 174791A0154 for <lisp@ietf.org>; Sat, 24 May 2014 03:22:03 -0700 (PDT)
Received: from gw-2.ac.upc.es (gw-2.ac.upc.es [147.83.30.8]) by roura.ac.upc.es (8.13.8/8.13.8) with ESMTP id s4OALwFe010621; Sat, 24 May 2014 12:21:58 +0200
Received: from dhcp-10-61-108-106.cisco.com (173-38-208-169.cisco.com [173.38.208.169]) by gw-2.ac.upc.es (Postfix) with ESMTPSA id 79E367E7; Sat, 24 May 2014 12:21:56 +0200 (CEST)
Content-Type: text/plain; charset=windows-1252
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.2\))
From: Lori Jakab <lori@lispmob.org>
In-Reply-To: <46de27bbedcf27377ee534a942874d6d@triangulum.uberspace.de>
Date: Sat, 24 May 2014 13:21:53 +0300
Content-Transfer-Encoding: quoted-printable
Message-Id: <A42C5DBE-B604-4AD7-83E9-48E35CB7B318@lispmob.org>
References: <46de27bbedcf27377ee534a942874d6d@triangulum.uberspace.de>
To: Rene Bartsch <ietf@bartschnet.de>
X-Mailer: Apple Mail (2.1878.2)
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/3GT_Q7f24D7_grGgPTE6ajDhCjg
Cc: lisp@ietf.org
Subject: Re: [lisp] NAT status of beta network and LISPmob
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 24 May 2014 10:22:07 -0000

On May 24, 2014, at 10:56 AM, Rene Bartsch <ietf@bartschnet.de> wrote:
> Hi,
>=20
> last year there were intentions to upgrade all proxy tunnel routers to =
NAT capability at the beginning of this year.

Actually, it=92s the Map-Servers that need to be upgraded, and RTRs =
added.  However, the IOS NAT implementation hasn=92t received enough =
testing and validation yet to be considered ready for wide deployment.  =
We do have some NAT infrastructure in place on the Beta network, so if =
you=92re ok with receiving best effort support if you run into issues, =
please contact lisp-support@cisco.com to get you hooked up.

> There's also a version 0.4 of LISPmob, meanwhile.

Yes, that version does support NAT traversal, and some users are running =
it successfully on the Beta network.

>=20
> Ist it possible to use router mode with multiple EIDs/EID-prefixes =
(e.g. IPv4 and IPv6 at the same time) with LISPmob and beta network, =
now?

I=92m not sure about that, please ask on the users@lispmob.org mailing =
list.

Best regards,
-Lori=


From nobody Sun May 25 21:51:33 2014
Return-Path: <rbonica@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 90E021A046C for <lisp@ietfa.amsl.com>; Sun, 25 May 2014 21:51:31 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.902
X-Spam-Level: 
X-Spam-Status: No, score=-101.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l3GQlJwZXc91 for <lisp@ietfa.amsl.com>; Sun, 25 May 2014 21:51:29 -0700 (PDT)
Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0145.outbound.protection.outlook.com [207.46.163.145]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 503091A0454 for <lisp@ietf.org>; Sun, 25 May 2014 21:51:29 -0700 (PDT)
Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB443.namprd05.prod.outlook.com (10.141.73.152) with Microsoft SMTP Server (TLS) id 15.0.944.11; Mon, 26 May 2014 04:51:24 +0000
Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) with mapi id 15.00.0949.001; Mon, 26 May 2014 04:51:24 +0000
From: Ronald Bonica <rbonica@juniper.net>
To: Dino Farinacci <farinacci@gmail.com>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEIABfmkAgAefyVCAAITngIABbBJggAEZ+ICABCHVsA==
Date: Mon, 26 May 2014 04:51:22 +0000
Message-ID: <1ed6bc991bb04281936d66c9bba4aa9c@CO1PR05MB442.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <E5D58037-2EDE-47F6-9089-9B6E04393B41@gmail.com>
In-Reply-To: <E5D58037-2EDE-47F6-9089-9B6E04393B41@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.14]
x-forefront-prvs: 02234DBFF6
x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(51704005)(189002)(199002)(87936001)(81542001)(20776003)(92566001)(80022001)(21056001)(74502001)(74662001)(76576001)(77982001)(4396001)(86362001)(99286001)(31966008)(1411001)(81342001)(46102001)(83072002)(33646001)(64706001)(66066001)(101416001)(99396002)(54356999)(2656002)(76176999)(74316001)(85852003)(50986999)(83322001)(76482001)(79102001)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO1PR05MB443; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; 
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/aV-w5WQdyQT0-kJh4P2FIiZKoHA
Cc: Roger Jorgensen <rogerj@gmail.com>, "lisp@ietf.org" <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 26 May 2014 04:51:31 -0000

Dino,

You have a very good point! Rather than arguing about whether DoS attacks a=
gainst the control plane are possible, a more constructive course of action=
 might be:

a) to document the attacks
b) to brainstorm for mitgations

IMHO, a) should definitely happen in the threats document. It should includ=
e DoS attacks initiated by attackers:

a1) who are outside of LISP sites
a2) who are inside of LISP sites

Mitigations could be documented in the threats document or somewhere else. =
The AD's and chairs will probably want to make that call.

Do you see an obvious mitigation to A1 and A2?

                                                              Ron

>=20
> > activity causes control plane activity. Since forwarding plane bandwidt=
h
> exceeds control plane bandwidth, DoS attacks against the control plane ar=
e
> possible.
>=20
> Yes, for every protocol we have invented. But like I said, there are bett=
er
> ways to solve this with LISP. If you look at all the drafts in totality, =
you will see
> we have a decent toolbox of solutions that COULD fight this traditional
> problem.
>=20
> You are merely (and continually) looking ONLY at the map-cache miss
> problem.
>=20
> > In order to be complete, the threats document must describe the DoS
> threat. It should also describe mitigations, if any exist.
>=20
> I agree with that. No one is arguing your point or Ross point. But rather=
 than
> just documenting what they are, we want to fix them. So that is were we
> should put our attention. So let's have all of us work together and ident=
ify
> the problems and brainstorm about fixes.
>=20
> Rather than just saying what is wrong.
>=20
> Dino
>=20


From nobody Sun May 25 22:06:26 2014
Return-Path: <rbonica@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2FB3A1A047B for <lisp@ietfa.amsl.com>; Sun, 25 May 2014 22:06:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.6
X-Spam-Level: 
X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oy6v_x9Kzu7N for <lisp@ietfa.amsl.com>; Sun, 25 May 2014 22:06:22 -0700 (PDT)
Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2lp0203.outbound.protection.outlook.com [207.46.163.203]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EFEA31A047A for <lisp@ietf.org>; Sun, 25 May 2014 22:06:21 -0700 (PDT)
Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) with Microsoft SMTP Server (TLS) id 15.0.949.11; Mon, 26 May 2014 05:06:16 +0000
Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) with mapi id 15.00.0949.001; Mon, 26 May 2014 05:06:16 +0000
From: Ronald Bonica <rbonica@juniper.net>
To: Damien Saucez <damien.saucez@gmail.com>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEIABfmkAgAefyVCAAITngIABbBJggAETbwCABC0O0A==
Date: Mon, 26 May 2014 05:06:16 +0000
Message-ID: <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com>
In-Reply-To: <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.14]
x-forefront-prvs: 02234DBFF6
x-forefront-antispam-report: SFV:NSPM; SFS:(428001)(377454003)(13464003)(24454002)(199002)(189002)(33646001)(76576001)(21056001)(4396001)(15975445006)(77982001)(31966008)(74662001)(74502001)(81542001)(81342001)(76482001)(74316001)(46102001)(54356999)(76176999)(87936001)(83072002)(92566001)(16236675002)(79102001)(19580395003)(19625215002)(83322001)(85852003)(50986999)(19580405001)(20776003)(64706001)(99396002)(2656002)(99286001)(101416001)(86362001)(19300405004)(66066001)(15202345003)(80022001)(24736002)(19607625008); DIR:OUT; SFP:; SCL:1; SRVR:CO1PR05MB442; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; 
Content-Type: multipart/alternative; boundary="_000_dd849ce0cca749c885c5b8a1e989f758CO1PR05MB442namprd05pro_"
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/ENS30OExksRJyYvurHpi5xcTmd8
Cc: Roger Jorgensen <rogerj@gmail.com>, LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 26 May 2014 05:06:25 -0000

--_000_dd849ce0cca749c885c5b8a1e989f758CO1PR05MB442namprd05pro_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable



From: Damien Saucez [mailto:damien.saucez@gmail.com]
Sent: Friday, May 23, 2014 9:07 AM
To: Ronald Bonica
Cc: Dino Farinacci; Roger Jorgensen; LISP mailing list list
Subject: Re: [lisp] Restarting last call on LISP threats

Hello Ronald,


On 22 May 2014, at 22:57, Ronald Bonica <rbonica@juniper.net<mailto:rbonica=
@juniper.net>> wrote:


Dino,

Today's Internet is not as fragile as you think. This mail traversed many r=
outers between my house and yours. If those routers are well-managed, there=
 is nothing that I can do from my house that will cause any of those router=
s to consume control plane resources. Therefore, there is nothing that I ca=
n do from my house that will cause a DoS attack against those routers' cont=
rol planes.
We tend to disagree with that, for example you have ICMP today...
[RPB] Because ICMP is susceptible to DoS attacks, it wouldn't make a very g=
ood routing protocol. That's why we don't use it for routing. By contrast, =
LISP map-request messages are susceptible to DoS attacks and they do carry =
routing information.



In LISP, separation between the forwarding and control plane is lost. As a =
matter of course, forwarding plane activity causes control plane activity. =
Since forwarding plane bandwidth exceeds control plane bandwidth, DoS attac=
ks against the control plane are possible.

In order to be complete, the threats document must describe the DoS threat.=
 It should also describe mitigations, if any exist.

DoS is already explained and the definition given:

" A Denial of Service (DoS) attack aims at disrupting a specific

   targeted service either by exhausting the resources of the victim up

   to the point that it is not able to provide a reliable service to

   legit traffic and/or systems or by exploiting vulnerabilities to make

   the targeted service unable to operate properly.
"

is covering the case you mention.
[RPB]
You might want to add the following details to section 5.2:


-          A DoS attack can be launched by anybody who can send a packet to=
 the XTR's LOC

-          DoS attacks can render an XTR inoperable

-          DDoS attacks can render the mapping system inoperable.

This is what differentiates LISP from today's routing system.

                                      Ron


Damien Saucez


                                                                           =
                   Ron



-----Original Message-----
From: Dino Farinacci [mailto:farinacci@gmail.com]
Sent: Wednesday, May 21, 2014 6:58 PM
To: Ronald Bonica
Cc: Roger Jorgensen; lisp@ietf.org<mailto:lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats


The attacker sends a flow of crafted packets to the victim XTR. Each packet
is a well-formed LISP data packet. It contains:


- an outer IP header (LOC->LOC)
- a UDP header
- a LISP Header
- an IP header (EID->EID)
- payload

Just like a regular packet I can send to your home router today. So yes oka=
y.
So let's continue. See comments below.


Each packet contains control plane information that is new to the victim

Be more specific about what control information are in these encapsulated
packets.


XTR. For example, the victim XTR has no mapping information regarding
either the source LOC or source EID prefix. Rather than gleaning this mappi=
ng
information from the crafted packet, the victim XTR sends a verifying MAP-
REQUEST to the mapping system.


Assume that the attack flow is large (N packets per second). Assume also
that the XTRs rate limit for MAP-REQUEST messages is less than N packets
per second. Has the attack not effectively DoS'd the victim XTR?

It caches the rate the rate the packets are coming in and eventually stops
sending Map-Requests completely.

It cannot stop the incoming rate of packets today just like a roque BGP
attacker can send millions of packets per second to a peer regardless if it
does or does not have the peer authentication key.


To make this attack work, every packet in the attack flow may need to have
a unique, spoofed, source LOC.

An implementation can detect that after rate limiting 1000s of such request=
s
are happening that it just stops operation.

What if I sent a Juniper 20 million routes today?

The Internet is very fragile and LISP IS NOT making it worse. And in some
cases it is making it better with integrated techniques.

Dino

_______________________________________________
lisp mailing list
lisp@ietf.org<mailto:lisp@ietf.org>
https://www.ietf.org/mailman/listinfo/lisp


--_000_dd849ce0cca749c885c5b8a1e989f758CO1PR05MB442namprd05pro_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
	{font-family:Wingdings;
	panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:Consolas;
	panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
pre
	{mso-style-priority:99;
	mso-style-link:"HTML Preformatted Char";
	margin:0in;
	margin-bottom:.0001pt;
	font-size:10.0pt;
	font-family:"Courier New";}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
	{mso-style-priority:34;
	margin-top:0in;
	margin-right:0in;
	margin-bottom:0in;
	margin-left:.5in;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
span.HTMLPreformattedChar
	{mso-style-name:"HTML Preformatted Char";
	mso-style-priority:99;
	mso-style-link:"HTML Preformatted";
	font-family:"Consolas","serif";}
span.EmailStyle19
	{mso-style-type:personal-reply;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
/* List Definitions */
@list l0
	{mso-list-id:984047709;
	mso-list-type:hybrid;
	mso-list-template-ids:-856259644 -1151283082 67698691 67698693 67698689 67=
698691 67698693 67698689 67698691 67698693;}
@list l0:level1
	{mso-level-start-at:5;
	mso-level-number-format:bullet;
	mso-level-text:-;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-.25in;
	font-family:"Calibri","sans-serif";
	mso-fareast-font-family:Calibri;
	mso-bidi-font-family:"Times New Roman";
	mso-ansi-font-weight:bold;
	mso-ansi-font-style:italic;}
@list l0:level2
	{mso-level-number-format:bullet;
	mso-level-text:o;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-.25in;
	font-family:"Courier New";}
@list l0:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-.25in;
	font-family:Wingdings;}
@list l0:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-.25in;
	font-family:Symbol;}
@list l0:level5
	{mso-level-number-format:bullet;
	mso-level-text:o;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-.25in;
	font-family:"Courier New";}
@list l0:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-.25in;
	font-family:Wingdings;}
@list l0:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-.25in;
	font-family:Symbol;}
@list l0:level8
	{mso-level-number-format:bullet;
	mso-level-text:o;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-.25in;
	font-family:"Courier New";}
@list l0:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-.25in;
	font-family:Wingdings;}
ol
	{margin-bottom:0in;}
ul
	{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-US" link=3D"blue" vlink=3D"purple">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,&quot;sans-serif&quot;;color:#1F497D"><o:p>&nbsp;</o:p></span><=
/p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,&quot;sans-serif&quot;;color:#1F497D"><o:p>&nbsp;</o:p></span><=
/p>
<div style=3D"border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in =
4.0pt">
<div>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in =
0in 0in">
<p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt;font-family:&quot=
;Calibri&quot;,&quot;sans-serif&quot;">From:</span></b><span style=3D"font-=
size:11.0pt;font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;"> Damien=
 Saucez [mailto:damien.saucez@gmail.com]
<br>
<b>Sent:</b> Friday, May 23, 2014 9:07 AM<br>
<b>To:</b> Ronald Bonica<br>
<b>Cc:</b> Dino Farinacci; Roger Jorgensen; LISP mailing list list<br>
<b>Subject:</b> Re: [lisp] Restarting last call on LISP threats<o:p></o:p><=
/span></p>
</div>
</div>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">Hello Ronald,<o:p></o:p></p>
<div>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
</div>
<div>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<div>
<div>
<p class=3D"MsoNormal">On 22 May 2014, at 22:57, Ronald Bonica &lt;<a href=
=3D"mailto:rbonica@juniper.net">rbonica@juniper.net</a>&gt; wrote:<o:p></o:=
p></p>
</div>
<p class=3D"MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style=3D"margin-top:5.0pt;margin-bottom:5.0pt">
<p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt">Dino,<br>
<br>
Today's Internet is not as fragile as you think. This mail traversed many r=
outers between my house and yours. If those routers are well-managed, there=
 is nothing that I can do from my house that will cause any of those router=
s to consume control plane resources.
 Therefore, there is nothing that I can do from my house that will cause a =
DoS attack against those routers' control planes.<o:p></o:p></p>
</blockquote>
<div>
<p class=3D"MsoNormal">We tend to disagree with that, for example you have =
ICMP today...<o:p></o:p></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;font-family:&q=
uot;Calibri&quot;,&quot;sans-serif&quot;;color:#1F497D">[RPB] Because ICMP =
is susceptible to DoS attacks, it wouldn&#8217;t make a very good routing p=
rotocol. That&#8217;s why we don&#8217;t use it for routing. By contrast,
 LISP map-request messages are susceptible to DoS attacks and they do carry=
 routing information.<o:p></o:p></span></i></b></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,&quot;sans-serif&quot;;color:#1F497D"><o:p>&nbsp;</o:p></span><=
/p>
</div>
<p class=3D"MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style=3D"margin-top:5.0pt;margin-bottom:5.0pt">
<p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt">In LISP, separation b=
etween the forwarding and control plane is lost. As a matter of course, for=
warding plane activity causes control plane activity. Since forwarding plan=
e bandwidth exceeds control plane bandwidth,
 DoS attacks against the control plane are possible.<br>
<br>
In order to be complete, the threats document must describe the DoS threat.=
 It should also describe mitigations, if any exist.<o:p></o:p></p>
</blockquote>
<div>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
</div>
<div>
<p class=3D"MsoNormal">DoS is already explained and the definition given:<o=
:p></o:p></p>
</div>
<div>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
</div>
<div>
<p class=3D"MsoNormal">&quot; A Denial of Service (DoS) attack aims at disr=
upting a specific<o:p></o:p></p>
</div>
<pre style=3D"page-break-before:always"><span style=3D"font-size:12.0pt">&n=
bsp;&nbsp; targeted service either by exhausting the resources of the victi=
m up<o:p></o:p></span></pre>
<pre style=3D"page-break-before:always"><span style=3D"font-size:12.0pt">&n=
bsp;&nbsp; to the point that it is not able to provide a reliable service t=
o<o:p></o:p></span></pre>
<pre style=3D"page-break-before:always"><span style=3D"font-size:12.0pt">&n=
bsp;&nbsp; legit traffic and/or systems or by exploiting vulnerabilities to=
 make<o:p></o:p></span></pre>
<pre style=3D"page-break-before:always"><span style=3D"font-size:12.0pt">&n=
bsp;&nbsp; the targeted service unable to operate properly.<o:p></o:p></spa=
n></pre>
<div>
<p class=3D"MsoNormal">&quot;<o:p></o:p></p>
</div>
<div>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
</div>
<div>
<p class=3D"MsoNormal">is covering the case you mention.<o:p></o:p></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;font-family:&q=
uot;Calibri&quot;,&quot;sans-serif&quot;;color:#1F497D">[RPB]
<o:p></o:p></span></i></b></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;font-family:&q=
uot;Calibri&quot;,&quot;sans-serif&quot;;color:#1F497D">You might want to a=
dd the following details to section 5.2:<o:p></o:p></span></i></b></p>
<p class=3D"MsoNormal"><b><i><span style=3D"font-size:11.0pt;font-family:&q=
uot;Calibri&quot;,&quot;sans-serif&quot;;color:#1F497D"><o:p>&nbsp;</o:p></=
span></i></b></p>
<p class=3D"MsoListParagraph" style=3D"text-indent:-.25in;mso-list:l0 level=
1 lfo1"><![if !supportLists]><span style=3D"font-size:11.0pt;font-family:&q=
uot;Calibri&quot;,&quot;sans-serif&quot;;color:#1F497D"><span style=3D"mso-=
list:Ignore">-<span style=3D"font:7.0pt &quot;Times New Roman&quot;">&nbsp;=
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span></span></span><![endif]><span style=3D"font-size:11.0pt;font-family:=
&quot;Calibri&quot;,&quot;sans-serif&quot;;color:#1F497D">A DoS attack can =
be launched by anybody who can send a packet to the XTR&#8217;s LOC<o:p></o=
:p></span></p>
<p class=3D"MsoListParagraph" style=3D"text-indent:-.25in;mso-list:l0 level=
1 lfo1"><![if !supportLists]><span style=3D"font-size:11.0pt;font-family:&q=
uot;Calibri&quot;,&quot;sans-serif&quot;;color:#1F497D"><span style=3D"mso-=
list:Ignore">-<span style=3D"font:7.0pt &quot;Times New Roman&quot;">&nbsp;=
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span></span></span><![endif]><span style=3D"font-size:11.0pt;font-family:=
&quot;Calibri&quot;,&quot;sans-serif&quot;;color:#1F497D">DoS attacks can r=
ender an XTR inoperable<o:p></o:p></span></p>
<p class=3D"MsoListParagraph" style=3D"text-indent:-.25in;mso-list:l0 level=
1 lfo1"><![if !supportLists]><span style=3D"font-size:11.0pt;font-family:&q=
uot;Calibri&quot;,&quot;sans-serif&quot;;color:#1F497D"><span style=3D"mso-=
list:Ignore">-<span style=3D"font:7.0pt &quot;Times New Roman&quot;">&nbsp;=
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span></span></span><![endif]><span style=3D"font-size:11.0pt;font-family:=
&quot;Calibri&quot;,&quot;sans-serif&quot;;color:#1F497D">DDoS attacks can =
render the mapping system inoperable.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,&quot;sans-serif&quot;;color:#1F497D"><o:p>&nbsp;</o:p></span><=
/p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,&quot;sans-serif&quot;;color:#1F497D">This is what differentiat=
es LISP from today&#8217;s routing system.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,&quot;sans-serif&quot;;color:#1F497D"><o:p>&nbsp;</o:p></span><=
/p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,&quot;sans-serif&quot;;color:#1F497D">&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Ron<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:&quot;Ca=
libri&quot;,&quot;sans-serif&quot;;color:#1F497D"><o:p>&nbsp;</o:p></span><=
/p>
</div>
<div>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
</div>
<div>
<p class=3D"MsoNormal">Damien Saucez&nbsp;<o:p></o:p></p>
</div>
<p class=3D"MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style=3D"margin-top:5.0pt;margin-bottom:5.0pt">
<p class=3D"MsoNormal">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Ron<br>
<br>
<br>
<br>
<o:p></o:p></p>
<blockquote style=3D"margin-top:5.0pt;margin-bottom:5.0pt">
<p class=3D"MsoNormal">-----Original Message-----<br>
From: Dino Farinacci [<a href=3D"mailto:farinacci@gmail.com">mailto:farinac=
ci@gmail.com</a>]<br>
Sent: Wednesday, May 21, 2014 6:58 PM<br>
To: Ronald Bonica<br>
Cc: Roger Jorgensen; <a href=3D"mailto:lisp@ietf.org">lisp@ietf.org</a><br>
Subject: Re: [lisp] Restarting last call on LISP threats<br>
<br>
<br>
<o:p></o:p></p>
<blockquote style=3D"margin-top:5.0pt;margin-bottom:5.0pt">
<p class=3D"MsoNormal">The attacker sends a flow of crafted packets to the =
victim XTR. Each packet<o:p></o:p></p>
</blockquote>
<p class=3D"MsoNormal">is a well-formed LISP data packet. It contains:<br>
<br>
<o:p></o:p></p>
<blockquote style=3D"margin-top:5.0pt;margin-bottom:5.0pt">
<p class=3D"MsoNormal"><br>
- an outer IP header (LOC-&gt;LOC)<br>
- a UDP header<br>
- a LISP Header<br>
- an IP header (EID-&gt;EID)<br>
- payload<o:p></o:p></p>
</blockquote>
<p class=3D"MsoNormal"><br>
Just like a regular packet I can send to your home router today. So yes oka=
y.<br>
So let's continue. See comments below.<br>
<br>
<br>
<o:p></o:p></p>
<blockquote style=3D"margin-top:5.0pt;margin-bottom:5.0pt">
<p class=3D"MsoNormal">Each packet contains control plane information that =
is new to the victim<o:p></o:p></p>
</blockquote>
<p class=3D"MsoNormal"><br>
Be more specific about what control information are in these encapsulated<b=
r>
packets.<br>
<br>
<br>
<o:p></o:p></p>
<blockquote style=3D"margin-top:5.0pt;margin-bottom:5.0pt">
<p class=3D"MsoNormal">XTR. For example, the victim XTR has no mapping info=
rmation regarding<o:p></o:p></p>
</blockquote>
<p class=3D"MsoNormal">either the source LOC or source EID prefix. Rather t=
han gleaning this mapping<br>
information from the crafted packet, the victim XTR sends a verifying MAP-<=
br>
REQUEST to the mapping system.<br>
<br>
<o:p></o:p></p>
<blockquote style=3D"margin-top:5.0pt;margin-bottom:5.0pt">
<p class=3D"MsoNormal"><br>
Assume that the attack flow is large (N packets per second). Assume also<o:=
p></o:p></p>
</blockquote>
<p class=3D"MsoNormal">that the XTRs rate limit for MAP-REQUEST messages is=
 less than N packets<br>
per second. Has the attack not effectively DoS'd the victim XTR?<br>
<br>
It caches the rate the rate the packets are coming in and eventually stops<=
br>
sending Map-Requests completely.<br>
<br>
It cannot stop the incoming rate of packets today just like a roque BGP<br>
attacker can send millions of packets per second to a peer regardless if it=
<br>
does or does not have the peer authentication key.<br>
<br>
<br>
<o:p></o:p></p>
<blockquote style=3D"margin-top:5.0pt;margin-bottom:5.0pt">
<p class=3D"MsoNormal">To make this attack work, every packet in the attack=
 flow may need to have<o:p></o:p></p>
</blockquote>
<p class=3D"MsoNormal">a unique, spoofed, source LOC.<br>
<br>
An implementation can detect that after rate limiting 1000s of such request=
s<br>
are happening that it just stops operation.<br>
<br>
What if I sent a Juniper 20 million routes today?<br>
<br>
The Internet is very fragile and LISP IS NOT making it worse. And in some<b=
r>
cases it is making it better with integrated techniques.<br>
<br>
Dino<o:p></o:p></p>
</blockquote>
<p class=3D"MsoNormal"><br>
_______________________________________________<br>
lisp mailing list<br>
<a href=3D"mailto:lisp@ietf.org">lisp@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/lisp">https://www.ietf.org=
/mailman/listinfo/lisp</a><o:p></o:p></p>
</blockquote>
</div>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
</div>
</div>
</div>
</body>
</html>

--_000_dd849ce0cca749c885c5b8a1e989f758CO1PR05MB442namprd05pro_--


From nobody Mon May 26 04:03:51 2014
Return-Path: <rogerj@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 570111A00F4 for <lisp@ietfa.amsl.com>; Mon, 26 May 2014 04:03:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.7
X-Spam-Level: 
X-Spam-Status: No, score=-1.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, MIME_8BIT_HEADER=0.3, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0iK6TJA2WgQC for <lisp@ietfa.amsl.com>; Mon, 26 May 2014 04:03:48 -0700 (PDT)
Received: from mail-wg0-x22a.google.com (mail-wg0-x22a.google.com [IPv6:2a00:1450:400c:c00::22a]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 083C91A00DE for <lisp@ietf.org>; Mon, 26 May 2014 04:03:47 -0700 (PDT)
Received: by mail-wg0-f42.google.com with SMTP id y10so7642865wgg.1 for <lisp@ietf.org>; Mon, 26 May 2014 04:03:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=tf8+MFoHKc9YT0Xb2zWwk7aMf2LruCraX/XwU0qtWf4=; b=i4BiAeeJPwqx0rgEJnpn2oo1a00Kqkymb0VaCeRTt1BpoZiUrY8lAnzuT+OzFBPnaa 0K1C0WZKVC1F1vUVnZXqzSReeMwrGQ7JahYhwJ6vkpBjwgQI1F3ye1VWLA8G/+pqJolT R6YwfpLaKD87cwA49plDJirInpFNz9g71qJSJ3Uv3+t5A7W48EMBhVV672tKhwBdpOdN z0N0tHrX8nExtYicly64z2eNcJjAhYZVNHTv73v/T70yH7XSEnuf3NpNgLfFYhqXwuSW ChIKmg7E7jIO0gUXDESsf0dU1pwU1B+odFDaIy8kdGvtjtE1xhnpLyhxqlwL4E3ccVdM kpGg==
MIME-Version: 1.0
X-Received: by 10.180.19.37 with SMTP id b5mr1975610wie.16.1401102224177; Mon, 26 May 2014 04:03:44 -0700 (PDT)
Received: by 10.216.210.6 with HTTP; Mon, 26 May 2014 04:03:44 -0700 (PDT)
In-Reply-To: <16a14e1029954a9cb74c6115dd3c1a71@CO2PR05MB636.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <B3FF60AE-ED9D-45E6-BBB5-AE3F6C6172F8@gmail.com> <16a14e1029954a9cb74c6115dd3c1a71@CO2PR05MB636.namprd05.prod.outlook.com>
Date: Mon, 26 May 2014 13:03:44 +0200
Message-ID: <CAKFn1SGo44M4kDhcgPTv54QQ450Q-dXPf1bggELRRpwxQgODYA@mail.gmail.com>
From: =?UTF-8?Q?Roger_J=C3=B8rgensen?= <rogerj@gmail.com>
To: Ross Callon <rcallon@juniper.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/j_5YnBM-cjfZ3COl1Lni_N1-uzA
Cc: LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 26 May 2014 11:03:49 -0000

A general reply, we were on the way to getting into a head-to-head
discussion instead of being constructive. The last few email I read
moved away from that path.

I think we should discuss all threat, not just define them to be out of sco=
pe.



some comments:


On Fri, May 23, 2014 at 4:36 PM, Ross Callon <rcallon@juniper.net> wrote:
> Detailed comments below. To summarize, these details include three threat=
s which are new to LISP and which are not adequately explained in the curre=
nt threats document:
>
>  (1) The Control Plane Threat: LISP allows a dataplane DOS attack (lots o=
f packets sent to overwhelm a site) to turn into a control plane attack (th=
e router is forced to respond to the attack in the control plane, which is =
of course frequently multiple orders of magnitude slower than the data plan=
e, particularly for very high speed routers).

Seems like we all disagree on how serious this is, how much harm it
can do. But it should be mention.

I think I remember an earlier discussion on a very similar topic that
just ended with people disagreeing and stopped discussing it.
This is probably a new topic, but where is the weakness really,
Mapping-System or on the xTR side? ...?
Could be that our ongoing discussion here might be because it's not
good enough explained?



>  (2) The Privacy Threat: LISP provides an attacker with a relatively easy=
 way to determine the identity of large numbers of PE and/or CE routers (gl=
obally, if LISP is deployed on that level) .

I agree there are privacy threats.

LISP is no better or worse compared to current internet on privacy for
end-user, it's reveled one way or another somehow unless you encrypt
your data (HTTPs etc).
What LISP add to the pool is the possibility to collect the IP for
many end-sites with ease, xTR sides. Is that the same thing as what
you're describing?



>  (3) the Traffic Gleaning Threat: If an xTR gleans EID -> RLOC mappings f=
rom incoming packets, this provides an easy way for hackers to intercept tr=
affic. I put this threat third because gleaning can be turned off, and thus=
 this threat can be defeated simply by not gleaning EID -> RLOC mappings.

Isn't this the same as on-path and Man-in-the-middle attack? Or do you
describe something else?




--=20

Roger Jorgensen           | ROJO9-RIPE
rogerj@gmail.com          | - IPv6 is The Key!
http://www.jorgensen.no   | roger@jorgensen.no


From nobody Mon May 26 08:46:43 2014
Return-Path: <jmh@joelhalpern.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A93031A01AF for <lisp@ietfa.amsl.com>; Mon, 26 May 2014 08:46:41 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Level: 
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aZxlQIlT5USq for <lisp@ietfa.amsl.com>; Mon, 26 May 2014 08:46:40 -0700 (PDT)
Received: from mailc1.tigertech.net (mailc1.tigertech.net [208.80.4.155]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EE9F11A01A0 for <lisp@ietf.org>; Mon, 26 May 2014 08:46:39 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mailc1.tigertech.net (Postfix) with ESMTP id CDEAE1C9B252; Mon, 26 May 2014 08:46:36 -0700 (PDT)
X-Virus-Scanned: Debian amavisd-new at c1.tigertech.net
Received: from Joels-MacBook-Pro.local (pool-70-106-135-10.clppva.east.verizon.net [70.106.135.10]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mailc1.tigertech.net (Postfix) with ESMTPSA id 7F1201C9B24C; Mon, 26 May 2014 08:46:35 -0700 (PDT)
Message-ID: <538361DA.10808@joelhalpern.com>
Date: Mon, 26 May 2014 11:46:34 -0400
From: "Joel M. Halpern" <jmh@joelhalpern.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.5.0
MIME-Version: 1.0
To: Ronald Bonica <rbonica@juniper.net>,  Damien Saucez <damien.saucez@gmail.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com>
In-Reply-To: <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 8bit
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/Lh5ywkvrAjPzvfEaN4FeZMFQ-gA
Cc: Roger Jorgensen <rogerj@gmail.com>, LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 26 May 2014 15:46:41 -0000

Top posting to make sure I am understanding:

You asssert that any xTR is subject to a DoS attack.  And that such a 
DoS attack can render the mapping system unusable.

It targeting an ITR, this would need to be from within ths cope the ITR 
serves.  I believe that is discussed.

If I have connected the dots correctly, the attack you are contemplating 
is sending a large stream of packets with different inner source 
addresses to an ETR.  This would prompt the ETR to check with the 
mapping system about each and every address.

If I have understood this properly, while there are several very 
effective mitigations, that does not change the basic message that this 
is an attack, and as such ought to be described in the threats document. 
  There are clealry a number of variations on this attack.  For example, 
using the same outer source address makes mitigation easier, while using 
different outer source addresses either requires a bot-net or a large 
unchecked BCP38 hole (and those can be used for MANY attacks on many 
systems.)  Both presumably should be described.

Have I captured your request accurately?

Yours,
Joel

On 5/26/14, 1:06 AM, Ronald Bonica wrote:
> *From:*Damien Saucez [mailto:damien.saucez@gmail.com]
> *Sent:* Friday, May 23, 2014 9:07 AM
> *To:* Ronald Bonica
> *Cc:* Dino Farinacci; Roger Jorgensen; LISP mailing list list
> *Subject:* Re: [lisp] Restarting last call on LISP threats
>
> Hello Ronald,
>
> On 22 May 2014, at 22:57, Ronald Bonica <rbonica@juniper.net
> <mailto:rbonica@juniper.net>> wrote:
>
>
>
>     Dino,
>
>     Today's Internet is not as fragile as you think. This mail traversed
>     many routers between my house and yours. If those routers are
>     well-managed, there is nothing that I can do from my house that will
>     cause any of those routers to consume control plane resources.
>     Therefore, there is nothing that I can do from my house that will
>     cause a DoS attack against those routers' control planes.
>
> We tend to disagree with that, for example you have ICMP today...
>
> */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn’t make a
> very good routing protocol. That’s why we don’t use it for routing. By
> contrast, LISP map-request messages are susceptible to DoS attacks and
> they do carry routing information./*
>
>
>
>     In LISP, separation between the forwarding and control plane is
>     lost. As a matter of course, forwarding plane activity causes
>     control plane activity. Since forwarding plane bandwidth exceeds
>     control plane bandwidth, DoS attacks against the control plane are
>     possible.
>
>     In order to be complete, the threats document must describe the DoS
>     threat. It should also describe mitigations, if any exist.
>
> DoS is already explained and the definition given:
>
> " A Denial of Service (DoS) attack aims at disrupting a specific
>
>     targeted service either by exhausting the resources of the victim up
>
>     to the point that it is not able to provide a reliable service to
>
>     legit traffic and/or systems or by exploiting vulnerabilities to make
>
>     the targeted service unable to operate properly.
>
> "
>
> is covering the case you mention.
>
> */[RPB] /*
>
> */You might want to add the following details to section 5.2:/*
>
> *//*
>
> -A DoS attack can be launched by anybody who can send a packet to the
> XTR’s LOC
>
> -DoS attacks can render an XTR inoperable
>
> -DDoS attacks can render the mapping system inoperable.
>
> This is what differentiates LISP from today’s routing system.
>
>                                        Ron
>
> Damien Saucez
>
>
>
>                                                                                                    Ron
>
>
>
>         -----Original Message-----
>         From: Dino Farinacci [mailto:farinacci@gmail.com]
>         Sent: Wednesday, May 21, 2014 6:58 PM
>         To: Ronald Bonica
>         Cc: Roger Jorgensen; lisp@ietf.org <mailto:lisp@ietf.org>
>         Subject: Re: [lisp] Restarting last call on LISP threats
>
>
>             The attacker sends a flow of crafted packets to the victim
>             XTR. Each packet
>
>         is a well-formed LISP data packet. It contains:
>
>
>             - an outer IP header (LOC->LOC)
>             - a UDP header
>             - a LISP Header
>             - an IP header (EID->EID)
>             - payload
>
>
>         Just like a regular packet I can send to your home router today.
>         So yes okay.
>         So let's continue. See comments below.
>
>
>             Each packet contains control plane information that is new
>             to the victim
>
>
>         Be more specific about what control information are in these
>         encapsulated
>         packets.
>
>
>             XTR. For example, the victim XTR has no mapping information
>             regarding
>
>         either the source LOC or source EID prefix. Rather than gleaning
>         this mapping
>         information from the crafted packet, the victim XTR sends a
>         verifying MAP-
>         REQUEST to the mapping system.
>
>
>             Assume that the attack flow is large (N packets per second).
>             Assume also
>
>         that the XTRs rate limit for MAP-REQUEST messages is less than N
>         packets
>         per second. Has the attack not effectively DoS'd the victim XTR?
>
>         It caches the rate the rate the packets are coming in and
>         eventually stops
>         sending Map-Requests completely.
>
>         It cannot stop the incoming rate of packets today just like a
>         roque BGP
>         attacker can send millions of packets per second to a peer
>         regardless if it
>         does or does not have the peer authentication key.
>
>
>             To make this attack work, every packet in the attack flow
>             may need to have
>
>         a unique, spoofed, source LOC.
>
>         An implementation can detect that after rate limiting 1000s of
>         such requests
>         are happening that it just stops operation.
>
>         What if I sent a Juniper 20 million routes today?
>
>         The Internet is very fragile and LISP IS NOT making it worse.
>         And in some
>         cases it is making it better with integrated techniques.
>
>         Dino
>
>
>     _______________________________________________
>     lisp mailing list
>     lisp@ietf.org <mailto:lisp@ietf.org>
>     https://www.ietf.org/mailman/listinfo/lisp
>
>
>
> _______________________________________________
> lisp mailing list
> lisp@ietf.org
> https://www.ietf.org/mailman/listinfo/lisp
>


From nobody Mon May 26 08:57:50 2014
Return-Path: <rbonica@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF8AA1A01A9 for <lisp@ietfa.amsl.com>; Mon, 26 May 2014 08:57:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.601
X-Spam-Level: 
X-Spam-Status: No, score=-102.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jP7aqjJ3J4Ut for <lisp@ietfa.amsl.com>; Mon, 26 May 2014 08:57:44 -0700 (PDT)
Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2lp0208.outbound.protection.outlook.com [207.46.163.208]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D0C691A01A0 for <lisp@ietf.org>; Mon, 26 May 2014 08:57:43 -0700 (PDT)
Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB441.namprd05.prod.outlook.com (10.141.73.147) with Microsoft SMTP Server (TLS) id 15.0.949.11; Mon, 26 May 2014 15:57:38 +0000
Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) with mapi id 15.00.0949.001; Mon, 26 May 2014 15:57:37 +0000
From: Ronald Bonica <rbonica@juniper.net>
To: "Joel M. Halpern" <jmh@joelhalpern.com>, Damien Saucez <damien.saucez@gmail.com>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEIABfmkAgAefyVCAAITngIABbBJggAETbwCABC0O0IAAtqUAgAABTnA=
Date: Mon, 26 May 2014 15:57:37 +0000
Message-ID: <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com> <538361DA.10808@joelhalpern.com>
In-Reply-To: <538361DA.10808@joelhalpern.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.14]
x-forefront-prvs: 02234DBFF6
x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(199002)(189002)(24454002)(479174003)(377454003)(51704005)(13464003)(54356999)(87936001)(50986999)(76176999)(83072002)(2656002)(85852003)(74502001)(99396002)(99286001)(74662001)(31966008)(4396001)(19580395003)(83322001)(19580405001)(15975445006)(21056001)(101416001)(92566001)(77982001)(46102001)(76482001)(86362001)(66066001)(64706001)(80022001)(20776003)(81342001)(33646001)(76576001)(81542001)(74316001)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO1PR05MB441; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; 
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/KIYmUW5Il0RorgUSx1MNocOQY6I
Cc: Roger Jorgensen <rogerj@gmail.com>, LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 26 May 2014 15:57:47 -0000

Inline.....

> -----Original Message-----
> From: Joel M. Halpern [mailto:jmh@joelhalpern.com]
> Sent: Monday, May 26, 2014 11:47 AM
> To: Ronald Bonica; Damien Saucez
> Cc: Roger Jorgensen; LISP mailing list list
> Subject: Re: [lisp] Restarting last call on LISP threats
>=20
> Top posting to make sure I am understanding:
>=20
> You asssert that any xTR is subject to a DoS attack.  And that such a DoS
> attack can render the mapping system unusable.
[RPB]=20
Exactly!

>=20
> It targeting an ITR, this would need to be from within ths cope the ITR s=
erves.
[RPB]=20
I don't understand this sentence. Please try again.

> I believe that is discussed.
[RPB]=20
Given that I don't understand the sentence above, I have no idea if this se=
ntence is true.

>=20
> If I have connected the dots correctly, the attack you are contemplating =
is
> sending a large stream of packets with different inner source addresses t=
o an
> ETR.  This would prompt the ETR to check with the mapping system about
> each and every address.
[RPB]=20
Exactly!

>=20
> If I have understood this properly, while there are several very effectiv=
e
> mitigations, that does not change the basic message that this is an attac=
k, and
> as such ought to be described in the threats document.
[RPB]=20
Even if there are effective mitigations, the attack should be described.

However, I am not convinced that an effective mitigation exists.

>   There are clealry a number of variations on this attack.
[RPB]=20
True!

  For example, using
> the same outer source address makes mitigation easier, while using differ=
ent
> outer source addresses either requires a bot-net or a large unchecked BCP=
38
> hole (and those can be used for MANY attacks on many
> systems.)  Both presumably should be described.
[RPB]=20
Yes, both should be described.

Also, recall that large BCP38 holes exist in today's internet.

>=20
> Have I captured your request accurately?
[RPB]=20
Pretty much.

Thanks for taking the effort.

                    Ron

>=20
> Yours,
> Joel
>=20
> On 5/26/14, 1:06 AM, Ronald Bonica wrote:
> > *From:*Damien Saucez [mailto:damien.saucez@gmail.com]
> > *Sent:* Friday, May 23, 2014 9:07 AM
> > *To:* Ronald Bonica
> > *Cc:* Dino Farinacci; Roger Jorgensen; LISP mailing list list
> > *Subject:* Re: [lisp] Restarting last call on LISP threats
> >
> > Hello Ronald,
> >
> > On 22 May 2014, at 22:57, Ronald Bonica <rbonica@juniper.net
> > <mailto:rbonica@juniper.net>> wrote:
> >
> >
> >
> >     Dino,
> >
> >     Today's Internet is not as fragile as you think. This mail traverse=
d
> >     many routers between my house and yours. If those routers are
> >     well-managed, there is nothing that I can do from my house that wil=
l
> >     cause any of those routers to consume control plane resources.
> >     Therefore, there is nothing that I can do from my house that will
> >     cause a DoS attack against those routers' control planes.
> >
> > We tend to disagree with that, for example you have ICMP today...
> >
> > */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn't make a
> > very good routing protocol. That's why we don't use it for routing. By
> > contrast, LISP map-request messages are susceptible to DoS attacks and
> > they do carry routing information./*
> >
> >
> >
> >     In LISP, separation between the forwarding and control plane is
> >     lost. As a matter of course, forwarding plane activity causes
> >     control plane activity. Since forwarding plane bandwidth exceeds
> >     control plane bandwidth, DoS attacks against the control plane are
> >     possible.
> >
> >     In order to be complete, the threats document must describe the DoS
> >     threat. It should also describe mitigations, if any exist.
> >
> > DoS is already explained and the definition given:
> >
> > " A Denial of Service (DoS) attack aims at disrupting a specific
> >
> >     targeted service either by exhausting the resources of the victim
> > up
> >
> >     to the point that it is not able to provide a reliable service to
> >
> >     legit traffic and/or systems or by exploiting vulnerabilities to
> > make
> >
> >     the targeted service unable to operate properly.
> >
> > "
> >
> > is covering the case you mention.
> >
> > */[RPB] /*
> >
> > */You might want to add the following details to section 5.2:/*
> >
> > *//*
> >
> > -A DoS attack can be launched by anybody who can send a packet to the
> > XTR's LOC
> >
> > -DoS attacks can render an XTR inoperable
> >
> > -DDoS attacks can render the mapping system inoperable.
> >
> > This is what differentiates LISP from today's routing system.
> >
> >                                        Ron
> >
> > Damien Saucez
> >
> >
> >
> >
> > Ron
> >
> >
> >
> >         -----Original Message-----
> >         From: Dino Farinacci [mailto:farinacci@gmail.com]
> >         Sent: Wednesday, May 21, 2014 6:58 PM
> >         To: Ronald Bonica
> >         Cc: Roger Jorgensen; lisp@ietf.org <mailto:lisp@ietf.org>
> >         Subject: Re: [lisp] Restarting last call on LISP threats
> >
> >
> >             The attacker sends a flow of crafted packets to the victim
> >             XTR. Each packet
> >
> >         is a well-formed LISP data packet. It contains:
> >
> >
> >             - an outer IP header (LOC->LOC)
> >             - a UDP header
> >             - a LISP Header
> >             - an IP header (EID->EID)
> >             - payload
> >
> >
> >         Just like a regular packet I can send to your home router today=
.
> >         So yes okay.
> >         So let's continue. See comments below.
> >
> >
> >             Each packet contains control plane information that is new
> >             to the victim
> >
> >
> >         Be more specific about what control information are in these
> >         encapsulated
> >         packets.
> >
> >
> >             XTR. For example, the victim XTR has no mapping information
> >             regarding
> >
> >         either the source LOC or source EID prefix. Rather than gleanin=
g
> >         this mapping
> >         information from the crafted packet, the victim XTR sends a
> >         verifying MAP-
> >         REQUEST to the mapping system.
> >
> >
> >             Assume that the attack flow is large (N packets per second)=
.
> >             Assume also
> >
> >         that the XTRs rate limit for MAP-REQUEST messages is less than =
N
> >         packets
> >         per second. Has the attack not effectively DoS'd the victim XTR=
?
> >
> >         It caches the rate the rate the packets are coming in and
> >         eventually stops
> >         sending Map-Requests completely.
> >
> >         It cannot stop the incoming rate of packets today just like a
> >         roque BGP
> >         attacker can send millions of packets per second to a peer
> >         regardless if it
> >         does or does not have the peer authentication key.
> >
> >
> >             To make this attack work, every packet in the attack flow
> >             may need to have
> >
> >         a unique, spoofed, source LOC.
> >
> >         An implementation can detect that after rate limiting 1000s of
> >         such requests
> >         are happening that it just stops operation.
> >
> >         What if I sent a Juniper 20 million routes today?
> >
> >         The Internet is very fragile and LISP IS NOT making it worse.
> >         And in some
> >         cases it is making it better with integrated techniques.
> >
> >         Dino
> >
> >
> >     _______________________________________________
> >     lisp mailing list
> >     lisp@ietf.org <mailto:lisp@ietf.org>
> >     https://www.ietf.org/mailman/listinfo/lisp
> >
> >
> >
> > _______________________________________________
> > lisp mailing list
> > lisp@ietf.org
> > https://www.ietf.org/mailman/listinfo/lisp
> >


From nobody Mon May 26 09:06:33 2014
Return-Path: <sbarkai@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 36FE71A019B for <lisp@ietfa.amsl.com>; Mon, 26 May 2014 09:06:29 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level: 
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9,  DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fy9KKBb29Qv9 for <lisp@ietfa.amsl.com>; Mon, 26 May 2014 09:06:27 -0700 (PDT)
Received: from mail-yh0-x236.google.com (mail-yh0-x236.google.com [IPv6:2607:f8b0:4002:c01::236]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E49B21A01A5 for <lisp@ietf.org>; Mon, 26 May 2014 09:06:26 -0700 (PDT)
Received: by mail-yh0-f54.google.com with SMTP id i57so6623529yha.27 for <lisp@ietf.org>; Mon, 26 May 2014 09:06:23 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=eDqAZJieCZ+CXwgHLWgeqhU19ZjiaNspnTwfN+IFgi4=; b=Zm1kFbx+Q5U6N2oYM/2tuP5qj7kwevaCDhg7cdWU+KrFHQ/uvYHzhcoLB3GYEaQ1nQ 0Ft60Iq1UPb7LOD9H/Xl5Xiw5ZaezMcMj0YHoI6Q5WwyC/nrQe6Nd6vtfSLKlLwZGnJS F1P1t4kulCU1nw7zIcioqO6a1sBOguP/HG9oZjgzw6lLvm34q3r57aEIHBBGoGB2RGF8 raGp5Sj6lX7eG3DKBgWZklajAa70UPzldBz5FiBzSHrMq0bYypBmpTpXF/FhHYmu5bOt d2JNZmnNtOmjYz62mvWIRHfSJy48uedZxv4S1FXyuko87t8HWe4gQ9QlLqnVM+kOp2Af 6k0w==
X-Received: by 10.236.129.43 with SMTP id g31mr36266111yhi.86.1401120383828; Mon, 26 May 2014 09:06:23 -0700 (PDT)
Received: from [192.168.1.102] (108-214-96-27.lightspeed.sntcca.sbcglobal.net. [108.214.96.27]) by mx.google.com with ESMTPSA id 37sm8084063yhu.26.2014.05.26.09.06.22 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 26 May 2014 09:06:23 -0700 (PDT)
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (1.0)
From: Sharon <sbarkai@gmail.com>
X-Mailer: iPhone Mail (11D201)
In-Reply-To: <538361DA.10808@joelhalpern.com>
Date: Mon, 26 May 2014 09:06:21 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <BDAC9F7C-1205-4A59-A252-2B20998E187B@gmail.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com> <538361DA.10808@joelhalpern.com>
To: "Joel M. Halpern" <jmh@joelhalpern.com>
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/TdsY8DkP6mf_fLp2I2pZiMlaDm0
Cc: Roger Jorgensen <rogerj@gmail.com>, LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 26 May 2014 16:06:29 -0000

Joel, thanks for clearing.
It was hard to follow.

If the challenge is for a distributed mapping system to keep track and prote=
ct itself from a "sick" xTR, sick because of a bug or an attack..
Then perhaps we could maintain mapping lookup per sec counters per xTR in th=
e mapping. It adds some overhead to the mapping, but doesn't slow down forwa=
rding. Can be aggregated by map servers for efficiency.

--szb

On May 26, 2014, at 8:46 AM, "Joel M. Halpern" <jmh@joelhalpern.com> wrote:

Top posting to make sure I am understanding:

You asssert that any xTR is subject to a DoS attack.  And that such a DoS at=
tack can render the mapping system unusable.

It targeting an ITR, this would need to be from within ths cope the ITR serv=
es.  I believe that is discussed.

If I have connected the dots correctly, the attack you are contemplating is s=
ending a large stream of packets with different inner source addresses to an=
 ETR.  This would prompt the ETR to check with the mapping system about each=
 and every address.

If I have understood this properly, while there are several very effective m=
itigations, that does not change the basic message that this is an attack, a=
nd as such ought to be described in the threats document.  There are clealry=
 a number of variations on this attack.  For example, using the same outer s=
ource address makes mitigation easier, while using different outer source ad=
dresses either requires a bot-net or a large unchecked BCP38 hole (and those=
 can be used for MANY attacks on many systems.)  Both presumably should be d=
escribed.

Have I captured your request accurately?

Yours,
Joel

> On 5/26/14, 1:06 AM, Ronald Bonica wrote:
> *From:*Damien Saucez [mailto:damien.saucez@gmail.com]
> *Sent:* Friday, May 23, 2014 9:07 AM
> *To:* Ronald Bonica
> *Cc:* Dino Farinacci; Roger Jorgensen; LISP mailing list list
> *Subject:* Re: [lisp] Restarting last call on LISP threats
>=20
> Hello Ronald,
>=20
> On 22 May 2014, at 22:57, Ronald Bonica <rbonica@juniper.net
> <mailto:rbonica@juniper.net>> wrote:
>=20
>=20
>=20
>    Dino,
>=20
>    Today's Internet is not as fragile as you think. This mail traversed
>    many routers between my house and yours. If those routers are
>    well-managed, there is nothing that I can do from my house that will
>    cause any of those routers to consume control plane resources.
>    Therefore, there is nothing that I can do from my house that will
>    cause a DoS attack against those routers' control planes.
>=20
> We tend to disagree with that, for example you have ICMP today...
>=20
> */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn=E2=80=99t ma=
ke a
> very good routing protocol. That=E2=80=99s why we don=E2=80=99t use it for=
 routing. By
> contrast, LISP map-request messages are susceptible to DoS attacks and
> they do carry routing information./*
>=20
>=20
>=20
>    In LISP, separation between the forwarding and control plane is
>    lost. As a matter of course, forwarding plane activity causes
>    control plane activity. Since forwarding plane bandwidth exceeds
>    control plane bandwidth, DoS attacks against the control plane are
>    possible.
>=20
>    In order to be complete, the threats document must describe the DoS
>    threat. It should also describe mitigations, if any exist.
>=20
> DoS is already explained and the definition given:
>=20
> " A Denial of Service (DoS) attack aims at disrupting a specific
>=20
>    targeted service either by exhausting the resources of the victim up
>=20
>    to the point that it is not able to provide a reliable service to
>=20
>    legit traffic and/or systems or by exploiting vulnerabilities to make
>=20
>    the targeted service unable to operate properly.
>=20
> "
>=20
> is covering the case you mention.
>=20
> */[RPB] /*
>=20
> */You might want to add the following details to section 5.2:/*
>=20
> *//*
>=20
> -A DoS attack can be launched by anybody who can send a packet to the
> XTR=E2=80=99s LOC
>=20
> -DoS attacks can render an XTR inoperable
>=20
> -DDoS attacks can render the mapping system inoperable.
>=20
> This is what differentiates LISP from today=E2=80=99s routing system.
>=20
>                                       Ron
>=20
> Damien Saucez
>=20
>=20
>=20
>                                                                           =
                        Ron
>=20
>=20
>=20
>        -----Original Message-----
>        From: Dino Farinacci [mailto:farinacci@gmail.com]
>        Sent: Wednesday, May 21, 2014 6:58 PM
>        To: Ronald Bonica
>        Cc: Roger Jorgensen; lisp@ietf.org <mailto:lisp@ietf.org>
>        Subject: Re: [lisp] Restarting last call on LISP threats
>=20
>=20
>            The attacker sends a flow of crafted packets to the victim
>            XTR. Each packet
>=20
>        is a well-formed LISP data packet. It contains:
>=20
>=20
>            - an outer IP header (LOC->LOC)
>            - a UDP header
>            - a LISP Header
>            - an IP header (EID->EID)
>            - payload
>=20
>=20
>        Just like a regular packet I can send to your home router today.
>        So yes okay.
>        So let's continue. See comments below.
>=20
>=20
>            Each packet contains control plane information that is new
>            to the victim
>=20
>=20
>        Be more specific about what control information are in these
>        encapsulated
>        packets.
>=20
>=20
>            XTR. For example, the victim XTR has no mapping information
>            regarding
>=20
>        either the source LOC or source EID prefix. Rather than gleaning
>        this mapping
>        information from the crafted packet, the victim XTR sends a
>        verifying MAP-
>        REQUEST to the mapping system.
>=20
>=20
>            Assume that the attack flow is large (N packets per second).
>            Assume also
>=20
>        that the XTRs rate limit for MAP-REQUEST messages is less than N
>        packets
>        per second. Has the attack not effectively DoS'd the victim XTR?
>=20
>        It caches the rate the rate the packets are coming in and
>        eventually stops
>        sending Map-Requests completely.
>=20
>        It cannot stop the incoming rate of packets today just like a
>        roque BGP
>        attacker can send millions of packets per second to a peer
>        regardless if it
>        does or does not have the peer authentication key.
>=20
>=20
>            To make this attack work, every packet in the attack flow
>            may need to have
>=20
>        a unique, spoofed, source LOC.
>=20
>        An implementation can detect that after rate limiting 1000s of
>        such requests
>        are happening that it just stops operation.
>=20
>        What if I sent a Juniper 20 million routes today?
>=20
>        The Internet is very fragile and LISP IS NOT making it worse.
>        And in some
>        cases it is making it better with integrated techniques.
>=20
>        Dino
>=20
>=20
>    _______________________________________________
>    lisp mailing list
>    lisp@ietf.org <mailto:lisp@ietf.org>
>    https://www.ietf.org/mailman/listinfo/lisp
>=20
>=20
>=20
> _______________________________________________
> lisp mailing list
> lisp@ietf.org
> https://www.ietf.org/mailman/listinfo/lisp
>=20

_______________________________________________
lisp mailing list
lisp@ietf.org
https://www.ietf.org/mailman/listinfo/lisp


From nobody Mon May 26 12:28:24 2014
Return-Path: <pvinci@VinciConsulting.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 579F11A0230 for <lisp@ietfa.amsl.com>; Mon, 26 May 2014 12:28:24 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TFKngmTVcVZE for <lisp@ietfa.amsl.com>; Mon, 26 May 2014 12:28:22 -0700 (PDT)
Received: from exchange.vinci-consulting-corp.com (exchange.vinci-consulting-corp.com [38.125.5.16]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 730BD1A0226 for <lisp@ietf.org>; Mon, 26 May 2014 12:28:22 -0700 (PDT)
Received: from NYDC-EXCH01.vinci-consulting-corp.local ([::1]) by NYDC-EXCH01.vinci-consulting-corp.local ([::1]) with mapi id 14.02.0387.000; Mon, 26 May 2014 15:28:18 -0400
From: Paul Vinciguerra <pvinci@VinciConsulting.com>
To: Ronald Bonica <rbonica@juniper.net>, "Joel M. Halpern" <jmh@joelhalpern.com>, Damien Saucez <damien.saucez@gmail.com>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa57mKa1BYIPtIUu5uyhXkNgDA5s9MyiAgAD04oCAAJ/u8IAAAtXQgAE1s4CAAm1DAIABaYAAgAeql4CAAHoZgIABcK+AgAEO0wCABDDMAIAAsuYAgAADF4D//88GbA==
Date: Mon, 26 May 2014 19:28:17 +0000
Message-ID: <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com> <538361DA.10808@joelhalpern.com>, <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com>
In-Reply-To: <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [199.119.75.37]
x-kse-antivirus-interceptor-info: scan successful
x-kse-antivirus-info: Clean
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/J1TU4TGP5tCTFVqmTBUJCO2GBPQ
Cc: Roger Jorgensen <rogerj@gmail.com>, LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 26 May 2014 19:28:24 -0000

Every host on the Internet is subject to a DoS attack.  An xTR is no more s=
o.  I am also not clear on how a DoS attack on an xTR would create any more=
 risk than an attack directly against the mapping system.  =0A=
=0A=
Joel describes Ronald's scenario of an attack where a large stream of packe=
ts with different inner source addresses to an ETR.  I don't call this an a=
ttack.  I call this our steady-state.  These would be the PxTR's we operate=
 across the US.  The PxTR's on the beta-network are no different.  We take =
in packets from anywhere.  This is a "Free" attacker if you will.  All that=
 really means is that you do not have to incur the computational cost of en=
capsulating the packet.=0A=
=0A=
I would defer to Dino and others on the list, but I do not believe that the=
 ETR does a reverse lookup on every packet.  At least that is not the behav=
ior we observe.  What we see happen is that the packet is decapsulated and =
sent to the destination.  If a valid destination host responds, then the IT=
R does a map-request for the reply packet.  There is not a 1:1 relationship=
 between the number of packets and the number of map-requests.=0A=
=0A=
Map-replies for IP addresses return prefixes. These prefixes can cover larg=
er address spaces than the map-request and limit the number of future map-r=
equests needed.=0A=
=0A=
Can you provide more specific details on how you see the xTR rendering the =
mapping system unusable? =0A=
=0A=
For what its worth, I still support the decision for last call and not to p=
lace mitigations within the document.  Without knowing the specifics of a c=
onfiguration and implementation, that just leads to a false sense of securi=
ty.  =0A=
=0A=
       =0A=
________________________________________=0A=
From: lisp [lisp-bounces@ietf.org] on behalf of Ronald Bonica [rbonica@juni=
per.net]=0A=
Sent: Monday, May 26, 2014 11:57 AM=0A=
To: Joel M. Halpern; Damien Saucez=0A=
Cc: Roger Jorgensen; LISP mailing list list=0A=
Subject: Re: [lisp] Restarting last call on LISP threats=0A=
=0A=
Inline.....=0A=
=0A=
> -----Original Message-----=0A=
> From: Joel M. Halpern [mailto:jmh@joelhalpern.com]=0A=
> Sent: Monday, May 26, 2014 11:47 AM=0A=
> To: Ronald Bonica; Damien Saucez=0A=
> Cc: Roger Jorgensen; LISP mailing list list=0A=
> Subject: Re: [lisp] Restarting last call on LISP threats=0A=
>=0A=
> Top posting to make sure I am understanding:=0A=
>=0A=
> You asssert that any xTR is subject to a DoS attack.  And that such a DoS=
=0A=
> attack can render the mapping system unusable.=0A=
[RPB]=0A=
Exactly!=0A=
=0A=
>=0A=
> It targeting an ITR, this would need to be from within ths cope the ITR s=
erves.=0A=
[RPB]=0A=
I don't understand this sentence. Please try again.=0A=
=0A=
> I believe that is discussed.=0A=
[RPB]=0A=
Given that I don't understand the sentence above, I have no idea if this se=
ntence is true.=0A=
=0A=
>=0A=
> If I have connected the dots correctly, the attack you are contemplating =
is=0A=
> sending a large stream of packets with different inner source addresses t=
o an=0A=
> ETR.  This would prompt the ETR to check with the mapping system about=0A=
> each and every address.=0A=
[RPB]=0A=
Exactly!=0A=
=0A=
>=0A=
> If I have understood this properly, while there are several very effectiv=
e=0A=
> mitigations, that does not change the basic message that this is an attac=
k, and=0A=
> as such ought to be described in the threats document.=0A=
[RPB]=0A=
Even if there are effective mitigations, the attack should be described.=0A=
=0A=
However, I am not convinced that an effective mitigation exists.=0A=
=0A=
>   There are clealry a number of variations on this attack.=0A=
[RPB]=0A=
True!=0A=
=0A=
  For example, using=0A=
> the same outer source address makes mitigation easier, while using differ=
ent=0A=
> outer source addresses either requires a bot-net or a large unchecked BCP=
38=0A=
> hole (and those can be used for MANY attacks on many=0A=
> systems.)  Both presumably should be described.=0A=
[RPB]=0A=
Yes, both should be described.=0A=
=0A=
Also, recall that large BCP38 holes exist in today's internet.=0A=
=0A=
>=0A=
> Have I captured your request accurately?=0A=
[RPB]=0A=
Pretty much.=0A=
=0A=
Thanks for taking the effort.=0A=
=0A=
                    Ron=0A=
=0A=
>=0A=
> Yours,=0A=
> Joel=0A=
>=0A=
> On 5/26/14, 1:06 AM, Ronald Bonica wrote:=0A=
> > *From:*Damien Saucez [mailto:damien.saucez@gmail.com]=0A=
> > *Sent:* Friday, May 23, 2014 9:07 AM=0A=
> > *To:* Ronald Bonica=0A=
> > *Cc:* Dino Farinacci; Roger Jorgensen; LISP mailing list list=0A=
> > *Subject:* Re: [lisp] Restarting last call on LISP threats=0A=
> >=0A=
> > Hello Ronald,=0A=
> >=0A=
> > On 22 May 2014, at 22:57, Ronald Bonica <rbonica@juniper.net=0A=
> > <mailto:rbonica@juniper.net>> wrote:=0A=
> >=0A=
> >=0A=
> >=0A=
> >     Dino,=0A=
> >=0A=
> >     Today's Internet is not as fragile as you think. This mail traverse=
d=0A=
> >     many routers between my house and yours. If those routers are=0A=
> >     well-managed, there is nothing that I can do from my house that wil=
l=0A=
> >     cause any of those routers to consume control plane resources.=0A=
> >     Therefore, there is nothing that I can do from my house that will=
=0A=
> >     cause a DoS attack against those routers' control planes.=0A=
> >=0A=
> > We tend to disagree with that, for example you have ICMP today...=0A=
> >=0A=
> > */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn't make a=
=0A=
> > very good routing protocol. That's why we don't use it for routing. By=
=0A=
> > contrast, LISP map-request messages are susceptible to DoS attacks and=
=0A=
> > they do carry routing information./*=0A=
> >=0A=
> >=0A=
> >=0A=
> >     In LISP, separation between the forwarding and control plane is=0A=
> >     lost. As a matter of course, forwarding plane activity causes=0A=
> >     control plane activity. Since forwarding plane bandwidth exceeds=0A=
> >     control plane bandwidth, DoS attacks against the control plane are=
=0A=
> >     possible.=0A=
> >=0A=
> >     In order to be complete, the threats document must describe the DoS=
=0A=
> >     threat. It should also describe mitigations, if any exist.=0A=
> >=0A=
> > DoS is already explained and the definition given:=0A=
> >=0A=
> > " A Denial of Service (DoS) attack aims at disrupting a specific=0A=
> >=0A=
> >     targeted service either by exhausting the resources of the victim=
=0A=
> > up=0A=
> >=0A=
> >     to the point that it is not able to provide a reliable service to=
=0A=
> >=0A=
> >     legit traffic and/or systems or by exploiting vulnerabilities to=0A=
> > make=0A=
> >=0A=
> >     the targeted service unable to operate properly.=0A=
> >=0A=
> > "=0A=
> >=0A=
> > is covering the case you mention.=0A=
> >=0A=
> > */[RPB] /*=0A=
> >=0A=
> > */You might want to add the following details to section 5.2:/*=0A=
> >=0A=
> > *//*=0A=
> >=0A=
> > -A DoS attack can be launched by anybody who can send a packet to the=
=0A=
> > XTR's LOC=0A=
> >=0A=
> > -DoS attacks can render an XTR inoperable=0A=
> >=0A=
> > -DDoS attacks can render the mapping system inoperable.=0A=
> >=0A=
> > This is what differentiates LISP from today's routing system.=0A=
> >=0A=
> >                                        Ron=0A=
> >=0A=
> > Damien Saucez=0A=
> >=0A=
> >=0A=
> >=0A=
> >=0A=
> > Ron=0A=
> >=0A=
> >=0A=
> >=0A=
> >         -----Original Message-----=0A=
> >         From: Dino Farinacci [mailto:farinacci@gmail.com]=0A=
> >         Sent: Wednesday, May 21, 2014 6:58 PM=0A=
> >         To: Ronald Bonica=0A=
> >         Cc: Roger Jorgensen; lisp@ietf.org <mailto:lisp@ietf.org>=0A=
> >         Subject: Re: [lisp] Restarting last call on LISP threats=0A=
> >=0A=
> >=0A=
> >             The attacker sends a flow of crafted packets to the victim=
=0A=
> >             XTR. Each packet=0A=
> >=0A=
> >         is a well-formed LISP data packet. It contains:=0A=
> >=0A=
> >=0A=
> >             - an outer IP header (LOC->LOC)=0A=
> >             - a UDP header=0A=
> >             - a LISP Header=0A=
> >             - an IP header (EID->EID)=0A=
> >             - payload=0A=
> >=0A=
> >=0A=
> >         Just like a regular packet I can send to your home router today=
.=0A=
> >         So yes okay.=0A=
> >         So let's continue. See comments below.=0A=
> >=0A=
> >=0A=
> >             Each packet contains control plane information that is new=
=0A=
> >             to the victim=0A=
> >=0A=
> >=0A=
> >         Be more specific about what control information are in these=0A=
> >         encapsulated=0A=
> >         packets.=0A=
> >=0A=
> >=0A=
> >             XTR. For example, the victim XTR has no mapping information=
=0A=
> >             regarding=0A=
> >=0A=
> >         either the source LOC or source EID prefix. Rather than gleanin=
g=0A=
> >         this mapping=0A=
> >         information from the crafted packet, the victim XTR sends a=0A=
> >         verifying MAP-=0A=
> >         REQUEST to the mapping system.=0A=
> >=0A=
> >=0A=
> >             Assume that the attack flow is large (N packets per second)=
.=0A=
> >             Assume also=0A=
> >=0A=
> >         that the XTRs rate limit for MAP-REQUEST messages is less than =
N=0A=
> >         packets=0A=
> >         per second. Has the attack not effectively DoS'd the victim XTR=
?=0A=
> >=0A=
> >         It caches the rate the rate the packets are coming in and=0A=
> >         eventually stops=0A=
> >         sending Map-Requests completely.=0A=
> >=0A=
> >         It cannot stop the incoming rate of packets today just like a=
=0A=
> >         roque BGP=0A=
> >         attacker can send millions of packets per second to a peer=0A=
> >         regardless if it=0A=
> >         does or does not have the peer authentication key.=0A=
> >=0A=
> >=0A=
> >             To make this attack work, every packet in the attack flow=
=0A=
> >             may need to have=0A=
> >=0A=
> >         a unique, spoofed, source LOC.=0A=
> >=0A=
> >         An implementation can detect that after rate limiting 1000s of=
=0A=
> >         such requests=0A=
> >         are happening that it just stops operation.=0A=
> >=0A=
> >         What if I sent a Juniper 20 million routes today?=0A=
> >=0A=
> >         The Internet is very fragile and LISP IS NOT making it worse.=
=0A=
> >         And in some=0A=
> >         cases it is making it better with integrated techniques.=0A=
> >=0A=
> >         Dino=0A=
> >=0A=
> >=0A=
> >     _______________________________________________=0A=
> >     lisp mailing list=0A=
> >     lisp@ietf.org <mailto:lisp@ietf.org>=0A=
> >     https://www.ietf.org/mailman/listinfo/lisp=0A=
> >=0A=
> >=0A=
> >=0A=
> > _______________________________________________=0A=
> > lisp mailing list=0A=
> > lisp@ietf.org=0A=
> > https://www.ietf.org/mailman/listinfo/lisp=0A=
> >=0A=
=0A=
_______________________________________________=0A=
lisp mailing list=0A=
lisp@ietf.org=0A=
https://www.ietf.org/mailman/listinfo/lisp=0A=


From nobody Mon May 26 12:34:46 2014
Return-Path: <jmh@joelhalpern.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2A5321A0240 for <lisp@ietfa.amsl.com>; Mon, 26 May 2014 12:34:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Level: 
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BmU6w6h0gla1 for <lisp@ietfa.amsl.com>; Mon, 26 May 2014 12:34:43 -0700 (PDT)
Received: from mailc1.tigertech.net (mailc1.tigertech.net [208.80.4.155]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4FF7B1A023D for <lisp@ietf.org>; Mon, 26 May 2014 12:34:43 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mailc1.tigertech.net (Postfix) with ESMTP id 798531C9CE15; Mon, 26 May 2014 12:34:40 -0700 (PDT)
X-Virus-Scanned: Debian amavisd-new at c1.tigertech.net
Received: from Joels-MacBook-Pro.local (pool-70-106-135-10.clppva.east.verizon.net [70.106.135.10]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mailc1.tigertech.net (Postfix) with ESMTPSA id 379901C9CE13; Mon, 26 May 2014 12:34:35 -0700 (PDT)
Message-ID: <53839747.1080806@joelhalpern.com>
Date: Mon, 26 May 2014 15:34:31 -0400
From: "Joel M. Halpern" <jmh@joelhalpern.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.5.0
MIME-Version: 1.0
To: Paul Vinciguerra <pvinci@VinciConsulting.com>,  Ronald Bonica <rbonica@juniper.net>, "Joel M. Halpern" <jmh@joelhalpern.com>,  Damien Saucez <damien.saucez@gmail.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com> <538361DA.10808@joelhalpern.com>, <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local>
In-Reply-To: <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/9ea7UfVSPSKYnvRw4pY3YhdfRp0
Cc: Roger Jorgensen <rogerj@gmail.com>, LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 26 May 2014 19:34:45 -0000

It sounds like the PxTRs you are using are already implementing sensible 
mitigations.  But the base document does not actually call this out.

On the base document, the ETR can do gleaning (and by some readings 
mgiht be being encouraged to do so).  Because of the security threat 
from gleaning, and because the Etr wants to avoid the delay on returning 
traffic, nor use a false glean to direct returning traffic, there is 
text suggesting that the ETR would, immediately upon gleaning, check the 
information with the mapping system.

That would mean that a packet flow to an ETR (which all nodes are, as 
you say, subject to) could become a significant load on the mapping system.

Making different choices about when to learn or verify entries changes 
that dramatically.  But since the document does currently include the 
problematic behavior as legitimate, we need to document that it can 
cause problems.

I am glad to hear that sensible implementations are already dealing with 
this well.

Yours,
Joel

On 5/26/14, 3:28 PM, Paul Vinciguerra wrote:
> Every host on the Internet is subject to a DoS attack.  An xTR is no
> more so.  I am also not clear on how a DoS attack on an xTR would
> create any more risk than an attack directly against the mapping
> system.
>
> Joel describes Ronald's scenario of an attack where a large stream of
> packets with different inner source addresses to an ETR.  I don't
> call this an attack.  I call this our steady-state.  These would be
> the PxTR's we operate across the US.  The PxTR's on the beta-network
> are no different.  We take in packets from anywhere.  This is a
> "Free" attacker if you will.  All that really means is that you do
> not have to incur the computational cost of encapsulating the
> packet.
>
> I would defer to Dino and others on the list, but I do not believe
> that the ETR does a reverse lookup on every packet.  At least that is
> not the behavior we observe.  What we see happen is that the packet
> is decapsulated and sent to the destination.  If a valid destination
> host responds, then the ITR does a map-request for the reply packet.
> There is not a 1:1 relationship between the number of packets and the
> number of map-requests.
>
> Map-replies for IP addresses return prefixes. These prefixes can
> cover larger address spaces than the map-request and limit the number
> of future map-requests needed.
>
> Can you provide more specific details on how you see the xTR
> rendering the mapping system unusable?
>
> For what its worth, I still support the decision for last call and
> not to place mitigations within the document.  Without knowing the
> specifics of a configuration and implementation, that just leads to a
> false sense of security.
>
>
> ________________________________________ From: lisp
> [lisp-bounces@ietf.org] on behalf of Ronald Bonica
> [rbonica@juniper.net] Sent: Monday, May 26, 2014 11:57 AM To: Joel M.
> Halpern; Damien Saucez Cc: Roger Jorgensen; LISP mailing list list
> Subject: Re: [lisp] Restarting last call on LISP threats
>
> Inline.....
>
>> -----Original Message----- From: Joel M. Halpern
>> [mailto:jmh@joelhalpern.com] Sent: Monday, May 26, 2014 11:47 AM
>> To: Ronald Bonica; Damien Saucez Cc: Roger Jorgensen; LISP mailing
>> list list Subject: Re: [lisp] Restarting last call on LISP threats
>>
>> Top posting to make sure I am understanding:
>>
>> You asssert that any xTR is subject to a DoS attack.  And that such
>> a DoS attack can render the mapping system unusable.
> [RPB] Exactly!
>
>>
>> It targeting an ITR, this would need to be from within ths cope the
>> ITR serves.
> [RPB] I don't understand this sentence. Please try again.
>
>> I believe that is discussed.
> [RPB] Given that I don't understand the sentence above, I have no
> idea if this sentence is true.
>
>>
>> If I have connected the dots correctly, the attack you are
>> contemplating is sending a large stream of packets with different
>> inner source addresses to an ETR.  This would prompt the ETR to
>> check with the mapping system about each and every address.
> [RPB] Exactly!
>
>>
>> If I have understood this properly, while there are several very
>> effective mitigations, that does not change the basic message that
>> this is an attack, and as such ought to be described in the threats
>> document.
> [RPB] Even if there are effective mitigations, the attack should be
> described.
>
> However, I am not convinced that an effective mitigation exists.
>
>> There are clealry a number of variations on this attack.
> [RPB] True!
>
> For example, using
>> the same outer source address makes mitigation easier, while using
>> different outer source addresses either requires a bot-net or a
>> large unchecked BCP38 hole (and those can be used for MANY attacks
>> on many systems.)  Both presumably should be described.
> [RPB] Yes, both should be described.
>
> Also, recall that large BCP38 holes exist in today's internet.
>
>>
>> Have I captured your request accurately?
> [RPB] Pretty much.
>
> Thanks for taking the effort.
>
> Ron
>
>>
>> Yours, Joel
>>
>> On 5/26/14, 1:06 AM, Ronald Bonica wrote:
>>> *From:*Damien Saucez [mailto:damien.saucez@gmail.com] *Sent:*
>>> Friday, May 23, 2014 9:07 AM *To:* Ronald Bonica *Cc:* Dino
>>> Farinacci; Roger Jorgensen; LISP mailing list list *Subject:* Re:
>>> [lisp] Restarting last call on LISP threats
>>>
>>> Hello Ronald,
>>>
>>> On 22 May 2014, at 22:57, Ronald Bonica <rbonica@juniper.net
>>> <mailto:rbonica@juniper.net>> wrote:
>>>
>>>
>>>
>>> Dino,
>>>
>>> Today's Internet is not as fragile as you think. This mail
>>> traversed many routers between my house and yours. If those
>>> routers are well-managed, there is nothing that I can do from my
>>> house that will cause any of those routers to consume control
>>> plane resources. Therefore, there is nothing that I can do from
>>> my house that will cause a DoS attack against those routers'
>>> control planes.
>>>
>>> We tend to disagree with that, for example you have ICMP
>>> today...
>>>
>>> */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn't
>>> make a very good routing protocol. That's why we don't use it for
>>> routing. By contrast, LISP map-request messages are susceptible
>>> to DoS attacks and they do carry routing information./*
>>>
>>>
>>>
>>> In LISP, separation between the forwarding and control plane is
>>> lost. As a matter of course, forwarding plane activity causes
>>> control plane activity. Since forwarding plane bandwidth exceeds
>>> control plane bandwidth, DoS attacks against the control plane
>>> are possible.
>>>
>>> In order to be complete, the threats document must describe the
>>> DoS threat. It should also describe mitigations, if any exist.
>>>
>>> DoS is already explained and the definition given:
>>>
>>> " A Denial of Service (DoS) attack aims at disrupting a specific
>>>
>>> targeted service either by exhausting the resources of the
>>> victim up
>>>
>>> to the point that it is not able to provide a reliable service
>>> to
>>>
>>> legit traffic and/or systems or by exploiting vulnerabilities to
>>> make
>>>
>>> the targeted service unable to operate properly.
>>>
>>> "
>>>
>>> is covering the case you mention.
>>>
>>> */[RPB] /*
>>>
>>> */You might want to add the following details to section 5.2:/*
>>>
>>> *//*
>>>
>>> -A DoS attack can be launched by anybody who can send a packet to
>>> the XTR's LOC
>>>
>>> -DoS attacks can render an XTR inoperable
>>>
>>> -DDoS attacks can render the mapping system inoperable.
>>>
>>> This is what differentiates LISP from today's routing system.
>>>
>>> Ron
>>>
>>> Damien Saucez
>>>
>>>
>>>
>>>
>>> Ron
>>>
>>>
>>>
>>> -----Original Message----- From: Dino Farinacci
>>> [mailto:farinacci@gmail.com] Sent: Wednesday, May 21, 2014 6:58
>>> PM To: Ronald Bonica Cc: Roger Jorgensen; lisp@ietf.org
>>> <mailto:lisp@ietf.org> Subject: Re: [lisp] Restarting last call
>>> on LISP threats
>>>
>>>
>>> The attacker sends a flow of crafted packets to the victim XTR.
>>> Each packet
>>>
>>> is a well-formed LISP data packet. It contains:
>>>
>>>
>>> - an outer IP header (LOC->LOC) - a UDP header - a LISP Header -
>>> an IP header (EID->EID) - payload
>>>
>>>
>>> Just like a regular packet I can send to your home router today.
>>> So yes okay. So let's continue. See comments below.
>>>
>>>
>>> Each packet contains control plane information that is new to the
>>> victim
>>>
>>>
>>> Be more specific about what control information are in these
>>> encapsulated packets.
>>>
>>>
>>> XTR. For example, the victim XTR has no mapping information
>>> regarding
>>>
>>> either the source LOC or source EID prefix. Rather than gleaning
>>> this mapping information from the crafted packet, the victim XTR
>>> sends a verifying MAP- REQUEST to the mapping system.
>>>
>>>
>>> Assume that the attack flow is large (N packets per second).
>>> Assume also
>>>
>>> that the XTRs rate limit for MAP-REQUEST messages is less than N
>>> packets per second. Has the attack not effectively DoS'd the
>>> victim XTR?
>>>
>>> It caches the rate the rate the packets are coming in and
>>> eventually stops sending Map-Requests completely.
>>>
>>> It cannot stop the incoming rate of packets today just like a
>>> roque BGP attacker can send millions of packets per second to a
>>> peer regardless if it does or does not have the peer
>>> authentication key.
>>>
>>>
>>> To make this attack work, every packet in the attack flow may
>>> need to have
>>>
>>> a unique, spoofed, source LOC.
>>>
>>> An implementation can detect that after rate limiting 1000s of
>>> such requests are happening that it just stops operation.
>>>
>>> What if I sent a Juniper 20 million routes today?
>>>
>>> The Internet is very fragile and LISP IS NOT making it worse. And
>>> in some cases it is making it better with integrated techniques.
>>>
>>> Dino
>>>
>>>
>>> _______________________________________________ lisp mailing
>>> list lisp@ietf.org <mailto:lisp@ietf.org>
>>> https://www.ietf.org/mailman/listinfo/lisp
>>>
>>>
>>>
>>> _______________________________________________ lisp mailing
>>> list lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp
>>>
>
> _______________________________________________ lisp mailing list
> lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp
>


From nobody Tue May 27 00:58:52 2014
Return-Path: <marc@sniff.de>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CA77D1A0028 for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 00:58:50 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.201
X-Spam-Level: 
X-Spam-Status: No, score=-2.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, RP_MATCHES_RCVD=-0.651] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6KE3zmewdfoM for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 00:58:48 -0700 (PDT)
Received: from door.sniff.de (door.sniff.de [IPv6:2001:6f8:94f:1::1]) by ietfa.amsl.com (Postfix) with ESMTP id 456A91A001E for <lisp@ietf.org>; Tue, 27 May 2014 00:58:47 -0700 (PDT)
Received: from [IPv6:::1] (localhost.sniff.de [127.0.0.1]) by door.sniff.de (Postfix) with ESMTP id 52EF72AA0F; Tue, 27 May 2014 07:58:40 +0000 (GMT)
Date: Tue, 27 May 2014 00:58:43 -0700
From: Marc Binderberger <marc@sniff.de>
To: "Joel M. Halpern" <jmh@joelhalpern.com>
Message-ID: <20140527005843634679.23839638@sniff.de>
In-Reply-To: <53839747.1080806@joelhalpern.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com> <538361DA.10808@joelhalpern.com> <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> <53839747.1080806@joelhalpern.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Mailer: GyazMail version 1.5.15
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/P_Ly_xcvOVL0so5p4AKTBLDe8XY
Cc: Roger Jorgensen <rogerj@gmail.com>, LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 27 May 2014 07:58:51 -0000

Hello Joel et al.

interesting discussion. I wonder if other Internet protocols would have ever 
"made it" if they would have started with such an intense threat discussion 
as LISP does now :-)

Nevertheless, my understanding of what Ross and Ronald bring up is indeed a 
potential risk with any data-driven "pull" protocols like LISP: your data 
plane may overwhelm the data channel to the control plane.

One could argue this is an implementation aspect but as we go already into 
great detail in the draft maybe it's worthwhile to mention?

The discussion was IMHO too much focused on gleaning. LISP is made for a 
large number of EID networks. If e.g. someone scans the address ranges of an 
ISP and the PiTR(s) of the ISP have no forwarding entry then they need to 
send a map-request - a task typically done in control plane. Punting packets 
from data to control plane may saturate the punt channel for a time T, during 
which a legitimate request may not be processed.

To be fair, even for a large number of EID networks (e.g. lots of /29) the 
period T should not be more than several minutes (my guess, assuming 1k 
lookup per second) and it would not affect already established flows, only 
the establishment of new flows during the time T, assuming the (P)iTR can 
hold all the map-cache entries.


Regards, Marc



On Mon, 26 May 2014 15:34:31 -0400, Joel M. Halpern wrote:
> It sounds like the PxTRs you are using are already implementing sensible 
> mitigations.  But the base document does not actually call this out.
> 
> On the base document, the ETR can do gleaning (and by some readings mgiht 
> be being encouraged to do so).  Because of the security threat from 
> gleaning, and because the Etr wants to avoid the delay on returning 
> traffic, nor use a false glean to direct returning traffic, there is text 
> suggesting that the ETR would, immediately upon gleaning, check the 
> information with the mapping system.
> 
> That would mean that a packet flow to an ETR (which all nodes are, as you 
> say, subject to) could become a significant load on the mapping system.
> 
> Making different choices about when to learn or verify entries changes that 
> dramatically.  But since the document does currently include the 
> problematic behavior as legitimate, we need to document that it can cause 
> problems.
> 
> I am glad to hear that sensible implementations are already dealing with 
> this well.
> 
> Yours,
> Joel
> 
> On 5/26/14, 3:28 PM, Paul Vinciguerra wrote:
>> Every host on the Internet is subject to a DoS attack.  An xTR is no
>> more so.  I am also not clear on how a DoS attack on an xTR would
>> create any more risk than an attack directly against the mapping
>> system.
>> 
>> Joel describes Ronald's scenario of an attack where a large stream of
>> packets with different inner source addresses to an ETR.  I don't
>> call this an attack.  I call this our steady-state.  These would be
>> the PxTR's we operate across the US.  The PxTR's on the beta-network
>> are no different.  We take in packets from anywhere.  This is a
>> "Free" attacker if you will.  All that really means is that you do
>> not have to incur the computational cost of encapsulating the
>> packet.
>> 
>> I would defer to Dino and others on the list, but I do not believe
>> that the ETR does a reverse lookup on every packet.  At least that is
>> not the behavior we observe.  What we see happen is that the packet
>> is decapsulated and sent to the destination.  If a valid destination
>> host responds, then the ITR does a map-request for the reply packet.
>> There is not a 1:1 relationship between the number of packets and the
>> number of map-requests.
>> 
>> Map-replies for IP addresses return prefixes. These prefixes can
>> cover larger address spaces than the map-request and limit the number
>> of future map-requests needed.
>> 
>> Can you provide more specific details on how you see the xTR
>> rendering the mapping system unusable?
>> 
>> For what its worth, I still support the decision for last call and
>> not to place mitigations within the document.  Without knowing the
>> specifics of a configuration and implementation, that just leads to a
>> false sense of security.
>> 
>> 
>> ________________________________________ From: lisp
>> [lisp-bounces@ietf.org] on behalf of Ronald Bonica
>> [rbonica@juniper.net] Sent: Monday, May 26, 2014 11:57 AM To: Joel M.
>> Halpern; Damien Saucez Cc: Roger Jorgensen; LISP mailing list list
>> Subject: Re: [lisp] Restarting last call on LISP threats
>> 
>> Inline.....
>> 
>>> -----Original Message----- From: Joel M. Halpern
>>> [mailto:jmh@joelhalpern.com] Sent: Monday, May 26, 2014 11:47 AM
>>> To: Ronald Bonica; Damien Saucez Cc: Roger Jorgensen; LISP mailing
>>> list list Subject: Re: [lisp] Restarting last call on LISP threats
>>> 
>>> Top posting to make sure I am understanding:
>>> 
>>> You asssert that any xTR is subject to a DoS attack.  And that such
>>> a DoS attack can render the mapping system unusable.
>> [RPB] Exactly!
>> 
>>> 
>>> It targeting an ITR, this would need to be from within ths cope the
>>> ITR serves.
>> [RPB] I don't understand this sentence. Please try again.
>> 
>>> I believe that is discussed.
>> [RPB] Given that I don't understand the sentence above, I have no
>> idea if this sentence is true.
>> 
>>> 
>>> If I have connected the dots correctly, the attack you are
>>> contemplating is sending a large stream of packets with different
>>> inner source addresses to an ETR.  This would prompt the ETR to
>>> check with the mapping system about each and every address.
>> [RPB] Exactly!
>> 
>>> 
>>> If I have understood this properly, while there are several very
>>> effective mitigations, that does not change the basic message that
>>> this is an attack, and as such ought to be described in the threats
>>> document.
>> [RPB] Even if there are effective mitigations, the attack should be
>> described.
>> 
>> However, I am not convinced that an effective mitigation exists.
>> 
>>> There are clealry a number of variations on this attack.
>> [RPB] True!
>> 
>> For example, using
>>> the same outer source address makes mitigation easier, while using
>>> different outer source addresses either requires a bot-net or a
>>> large unchecked BCP38 hole (and those can be used for MANY attacks
>>> on many systems.)  Both presumably should be described.
>> [RPB] Yes, both should be described.
>> 
>> Also, recall that large BCP38 holes exist in today's internet.
>> 
>>> 
>>> Have I captured your request accurately?
>> [RPB] Pretty much.
>> 
>> Thanks for taking the effort.
>> 
>> Ron
>> 
>>> 
>>> Yours, Joel
>>> 
>>> On 5/26/14, 1:06 AM, Ronald Bonica wrote:
>>>> *From:*Damien Saucez [mailto:damien.saucez@gmail.com] *Sent:*
>>>> Friday, May 23, 2014 9:07 AM *To:* Ronald Bonica *Cc:* Dino
>>>> Farinacci; Roger Jorgensen; LISP mailing list list *Subject:* Re:
>>>> [lisp] Restarting last call on LISP threats
>>>> 
>>>> Hello Ronald,
>>>> 
>>>> On 22 May 2014, at 22:57, Ronald Bonica <rbonica@juniper.net
>>>> <mailto:rbonica@juniper.net>> wrote:
>>>> 
>>>> 
>>>> 
>>>> Dino,
>>>> 
>>>> Today's Internet is not as fragile as you think. This mail
>>>> traversed many routers between my house and yours. If those
>>>> routers are well-managed, there is nothing that I can do from my
>>>> house that will cause any of those routers to consume control
>>>> plane resources. Therefore, there is nothing that I can do from
>>>> my house that will cause a DoS attack against those routers'
>>>> control planes.
>>>> 
>>>> We tend to disagree with that, for example you have ICMP
>>>> today...
>>>> 
>>>> */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn't
>>>> make a very good routing protocol. That's why we don't use it for
>>>> routing. By contrast, LISP map-request messages are susceptible
>>>> to DoS attacks and they do carry routing information./*
>>>> 
>>>> 
>>>> 
>>>> In LISP, separation between the forwarding and control plane is
>>>> lost. As a matter of course, forwarding plane activity causes
>>>> control plane activity. Since forwarding plane bandwidth exceeds
>>>> control plane bandwidth, DoS attacks against the control plane
>>>> are possible.
>>>> 
>>>> In order to be complete, the threats document must describe the
>>>> DoS threat. It should also describe mitigations, if any exist.
>>>> 
>>>> DoS is already explained and the definition given:
>>>> 
>>>> " A Denial of Service (DoS) attack aims at disrupting a specific
>>>> 
>>>> targeted service either by exhausting the resources of the
>>>> victim up
>>>> 
>>>> to the point that it is not able to provide a reliable service
>>>> to
>>>> 
>>>> legit traffic and/or systems or by exploiting vulnerabilities to
>>>> make
>>>> 
>>>> the targeted service unable to operate properly.
>>>> 
>>>> "
>>>> 
>>>> is covering the case you mention.
>>>> 
>>>> */[RPB] /*
>>>> 
>>>> */You might want to add the following details to section 5.2:/*
>>>> 
>>>> *//*
>>>> 
>>>> -A DoS attack can be launched by anybody who can send a packet to
>>>> the XTR's LOC
>>>> 
>>>> -DoS attacks can render an XTR inoperable
>>>> 
>>>> -DDoS attacks can render the mapping system inoperable.
>>>> 
>>>> This is what differentiates LISP from today's routing system.
>>>> 
>>>> Ron
>>>> 
>>>> Damien Saucez
>>>> 
>>>> 
>>>> 
>>>> 
>>>> Ron
>>>> 
>>>> 
>>>> 
>>>> -----Original Message----- From: Dino Farinacci
>>>> [mailto:farinacci@gmail.com] Sent: Wednesday, May 21, 2014 6:58
>>>> PM To: Ronald Bonica Cc: Roger Jorgensen; lisp@ietf.org
>>>> <mailto:lisp@ietf.org> Subject: Re: [lisp] Restarting last call
>>>> on LISP threats
>>>> 
>>>> 
>>>> The attacker sends a flow of crafted packets to the victim XTR.
>>>> Each packet
>>>> 
>>>> is a well-formed LISP data packet. It contains:
>>>> 
>>>> 
>>>> - an outer IP header (LOC->LOC) - a UDP header - a LISP Header -
>>>> an IP header (EID->EID) - payload
>>>> 
>>>> 
>>>> Just like a regular packet I can send to your home router today.
>>>> So yes okay. So let's continue. See comments below.
>>>> 
>>>> 
>>>> Each packet contains control plane information that is new to the
>>>> victim
>>>> 
>>>> 
>>>> Be more specific about what control information are in these
>>>> encapsulated packets.
>>>> 
>>>> 
>>>> XTR. For example, the victim XTR has no mapping information
>>>> regarding
>>>> 
>>>> either the source LOC or source EID prefix. Rather than gleaning
>>>> this mapping information from the crafted packet, the victim XTR
>>>> sends a verifying MAP- REQUEST to the mapping system.
>>>> 
>>>> 
>>>> Assume that the attack flow is large (N packets per second).
>>>> Assume also
>>>> 
>>>> that the XTRs rate limit for MAP-REQUEST messages is less than N
>>>> packets per second. Has the attack not effectively DoS'd the
>>>> victim XTR?
>>>> 
>>>> It caches the rate the rate the packets are coming in and
>>>> eventually stops sending Map-Requests completely.
>>>> 
>>>> It cannot stop the incoming rate of packets today just like a
>>>> roque BGP attacker can send millions of packets per second to a
>>>> peer regardless if it does or does not have the peer
>>>> authentication key.
>>>> 
>>>> 
>>>> To make this attack work, every packet in the attack flow may
>>>> need to have
>>>> 
>>>> a unique, spoofed, source LOC.
>>>> 
>>>> An implementation can detect that after rate limiting 1000s of
>>>> such requests are happening that it just stops operation.
>>>> 
>>>> What if I sent a Juniper 20 million routes today?
>>>> 
>>>> The Internet is very fragile and LISP IS NOT making it worse. And
>>>> in some cases it is making it better with integrated techniques.
>>>> 
>>>> Dino
>>>> 
>>>> 
>>>> _______________________________________________ lisp mailing
>>>> list lisp@ietf.org <mailto:lisp@ietf.org>
>>>> https://www.ietf.org/mailman/listinfo/lisp
>>>> 
>>>> 
>>>> 
>>>> _______________________________________________ lisp mailing
>>>> list lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp
>>>> 
>> 
>> _______________________________________________ lisp mailing list
>> lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp
>> 
> 
> _______________________________________________
> lisp mailing list
> lisp@ietf.org
> https://www.ietf.org/mailman/listinfo/lisp
> 


From nobody Tue May 27 07:17:16 2014
Return-Path: <rbonica@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D6461A0394 for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 07:17:14 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.601
X-Spam-Level: 
X-Spam-Status: No, score=-102.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qqeE46NiJRm0 for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 07:17:11 -0700 (PDT)
Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2lp0207.outbound.protection.outlook.com [207.46.163.207]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A15D1A0158 for <lisp@ietf.org>; Tue, 27 May 2014 07:17:10 -0700 (PDT)
Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB443.namprd05.prod.outlook.com (10.141.73.152) with Microsoft SMTP Server (TLS) id 15.0.949.11; Tue, 27 May 2014 14:17:06 +0000
Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) with mapi id 15.00.0949.001; Tue, 27 May 2014 14:17:06 +0000
From: Ronald Bonica <rbonica@juniper.net>
To: Sharon <sbarkai@gmail.com>, "Joel M. Halpern" <jmh@joelhalpern.com>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEIABfmkAgAefyVCAAITngIABbBJggAETbwCABC0O0IAAtqUAgAAFh4CAAXMyQA==
Date: Tue, 27 May 2014 14:17:05 +0000
Message-ID: <db536016d3734bf4b289f185b0051768@CO1PR05MB442.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com> <538361DA.10808@joelhalpern.com> <BDAC9F7C-1205-4A59-A252-2B20998E187B@gmail.com>
In-Reply-To: <BDAC9F7C-1205-4A59-A252-2B20998E187B@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.14]
x-forefront-prvs: 02243C58C6
x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(377454003)(13464003)(51704005)(479174003)(199002)(189002)(24454002)(52604005)(21056001)(81342001)(76482001)(74502001)(74662001)(81542001)(74316001)(76576001)(76176999)(86362001)(2656002)(79102001)(80022001)(87936001)(101416001)(15975445006)(33646001)(83072002)(4396001)(99396002)(77982001)(19580395003)(19580405001)(83322001)(99286001)(66066001)(50986999)(46102001)(64706001)(20776003)(54356999)(85852003)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO1PR05MB443; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; 
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/nevNYrcqYQf7PIQlmpDy1fCKwo4
Cc: Roger Jorgensen <rogerj@gmail.com>, LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 27 May 2014 14:17:14 -0000

SGkgU2hhcm9uLA0KDQpXZSBtYXkgYmUgdGFsa2luZyBhYm91dCBhbiBYVFIgdGhhdCBpcyBzaWNr
IGR1ZSB0byBhIGJ1ZyBvciBhdHRhY2suIFdlIG1heSBhbHNvIGJlIHRhbGtpbmcgYWJvdXQgYW4g
YXR0YWNrZXIgdGhhdCBpc24ndCBhbiBYVFIgYXQgYWxsLCBqdXN0IGltcGVyc29uYXRpbmcgb25l
Lg0KDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBSb24NCg0KDQo+IC0tLS0tT3JpZ2luYWwgTWVzc2Fn
ZS0tLS0tDQo+IEZyb206IFNoYXJvbiBbbWFpbHRvOnNiYXJrYWlAZ21haWwuY29tXQ0KPiBTZW50
OiBNb25kYXksIE1heSAyNiwgMjAxNCAxMjowNiBQTQ0KPiBUbzogSm9lbCBNLiBIYWxwZXJuDQo+
IENjOiBSb25hbGQgQm9uaWNhOyBEYW1pZW4gU2F1Y2V6OyBSb2dlciBKb3JnZW5zZW47IExJU1Ag
bWFpbGluZyBsaXN0IGxpc3QNCj4gU3ViamVjdDogUmU6IFtsaXNwXSBSZXN0YXJ0aW5nIGxhc3Qg
Y2FsbCBvbiBMSVNQIHRocmVhdHMNCj4gDQo+IEpvZWwsIHRoYW5rcyBmb3IgY2xlYXJpbmcuDQo+
IEl0IHdhcyBoYXJkIHRvIGZvbGxvdy4NCj4gDQo+IElmIHRoZSBjaGFsbGVuZ2UgaXMgZm9yIGEg
ZGlzdHJpYnV0ZWQgbWFwcGluZyBzeXN0ZW0gdG8ga2VlcCB0cmFjayBhbmQgcHJvdGVjdA0KPiBp
dHNlbGYgZnJvbSBhICJzaWNrIiB4VFIsIHNpY2sgYmVjYXVzZSBvZiBhIGJ1ZyBvciBhbiBhdHRh
Y2suLg0KPiBUaGVuIHBlcmhhcHMgd2UgY291bGQgbWFpbnRhaW4gbWFwcGluZyBsb29rdXAgcGVy
IHNlYyBjb3VudGVycyBwZXIgeFRSIGluDQo+IHRoZSBtYXBwaW5nLiBJdCBhZGRzIHNvbWUgb3Zl
cmhlYWQgdG8gdGhlIG1hcHBpbmcsIGJ1dCBkb2Vzbid0IHNsb3cgZG93bg0KPiBmb3J3YXJkaW5n
LiBDYW4gYmUgYWdncmVnYXRlZCBieSBtYXAgc2VydmVycyBmb3IgZWZmaWNpZW5jeS4NCj4gDQo+
IC0tc3piDQo+IA0KPiBPbiBNYXkgMjYsIDIwMTQsIGF0IDg6NDYgQU0sICJKb2VsIE0uIEhhbHBl
cm4iIDxqbWhAam9lbGhhbHBlcm4uY29tPg0KPiB3cm90ZToNCj4gDQo+IFRvcCBwb3N0aW5nIHRv
IG1ha2Ugc3VyZSBJIGFtIHVuZGVyc3RhbmRpbmc6DQo+IA0KPiBZb3UgYXNzc2VydCB0aGF0IGFu
eSB4VFIgaXMgc3ViamVjdCB0byBhIERvUyBhdHRhY2suICBBbmQgdGhhdCBzdWNoIGEgRG9TDQo+
IGF0dGFjayBjYW4gcmVuZGVyIHRoZSBtYXBwaW5nIHN5c3RlbSB1bnVzYWJsZS4NCj4gDQo+IEl0
IHRhcmdldGluZyBhbiBJVFIsIHRoaXMgd291bGQgbmVlZCB0byBiZSBmcm9tIHdpdGhpbiB0aHMg
Y29wZSB0aGUgSVRSIHNlcnZlcy4NCj4gSSBiZWxpZXZlIHRoYXQgaXMgZGlzY3Vzc2VkLg0KPiAN
Cj4gSWYgSSBoYXZlIGNvbm5lY3RlZCB0aGUgZG90cyBjb3JyZWN0bHksIHRoZSBhdHRhY2sgeW91
IGFyZSBjb250ZW1wbGF0aW5nIGlzDQo+IHNlbmRpbmcgYSBsYXJnZSBzdHJlYW0gb2YgcGFja2V0
cyB3aXRoIGRpZmZlcmVudCBpbm5lciBzb3VyY2UgYWRkcmVzc2VzIHRvIGFuDQo+IEVUUi4gIFRo
aXMgd291bGQgcHJvbXB0IHRoZSBFVFIgdG8gY2hlY2sgd2l0aCB0aGUgbWFwcGluZyBzeXN0ZW0g
YWJvdXQNCj4gZWFjaCBhbmQgZXZlcnkgYWRkcmVzcy4NCj4gDQo+IElmIEkgaGF2ZSB1bmRlcnN0
b29kIHRoaXMgcHJvcGVybHksIHdoaWxlIHRoZXJlIGFyZSBzZXZlcmFsIHZlcnkgZWZmZWN0aXZl
DQo+IG1pdGlnYXRpb25zLCB0aGF0IGRvZXMgbm90IGNoYW5nZSB0aGUgYmFzaWMgbWVzc2FnZSB0
aGF0IHRoaXMgaXMgYW4gYXR0YWNrLCBhbmQNCj4gYXMgc3VjaCBvdWdodCB0byBiZSBkZXNjcmli
ZWQgaW4gdGhlIHRocmVhdHMgZG9jdW1lbnQuICBUaGVyZSBhcmUgY2xlYWxyeSBhDQo+IG51bWJl
ciBvZiB2YXJpYXRpb25zIG9uIHRoaXMgYXR0YWNrLiAgRm9yIGV4YW1wbGUsIHVzaW5nIHRoZSBz
YW1lIG91dGVyDQo+IHNvdXJjZSBhZGRyZXNzIG1ha2VzIG1pdGlnYXRpb24gZWFzaWVyLCB3aGls
ZSB1c2luZyBkaWZmZXJlbnQgb3V0ZXIgc291cmNlDQo+IGFkZHJlc3NlcyBlaXRoZXIgcmVxdWly
ZXMgYSBib3QtbmV0IG9yIGEgbGFyZ2UgdW5jaGVja2VkIEJDUDM4IGhvbGUgKGFuZA0KPiB0aG9z
ZSBjYW4gYmUgdXNlZCBmb3IgTUFOWSBhdHRhY2tzIG9uIG1hbnkgc3lzdGVtcy4pICBCb3RoIHBy
ZXN1bWFibHkNCj4gc2hvdWxkIGJlIGRlc2NyaWJlZC4NCj4gDQo+IEhhdmUgSSBjYXB0dXJlZCB5
b3VyIHJlcXVlc3QgYWNjdXJhdGVseT8NCj4gDQo+IFlvdXJzLA0KPiBKb2VsDQo+IA0KPiA+IE9u
IDUvMjYvMTQsIDE6MDYgQU0sIFJvbmFsZCBCb25pY2Egd3JvdGU6DQo+ID4gKkZyb206KkRhbWll
biBTYXVjZXogW21haWx0bzpkYW1pZW4uc2F1Y2V6QGdtYWlsLmNvbV0NCj4gPiAqU2VudDoqIEZy
aWRheSwgTWF5IDIzLCAyMDE0IDk6MDcgQU0NCj4gPiAqVG86KiBSb25hbGQgQm9uaWNhDQo+ID4g
KkNjOiogRGlubyBGYXJpbmFjY2k7IFJvZ2VyIEpvcmdlbnNlbjsgTElTUCBtYWlsaW5nIGxpc3Qg
bGlzdA0KPiA+ICpTdWJqZWN0OiogUmU6IFtsaXNwXSBSZXN0YXJ0aW5nIGxhc3QgY2FsbCBvbiBM
SVNQIHRocmVhdHMNCj4gPg0KPiA+IEhlbGxvIFJvbmFsZCwNCj4gPg0KPiA+IE9uIDIyIE1heSAy
MDE0LCBhdCAyMjo1NywgUm9uYWxkIEJvbmljYSA8cmJvbmljYUBqdW5pcGVyLm5ldA0KPiA+IDxt
YWlsdG86cmJvbmljYUBqdW5pcGVyLm5ldD4+IHdyb3RlOg0KPiA+DQo+ID4NCj4gPg0KPiA+ICAg
IERpbm8sDQo+ID4NCj4gPiAgICBUb2RheSdzIEludGVybmV0IGlzIG5vdCBhcyBmcmFnaWxlIGFz
IHlvdSB0aGluay4gVGhpcyBtYWlsIHRyYXZlcnNlZA0KPiA+ICAgIG1hbnkgcm91dGVycyBiZXR3
ZWVuIG15IGhvdXNlIGFuZCB5b3Vycy4gSWYgdGhvc2Ugcm91dGVycyBhcmUNCj4gPiAgICB3ZWxs
LW1hbmFnZWQsIHRoZXJlIGlzIG5vdGhpbmcgdGhhdCBJIGNhbiBkbyBmcm9tIG15IGhvdXNlIHRo
YXQgd2lsbA0KPiA+ICAgIGNhdXNlIGFueSBvZiB0aG9zZSByb3V0ZXJzIHRvIGNvbnN1bWUgY29u
dHJvbCBwbGFuZSByZXNvdXJjZXMuDQo+ID4gICAgVGhlcmVmb3JlLCB0aGVyZSBpcyBub3RoaW5n
IHRoYXQgSSBjYW4gZG8gZnJvbSBteSBob3VzZSB0aGF0IHdpbGwNCj4gPiAgICBjYXVzZSBhIERv
UyBhdHRhY2sgYWdhaW5zdCB0aG9zZSByb3V0ZXJzJyBjb250cm9sIHBsYW5lcy4NCj4gPg0KPiA+
IFdlIHRlbmQgdG8gZGlzYWdyZWUgd2l0aCB0aGF0LCBmb3IgZXhhbXBsZSB5b3UgaGF2ZSBJQ01Q
IHRvZGF5Li4uDQo+ID4NCj4gPiAqL1tSUEJdIEJlY2F1c2UgSUNNUCBpcyBzdXNjZXB0aWJsZSB0
byBEb1MgYXR0YWNrcywgaXQgd291bGRu4oCZdCBtYWtlIGENCj4gPiB2ZXJ5IGdvb2Qgcm91dGlu
ZyBwcm90b2NvbC4gVGhhdOKAmXMgd2h5IHdlIGRvbuKAmXQgdXNlIGl0IGZvciByb3V0aW5nLiBC
eQ0KPiA+IGNvbnRyYXN0LCBMSVNQIG1hcC1yZXF1ZXN0IG1lc3NhZ2VzIGFyZSBzdXNjZXB0aWJs
ZSB0byBEb1MgYXR0YWNrcyBhbmQNCj4gPiB0aGV5IGRvIGNhcnJ5IHJvdXRpbmcgaW5mb3JtYXRp
b24uLyoNCj4gPg0KPiA+DQo+ID4NCj4gPiAgICBJbiBMSVNQLCBzZXBhcmF0aW9uIGJldHdlZW4g
dGhlIGZvcndhcmRpbmcgYW5kIGNvbnRyb2wgcGxhbmUgaXMNCj4gPiAgICBsb3N0LiBBcyBhIG1h
dHRlciBvZiBjb3Vyc2UsIGZvcndhcmRpbmcgcGxhbmUgYWN0aXZpdHkgY2F1c2VzDQo+ID4gICAg
Y29udHJvbCBwbGFuZSBhY3Rpdml0eS4gU2luY2UgZm9yd2FyZGluZyBwbGFuZSBiYW5kd2lkdGgg
ZXhjZWVkcw0KPiA+ICAgIGNvbnRyb2wgcGxhbmUgYmFuZHdpZHRoLCBEb1MgYXR0YWNrcyBhZ2Fp
bnN0IHRoZSBjb250cm9sIHBsYW5lIGFyZQ0KPiA+ICAgIHBvc3NpYmxlLg0KPiA+DQo+ID4gICAg
SW4gb3JkZXIgdG8gYmUgY29tcGxldGUsIHRoZSB0aHJlYXRzIGRvY3VtZW50IG11c3QgZGVzY3Jp
YmUgdGhlIERvUw0KPiA+ICAgIHRocmVhdC4gSXQgc2hvdWxkIGFsc28gZGVzY3JpYmUgbWl0aWdh
dGlvbnMsIGlmIGFueSBleGlzdC4NCj4gPg0KPiA+IERvUyBpcyBhbHJlYWR5IGV4cGxhaW5lZCBh
bmQgdGhlIGRlZmluaXRpb24gZ2l2ZW46DQo+ID4NCj4gPiAiIEEgRGVuaWFsIG9mIFNlcnZpY2Ug
KERvUykgYXR0YWNrIGFpbXMgYXQgZGlzcnVwdGluZyBhIHNwZWNpZmljDQo+ID4NCj4gPiAgICB0
YXJnZXRlZCBzZXJ2aWNlIGVpdGhlciBieSBleGhhdXN0aW5nIHRoZSByZXNvdXJjZXMgb2YgdGhl
IHZpY3RpbQ0KPiA+IHVwDQo+ID4NCj4gPiAgICB0byB0aGUgcG9pbnQgdGhhdCBpdCBpcyBub3Qg
YWJsZSB0byBwcm92aWRlIGEgcmVsaWFibGUgc2VydmljZSB0bw0KPiA+DQo+ID4gICAgbGVnaXQg
dHJhZmZpYyBhbmQvb3Igc3lzdGVtcyBvciBieSBleHBsb2l0aW5nIHZ1bG5lcmFiaWxpdGllcyB0
bw0KPiA+IG1ha2UNCj4gPg0KPiA+ICAgIHRoZSB0YXJnZXRlZCBzZXJ2aWNlIHVuYWJsZSB0byBv
cGVyYXRlIHByb3Blcmx5Lg0KPiA+DQo+ID4gIg0KPiA+DQo+ID4gaXMgY292ZXJpbmcgdGhlIGNh
c2UgeW91IG1lbnRpb24uDQo+ID4NCj4gPiAqL1tSUEJdIC8qDQo+ID4NCj4gPiAqL1lvdSBtaWdo
dCB3YW50IHRvIGFkZCB0aGUgZm9sbG93aW5nIGRldGFpbHMgdG8gc2VjdGlvbiA1LjI6LyoNCj4g
Pg0KPiA+ICovLyoNCj4gPg0KPiA+IC1BIERvUyBhdHRhY2sgY2FuIGJlIGxhdW5jaGVkIGJ5IGFu
eWJvZHkgd2hvIGNhbiBzZW5kIGEgcGFja2V0IHRvIHRoZQ0KPiA+IFhUUuKAmXMgTE9DDQo+ID4N
Cj4gPiAtRG9TIGF0dGFja3MgY2FuIHJlbmRlciBhbiBYVFIgaW5vcGVyYWJsZQ0KPiA+DQo+ID4g
LUREb1MgYXR0YWNrcyBjYW4gcmVuZGVyIHRoZSBtYXBwaW5nIHN5c3RlbSBpbm9wZXJhYmxlLg0K
PiA+DQo+ID4gVGhpcyBpcyB3aGF0IGRpZmZlcmVudGlhdGVzIExJU1AgZnJvbSB0b2RheeKAmXMg
cm91dGluZyBzeXN0ZW0uDQo+ID4NCj4gPiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIFJvbg0KPiA+DQo+ID4gRGFtaWVuIFNhdWNleg0KPiA+DQo+ID4NCj4gPg0KPiA+DQo+
ID4gUm9uDQo+ID4NCj4gPg0KPiA+DQo+ID4gICAgICAgIC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0t
LS0tDQo+ID4gICAgICAgIEZyb206IERpbm8gRmFyaW5hY2NpIFttYWlsdG86ZmFyaW5hY2NpQGdt
YWlsLmNvbV0NCj4gPiAgICAgICAgU2VudDogV2VkbmVzZGF5LCBNYXkgMjEsIDIwMTQgNjo1OCBQ
TQ0KPiA+ICAgICAgICBUbzogUm9uYWxkIEJvbmljYQ0KPiA+ICAgICAgICBDYzogUm9nZXIgSm9y
Z2Vuc2VuOyBsaXNwQGlldGYub3JnIDxtYWlsdG86bGlzcEBpZXRmLm9yZz4NCj4gPiAgICAgICAg
U3ViamVjdDogUmU6IFtsaXNwXSBSZXN0YXJ0aW5nIGxhc3QgY2FsbCBvbiBMSVNQIHRocmVhdHMN
Cj4gPg0KPiA+DQo+ID4gICAgICAgICAgICBUaGUgYXR0YWNrZXIgc2VuZHMgYSBmbG93IG9mIGNy
YWZ0ZWQgcGFja2V0cyB0byB0aGUgdmljdGltDQo+ID4gICAgICAgICAgICBYVFIuIEVhY2ggcGFj
a2V0DQo+ID4NCj4gPiAgICAgICAgaXMgYSB3ZWxsLWZvcm1lZCBMSVNQIGRhdGEgcGFja2V0LiBJ
dCBjb250YWluczoNCj4gPg0KPiA+DQo+ID4gICAgICAgICAgICAtIGFuIG91dGVyIElQIGhlYWRl
ciAoTE9DLT5MT0MpDQo+ID4gICAgICAgICAgICAtIGEgVURQIGhlYWRlcg0KPiA+ICAgICAgICAg
ICAgLSBhIExJU1AgSGVhZGVyDQo+ID4gICAgICAgICAgICAtIGFuIElQIGhlYWRlciAoRUlELT5F
SUQpDQo+ID4gICAgICAgICAgICAtIHBheWxvYWQNCj4gPg0KPiA+DQo+ID4gICAgICAgIEp1c3Qg
bGlrZSBhIHJlZ3VsYXIgcGFja2V0IEkgY2FuIHNlbmQgdG8geW91ciBob21lIHJvdXRlciB0b2Rh
eS4NCj4gPiAgICAgICAgU28geWVzIG9rYXkuDQo+ID4gICAgICAgIFNvIGxldCdzIGNvbnRpbnVl
LiBTZWUgY29tbWVudHMgYmVsb3cuDQo+ID4NCj4gPg0KPiA+ICAgICAgICAgICAgRWFjaCBwYWNr
ZXQgY29udGFpbnMgY29udHJvbCBwbGFuZSBpbmZvcm1hdGlvbiB0aGF0IGlzIG5ldw0KPiA+ICAg
ICAgICAgICAgdG8gdGhlIHZpY3RpbQ0KPiA+DQo+ID4NCj4gPiAgICAgICAgQmUgbW9yZSBzcGVj
aWZpYyBhYm91dCB3aGF0IGNvbnRyb2wgaW5mb3JtYXRpb24gYXJlIGluIHRoZXNlDQo+ID4gICAg
ICAgIGVuY2Fwc3VsYXRlZA0KPiA+ICAgICAgICBwYWNrZXRzLg0KPiA+DQo+ID4NCj4gPiAgICAg
ICAgICAgIFhUUi4gRm9yIGV4YW1wbGUsIHRoZSB2aWN0aW0gWFRSIGhhcyBubyBtYXBwaW5nIGlu
Zm9ybWF0aW9uDQo+ID4gICAgICAgICAgICByZWdhcmRpbmcNCj4gPg0KPiA+ICAgICAgICBlaXRo
ZXIgdGhlIHNvdXJjZSBMT0Mgb3Igc291cmNlIEVJRCBwcmVmaXguIFJhdGhlciB0aGFuIGdsZWFu
aW5nDQo+ID4gICAgICAgIHRoaXMgbWFwcGluZw0KPiA+ICAgICAgICBpbmZvcm1hdGlvbiBmcm9t
IHRoZSBjcmFmdGVkIHBhY2tldCwgdGhlIHZpY3RpbSBYVFIgc2VuZHMgYQ0KPiA+ICAgICAgICB2
ZXJpZnlpbmcgTUFQLQ0KPiA+ICAgICAgICBSRVFVRVNUIHRvIHRoZSBtYXBwaW5nIHN5c3RlbS4N
Cj4gPg0KPiA+DQo+ID4gICAgICAgICAgICBBc3N1bWUgdGhhdCB0aGUgYXR0YWNrIGZsb3cgaXMg
bGFyZ2UgKE4gcGFja2V0cyBwZXIgc2Vjb25kKS4NCj4gPiAgICAgICAgICAgIEFzc3VtZSBhbHNv
DQo+ID4NCj4gPiAgICAgICAgdGhhdCB0aGUgWFRScyByYXRlIGxpbWl0IGZvciBNQVAtUkVRVUVT
VCBtZXNzYWdlcyBpcyBsZXNzIHRoYW4gTg0KPiA+ICAgICAgICBwYWNrZXRzDQo+ID4gICAgICAg
IHBlciBzZWNvbmQuIEhhcyB0aGUgYXR0YWNrIG5vdCBlZmZlY3RpdmVseSBEb1MnZCB0aGUgdmlj
dGltIFhUUj8NCj4gPg0KPiA+ICAgICAgICBJdCBjYWNoZXMgdGhlIHJhdGUgdGhlIHJhdGUgdGhl
IHBhY2tldHMgYXJlIGNvbWluZyBpbiBhbmQNCj4gPiAgICAgICAgZXZlbnR1YWxseSBzdG9wcw0K
PiA+ICAgICAgICBzZW5kaW5nIE1hcC1SZXF1ZXN0cyBjb21wbGV0ZWx5Lg0KPiA+DQo+ID4gICAg
ICAgIEl0IGNhbm5vdCBzdG9wIHRoZSBpbmNvbWluZyByYXRlIG9mIHBhY2tldHMgdG9kYXkganVz
dCBsaWtlIGENCj4gPiAgICAgICAgcm9xdWUgQkdQDQo+ID4gICAgICAgIGF0dGFja2VyIGNhbiBz
ZW5kIG1pbGxpb25zIG9mIHBhY2tldHMgcGVyIHNlY29uZCB0byBhIHBlZXINCj4gPiAgICAgICAg
cmVnYXJkbGVzcyBpZiBpdA0KPiA+ICAgICAgICBkb2VzIG9yIGRvZXMgbm90IGhhdmUgdGhlIHBl
ZXIgYXV0aGVudGljYXRpb24ga2V5Lg0KPiA+DQo+ID4NCj4gPiAgICAgICAgICAgIFRvIG1ha2Ug
dGhpcyBhdHRhY2sgd29yaywgZXZlcnkgcGFja2V0IGluIHRoZSBhdHRhY2sgZmxvdw0KPiA+ICAg
ICAgICAgICAgbWF5IG5lZWQgdG8gaGF2ZQ0KPiA+DQo+ID4gICAgICAgIGEgdW5pcXVlLCBzcG9v
ZmVkLCBzb3VyY2UgTE9DLg0KPiA+DQo+ID4gICAgICAgIEFuIGltcGxlbWVudGF0aW9uIGNhbiBk
ZXRlY3QgdGhhdCBhZnRlciByYXRlIGxpbWl0aW5nIDEwMDBzIG9mDQo+ID4gICAgICAgIHN1Y2gg
cmVxdWVzdHMNCj4gPiAgICAgICAgYXJlIGhhcHBlbmluZyB0aGF0IGl0IGp1c3Qgc3RvcHMgb3Bl
cmF0aW9uLg0KPiA+DQo+ID4gICAgICAgIFdoYXQgaWYgSSBzZW50IGEgSnVuaXBlciAyMCBtaWxs
aW9uIHJvdXRlcyB0b2RheT8NCj4gPg0KPiA+ICAgICAgICBUaGUgSW50ZXJuZXQgaXMgdmVyeSBm
cmFnaWxlIGFuZCBMSVNQIElTIE5PVCBtYWtpbmcgaXQgd29yc2UuDQo+ID4gICAgICAgIEFuZCBp
biBzb21lDQo+ID4gICAgICAgIGNhc2VzIGl0IGlzIG1ha2luZyBpdCBiZXR0ZXIgd2l0aCBpbnRl
Z3JhdGVkIHRlY2huaXF1ZXMuDQo+ID4NCj4gPiAgICAgICAgRGlubw0KPiA+DQo+ID4NCj4gPiAg
ICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPiA+ICAg
IGxpc3AgbWFpbGluZyBsaXN0DQo+ID4gICAgbGlzcEBpZXRmLm9yZyA8bWFpbHRvOmxpc3BAaWV0
Zi5vcmc+DQo+ID4gICAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9saXNw
DQo+ID4NCj4gPg0KPiA+DQo+ID4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX18NCj4gPiBsaXNwIG1haWxpbmcgbGlzdA0KPiA+IGxpc3BAaWV0Zi5vcmcNCj4g
PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2xpc3ANCj4gPg0KPiANCj4g
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4gbGlzcCBt
YWlsaW5nIGxpc3QNCj4gbGlzcEBpZXRmLm9yZw0KPiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWls
bWFuL2xpc3RpbmZvL2xpc3ANCg==


From nobody Tue May 27 08:04:50 2014
Return-Path: <farinacci@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 156DD1A0171 for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 08:04:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level: 
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9,  DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EVd-QHaqyCJk for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 08:04:48 -0700 (PDT)
Received: from mail-pa0-x230.google.com (mail-pa0-x230.google.com [IPv6:2607:f8b0:400e:c03::230]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2F37E1A013B for <lisp@ietf.org>; Tue, 27 May 2014 08:04:48 -0700 (PDT)
Received: by mail-pa0-f48.google.com with SMTP id rd3so9266739pab.21 for <lisp@ietf.org>; Tue, 27 May 2014 08:04:45 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=q/WQFsB8U/4xmswLh2qKzseqpLnIvBOC/sybEMC/vqs=; b=Lmhcf6ucRAVSHwY9vYKqwuQb5t+g5E1KLH+oZeM5HeGAO+i5c4SAuqijZvNU3fjkOW I4GeM3Xc8sFGVqBcZEwoYzJS63IyHN0BVVfjbFAygrrvTGSUMQioqmga5mijyug71Ngy TK21OT18X6d2oijTK+6RV4bguWlLPqdYkiR7B13+moH+88m+rusv/ZU1OBRHAx7Ljudp pcOlbPscmVEJIVzhn4o+9ppHf8u50LpsnaoOrfxr+n+US9fchdlX+ZnwHBKUkxEKS6AM +1EEQ/Qxgrinsb/Z8vN6xeRxYif9lf/eZqJlw7Ge+ApmW3hmP+Di6KcvBllX7T2IksDh 8YPw==
X-Received: by 10.68.226.197 with SMTP id ru5mr37329621pbc.77.1401203085074; Tue, 27 May 2014 08:04:45 -0700 (PDT)
Received: from [192.168.1.174] ([207.145.253.66]) by mx.google.com with ESMTPSA id op3sm23786662pbc.40.2014.05.27.08.04.43 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 27 May 2014 08:04:44 -0700 (PDT)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\))
From: Dino Farinacci <farinacci@gmail.com>
In-Reply-To: <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com>
Date: Tue, 27 May 2014 08:04:42 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <FB6C01EE-2BB8-4848-8AA2-9512F8FE064A@gmail.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com> <538361DA.10808@joelhalpern.com> <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com>
To: Ronald Bonica <rbonica@juniper.net>
X-Mailer: Apple Mail (2.1874)
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/VrY-4Uh_MKW4kFrGLLVlmTViqwU
Cc: Roger Jorgensen <rogerj@gmail.com>, LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 27 May 2014 15:04:49 -0000

> Also, recall that large BCP38 holes exist in today's internet.

And I am going to repeat again, this is not a binary statement. That is, =
if a BCP38 hole exists in one part of the network, source spoofing can =
still be detected in other parts of the network.

Dino



From nobody Tue May 27 08:12:04 2014
Return-Path: <farinacci@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C32771A0428 for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 08:12:02 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level: 
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9,  DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vGlInooZ_rKX for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 08:12:01 -0700 (PDT)
Received: from mail-pb0-x22b.google.com (mail-pb0-x22b.google.com [IPv6:2607:f8b0:400e:c01::22b]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AAB3A1A040C for <lisp@ietf.org>; Tue, 27 May 2014 08:12:01 -0700 (PDT)
Received: by mail-pb0-f43.google.com with SMTP id up15so9403612pbc.2 for <lisp@ietf.org>; Tue, 27 May 2014 08:11:58 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=bgM/xqzvpYutgsV/i/NbWsmDZSqsWfnb28kNRk79I8o=; b=ReBPaKeiHA/J/MIfcHIoWUPLer6SgS7jt0y1rR+ASIVZuQQcZQgJi+REvUCDEmri+m VDqxtsfbwLfSznGExhV10rD+bYJh6Ldj8YkS/CfER1SAXEFOxFQwh8kEufuWGPUGQNZ/ 8FaH0ZxV98Iyswr/7PDooH4i1O1Don63oz9uT+RDSxBI4cc3P8uC2hA3tg6CXLDevHna iIbHfPXX/FUbBu4Mr7WfKFUPQXSNs5ELbb9kT9nzi4UYLzqXRTlJ1f/Hel7bmT+Q0vrX LE64xYQkMe3Iu7iaqEXLxIrDG6tD9SaMpnJ8Dcmy766PawKwRUCovauTu2HJfslTBOvT fRgw==
X-Received: by 10.66.233.73 with SMTP id tu9mr19141986pac.78.1401203518521; Tue, 27 May 2014 08:11:58 -0700 (PDT)
Received: from [192.168.1.174] ([207.145.253.66]) by mx.google.com with ESMTPSA id ck10sm74759678pac.0.2014.05.27.08.11.56 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 27 May 2014 08:11:57 -0700 (PDT)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\))
From: Dino Farinacci <farinacci@gmail.com>
In-Reply-To: <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local>
Date: Tue, 27 May 2014 08:11:55 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <2BC8321B-26CD-4A33-B999-64B8A44428DD@gmail.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com> <538361DA.10808@joelhalpern.com>, <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local>
To: Paul Vinciguerra <pvinci@VinciConsulting.com>
X-Mailer: Apple Mail (2.1874)
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/KSj1cdakPnQMNh0cyCbUlgeeXKI
Cc: Roger Jorgensen <rogerj@gmail.com>, LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 27 May 2014 15:12:03 -0000

> I would defer to Dino and others on the list, but I do not believe =
that the ETR does a reverse lookup on every packet.  At least that is =
not the behavior we observe.  What we see happen is that the packet is =
decapsulated=20

Right Paul. We did not document an ETR doing reverse lookups to solve =
this problem. When I mentioned it, I said it is something that COULD be =
done. It comes at a cost but wouldn't come at a per-packet cost, not =
even close. And as you said if the inner source is changing but the =
mapping system covers those addresses with a coarse prefix (that is =
returned from a lookup), then that reduces the number of RPF lookups, in =
addition to rate-limiting the number you do.

But I would suggest that implementations do what they are already doing. =
That is what you describe here:

> and sent to the destination.  If a valid destination host responds, =
then the ITR does a map-request for the reply packet.  There is not a =
1:1 relationship between the number of packets and the number of =
map-requests.

The mapping system is no different in its load then the DNS system. We =
engineer and build that infrastructure the same way to protect it.=20

So how many more magnitudes of hosts are sending DNS queries than xTRs =
sending Map-Requests (and please normalize this to every site having at =
least 2 xTRs per site).

We are over-reacting a bit, but just saying that is not going to calm =
fears. With continued experimentation and deployment, we will prove it.

Dino

P.S. Don't eat that burger today, it will kill you just like the =
cigarette you may smoke today.  ;-)



From nobody Tue May 27 08:12:28 2014
Return-Path: <jmh@joelhalpern.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 157AC1A0456 for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 08:12:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Level: 
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Foo5og5xXsBp for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 08:12:19 -0700 (PDT)
Received: from mailc1.tigertech.net (mailc1.tigertech.net [208.80.4.155]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 627AB1A0166 for <lisp@ietf.org>; Tue, 27 May 2014 08:12:19 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mailc1.tigertech.net (Postfix) with ESMTP id 004B8220DA5; Tue, 27 May 2014 08:12:16 -0700 (PDT)
X-Virus-Scanned: Debian amavisd-new at c1.tigertech.net
Received: from Joels-MacBook-Pro.local (pool-70-106-135-10.clppva.east.verizon.net [70.106.135.10]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mailc1.tigertech.net (Postfix) with ESMTPSA id E5964220D91; Tue, 27 May 2014 08:12:14 -0700 (PDT)
Message-ID: <5384AB4E.2010208@joelhalpern.com>
Date: Tue, 27 May 2014 11:12:14 -0400
From: "Joel M. Halpern" <jmh@joelhalpern.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.5.0
MIME-Version: 1.0
To: Dino Farinacci <farinacci@gmail.com>, Ronald Bonica <rbonica@juniper.net>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com> <538361DA.10808@joelhalpern.com> <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <FB6C01EE-2BB8-4848-8AA2-9512F8FE064A@gmail.com>
In-Reply-To: <FB6C01EE-2BB8-4848-8AA2-9512F8FE064A@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/rDMnyFhIdP1qvDcrnwSK15DDsCM
Cc: Roger Jorgensen <rogerj@gmail.com>, LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 27 May 2014 15:12:26 -0000

Can we please not get into a debate about how well BCP38 is or is not 
deployed, whether violations are remotely detectable, ...This is NOT the 
working group for that.

For our purposes, given that source address forging is known to occur, 
we have to allow it in the threat analysis.

Yours,
Joel

On 5/27/14, 11:04 AM, Dino Farinacci wrote:
>
>> Also, recall that large BCP38 holes exist in today's internet.
>
> And I am going to repeat again, this is not a binary statement. That is, if a BCP38 hole exists in one part of the network, source spoofing can still be detected in other parts of the network.
>
> Dino
>
>


From nobody Tue May 27 08:17:21 2014
Return-Path: <farinacci@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C7A071A013B for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 08:17:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level: 
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9,  DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4N-CRgrmb6pJ for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 08:17:19 -0700 (PDT)
Received: from mail-pb0-x22c.google.com (mail-pb0-x22c.google.com [IPv6:2607:f8b0:400e:c01::22c]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B14071A00F9 for <lisp@ietf.org>; Tue, 27 May 2014 08:17:19 -0700 (PDT)
Received: by mail-pb0-f44.google.com with SMTP id rq2so9465897pbb.3 for <lisp@ietf.org>; Tue, 27 May 2014 08:17:16 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=ZQWnbPGAQFlxqPIZRi3Wb0LkSv70QGtVt9EXB1muU9Q=; b=d0yXPw2ma1Jzc/e7GjyWckOx8jVSj1sBNNho0v+Zi9Q3vEjn0NEx8UZL9TuNQQDgnj QRcCOKtklXo3BBTWgVt0qBkCJ+kAF774yW4w3KOFpW87mg+w3gcjRDKdoaaN/oTS0CPf n4spo0HJ4UuF1X3Atvx4/pT6voy01fGzCJQCCmWVRjEWOqrhw7GEtmL46DUYxhXU7RTC 0vhN2q80r69edpNx3ZAZNYl1q0L2+jJ4duY0aPA5VCEL9NwCNKgX1cLv+fViwjqV4oGX 7U9zGW7296qLQacLV+EYS7HBe2/HYajc1EbUAmj10ly2Uo43LUrbWcugFQ6w3/ZUPL5K mHkg==
X-Received: by 10.66.251.136 with SMTP id zk8mr37255642pac.137.1401203836605;  Tue, 27 May 2014 08:17:16 -0700 (PDT)
Received: from [192.168.1.174] ([207.145.253.66]) by mx.google.com with ESMTPSA id tg9sm23840475pbc.29.2014.05.27.08.17.15 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 27 May 2014 08:17:15 -0700 (PDT)
Content-Type: text/plain; charset=iso-8859-1
Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\))
From: Dino Farinacci <farinacci@gmail.com>
In-Reply-To: <5384AB4E.2010208@joelhalpern.com>
Date: Tue, 27 May 2014 08:17:14 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <CBCA3DF0-2AAC-462F-89F1-8369B0E42EDE@gmail.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com> <538361DA.10808@joelhalpern.com> <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <FB6C01EE-2BB8-4848-8AA2-9512F8FE064A@gmail.com> <5384AB4E.2010208@joelhalpern.com>
To: "Joel M. Halpern" <jmh@joelhalpern.com>
X-Mailer: Apple Mail (2.1874)
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/XxM6C7nWi9dnRq6SRNpNlHBxKbo
Cc: Roger Jorgensen <rogerj@gmail.com>, LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 27 May 2014 15:17:20 -0000

> Can we please not get into a debate about how well BCP38 is or is not =
deployed, whether violations are remotely detectable, ...This is NOT the =
working group for that.

The point is that LISP makes spoofing no worse even though many think =
that it could because there are more addreses in the packet to =
manipulate. This aspect is on topic.

> For our purposes, given that source address forging is known to occur, =
we have to allow it in the threat analysis.

I agree.

Dino

>=20
> Yours,
> Joel
>=20
> On 5/27/14, 11:04 AM, Dino Farinacci wrote:
>>=20
>>> Also, recall that large BCP38 holes exist in today's internet.
>>=20
>> And I am going to repeat again, this is not a binary statement. That =
is, if a BCP38 hole exists in one part of the network, source spoofing =
can still be detected in other parts of the network.
>>=20
>> Dino
>>=20
>>=20


From nobody Tue May 27 08:24:47 2014
Return-Path: <Sharon@Contextream.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC0D31A03DD for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 08:24:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Level: 
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rppaLh-xt6AF for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 08:24:37 -0700 (PDT)
Received: from emea01-db3-obe.outbound.protection.outlook.com (mail-db3lp0075.outbound.protection.outlook.com [213.199.154.75]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 17A391A046A for <lisp@ietf.org>; Tue, 27 May 2014 08:23:47 -0700 (PDT)
Received: from DBXPR06MB399.eurprd06.prod.outlook.com (10.141.14.23) by DBXPR06MB400.eurprd06.prod.outlook.com (10.141.14.24) with Microsoft SMTP Server (TLS) id 15.0.944.11; Tue, 27 May 2014 15:23:42 +0000
Received: from DBXPR06MB399.eurprd06.prod.outlook.com ([10.141.14.23]) by DBXPR06MB399.eurprd06.prod.outlook.com ([10.141.14.23]) with mapi id 15.00.0944.000; Tue, 27 May 2014 15:23:42 +0000
From: Sharon Barkai <Sharon@Contextream.com>
To: Ronald Bonica <rbonica@juniper.net>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa57m+o2Brd1FsE6b44HD+a1mF5s9MyiAgAD04oCAAJ/u8IAAAtXQgADypYCAAm1DAIABaYAAgAeql4CAAHoZgIABcK+AgAEO0wCABDDMAIAAsuYAgAAFh4CAAXPOgIAAEpt4
Date: Tue, 27 May 2014 15:23:41 +0000
Message-ID: <358B4B1A-1883-45F9-986B-13E9D6BB8836@Contextream.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com> <538361DA.10808@joelhalpern.com> <BDAC9F7C-1205-4A59-A252-2B20998E187B@gmail.com>, <db536016d3734bf4b289f185b0051768@CO1PR05MB442.namprd05.prod.outlook.com>
In-Reply-To: <db536016d3734bf4b289f185b0051768@CO1PR05MB442.namprd05.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [2600:1010:b10a:df8c:c68:6ef8:2041:5023]
x-forefront-prvs: 02243C58C6
x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(51704005)(13464003)(52604005)(479174003)(24454002)(189002)(199002)(377454003)(36756003)(20776003)(77982001)(2656002)(81542001)(81342001)(76176999)(21056001)(92726001)(86362001)(1941001)(83072002)(87936001)(19580395003)(64706001)(85852003)(74662001)(83322001)(50986999)(46102001)(79102001)(33656002)(74502001)(83716003)(54356999)(4396001)(15975445006)(80022001)(99396002)(19580405001)(82746002)(76482001)(101416001)(77096999)(3826001)(80792004); DIR:OUT; SFP:; SCL:1; SRVR:DBXPR06MB400; H:DBXPR06MB399.eurprd06.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; 
received-spf: None (: Contextream.com does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=Sharon@Contextream.com; 
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: Contextream.com
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/bCpwyYna6CImZITOzja5OzwwAVM
Cc: Roger Jorgensen <rogerj@gmail.com>, LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 27 May 2014 15:24:44 -0000

Hi Roland, Got it. Tnx.

 I thought that since the mapping is in the underlay, then existing underla=
y protections apply.. unless "outerlay" elements use the XTRs in order to i=
ndirectly attack the mapping service.
I thought that's what you meant..=20

And that the problem of why this is not a trivial throttling is because the=
 mapping itself is distributed so no one place can identify the XTR being l=
everaged for the attack. That's why I thought keeping an mapping internal l=
caf/counter-Schema can help.

But I think Joel is correct, and let's first phrase the problem.
Thanks for the clarification.

--szb

On May 27, 2014, at 7:17 AM, "Ronald Bonica" <rbonica@juniper.net> wrote:

Hi Sharon,

We may be talking about an XTR that is sick due to a bug or attack. We may =
also be talking about an attacker that isn't an XTR at all, just impersonat=
ing one.

                                                                           =
  Ron


> -----Original Message-----
> From: Sharon [mailto:sbarkai@gmail.com]
> Sent: Monday, May 26, 2014 12:06 PM
> To: Joel M. Halpern
> Cc: Ronald Bonica; Damien Saucez; Roger Jorgensen; LISP mailing list list
> Subject: Re: [lisp] Restarting last call on LISP threats
>=20
> Joel, thanks for clearing.
> It was hard to follow.
>=20
> If the challenge is for a distributed mapping system to keep track and pr=
otect
> itself from a "sick" xTR, sick because of a bug or an attack..
> Then perhaps we could maintain mapping lookup per sec counters per xTR in
> the mapping. It adds some overhead to the mapping, but doesn't slow down
> forwarding. Can be aggregated by map servers for efficiency.
>=20
> --szb
>=20
> On May 26, 2014, at 8:46 AM, "Joel M. Halpern" <jmh@joelhalpern.com>
> wrote:
>=20
> Top posting to make sure I am understanding:
>=20
> You asssert that any xTR is subject to a DoS attack.  And that such a DoS
> attack can render the mapping system unusable.
>=20
> It targeting an ITR, this would need to be from within ths cope the ITR s=
erves.
> I believe that is discussed.
>=20
> If I have connected the dots correctly, the attack you are contemplating =
is
> sending a large stream of packets with different inner source addresses t=
o an
> ETR.  This would prompt the ETR to check with the mapping system about
> each and every address.
>=20
> If I have understood this properly, while there are several very effectiv=
e
> mitigations, that does not change the basic message that this is an attac=
k, and
> as such ought to be described in the threats document.  There are clealry=
 a
> number of variations on this attack.  For example, using the same outer
> source address makes mitigation easier, while using different outer sourc=
e
> addresses either requires a bot-net or a large unchecked BCP38 hole (and
> those can be used for MANY attacks on many systems.)  Both presumably
> should be described.
>=20
> Have I captured your request accurately?
>=20
> Yours,
> Joel
>=20
>> On 5/26/14, 1:06 AM, Ronald Bonica wrote:
>> *From:*Damien Saucez [mailto:damien.saucez@gmail.com]
>> *Sent:* Friday, May 23, 2014 9:07 AM
>> *To:* Ronald Bonica
>> *Cc:* Dino Farinacci; Roger Jorgensen; LISP mailing list list
>> *Subject:* Re: [lisp] Restarting last call on LISP threats
>>=20
>> Hello Ronald,
>>=20
>> On 22 May 2014, at 22:57, Ronald Bonica <rbonica@juniper.net
>> <mailto:rbonica@juniper.net>> wrote:
>>=20
>>=20
>>=20
>>   Dino,
>>=20
>>   Today's Internet is not as fragile as you think. This mail traversed
>>   many routers between my house and yours. If those routers are
>>   well-managed, there is nothing that I can do from my house that will
>>   cause any of those routers to consume control plane resources.
>>   Therefore, there is nothing that I can do from my house that will
>>   cause a DoS attack against those routers' control planes.
>>=20
>> We tend to disagree with that, for example you have ICMP today...
>>=20
>> */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn=92t make a
>> very good routing protocol. That=92s why we don=92t use it for routing. =
By
>> contrast, LISP map-request messages are susceptible to DoS attacks and
>> they do carry routing information./*
>>=20
>>=20
>>=20
>>   In LISP, separation between the forwarding and control plane is
>>   lost. As a matter of course, forwarding plane activity causes
>>   control plane activity. Since forwarding plane bandwidth exceeds
>>   control plane bandwidth, DoS attacks against the control plane are
>>   possible.
>>=20
>>   In order to be complete, the threats document must describe the DoS
>>   threat. It should also describe mitigations, if any exist.
>>=20
>> DoS is already explained and the definition given:
>>=20
>> " A Denial of Service (DoS) attack aims at disrupting a specific
>>=20
>>   targeted service either by exhausting the resources of the victim
>> up
>>=20
>>   to the point that it is not able to provide a reliable service to
>>=20
>>   legit traffic and/or systems or by exploiting vulnerabilities to
>> make
>>=20
>>   the targeted service unable to operate properly.
>>=20
>> "
>>=20
>> is covering the case you mention.
>>=20
>> */[RPB] /*
>>=20
>> */You might want to add the following details to section 5.2:/*
>>=20
>> *//*
>>=20
>> -A DoS attack can be launched by anybody who can send a packet to the
>> XTR=92s LOC
>>=20
>> -DoS attacks can render an XTR inoperable
>>=20
>> -DDoS attacks can render the mapping system inoperable.
>>=20
>> This is what differentiates LISP from today=92s routing system.
>>=20
>>                                      Ron
>>=20
>> Damien Saucez
>>=20
>>=20
>>=20
>>=20
>> Ron
>>=20
>>=20
>>=20
>>       -----Original Message-----
>>       From: Dino Farinacci [mailto:farinacci@gmail.com]
>>       Sent: Wednesday, May 21, 2014 6:58 PM
>>       To: Ronald Bonica
>>       Cc: Roger Jorgensen; lisp@ietf.org <mailto:lisp@ietf.org>
>>       Subject: Re: [lisp] Restarting last call on LISP threats
>>=20
>>=20
>>           The attacker sends a flow of crafted packets to the victim
>>           XTR. Each packet
>>=20
>>       is a well-formed LISP data packet. It contains:
>>=20
>>=20
>>           - an outer IP header (LOC->LOC)
>>           - a UDP header
>>           - a LISP Header
>>           - an IP header (EID->EID)
>>           - payload
>>=20
>>=20
>>       Just like a regular packet I can send to your home router today.
>>       So yes okay.
>>       So let's continue. See comments below.
>>=20
>>=20
>>           Each packet contains control plane information that is new
>>           to the victim
>>=20
>>=20
>>       Be more specific about what control information are in these
>>       encapsulated
>>       packets.
>>=20
>>=20
>>           XTR. For example, the victim XTR has no mapping information
>>           regarding
>>=20
>>       either the source LOC or source EID prefix. Rather than gleaning
>>       this mapping
>>       information from the crafted packet, the victim XTR sends a
>>       verifying MAP-
>>       REQUEST to the mapping system.
>>=20
>>=20
>>           Assume that the attack flow is large (N packets per second).
>>           Assume also
>>=20
>>       that the XTRs rate limit for MAP-REQUEST messages is less than N
>>       packets
>>       per second. Has the attack not effectively DoS'd the victim XTR?
>>=20
>>       It caches the rate the rate the packets are coming in and
>>       eventually stops
>>       sending Map-Requests completely.
>>=20
>>       It cannot stop the incoming rate of packets today just like a
>>       roque BGP
>>       attacker can send millions of packets per second to a peer
>>       regardless if it
>>       does or does not have the peer authentication key.
>>=20
>>=20
>>           To make this attack work, every packet in the attack flow
>>           may need to have
>>=20
>>       a unique, spoofed, source LOC.
>>=20
>>       An implementation can detect that after rate limiting 1000s of
>>       such requests
>>       are happening that it just stops operation.
>>=20
>>       What if I sent a Juniper 20 million routes today?
>>=20
>>       The Internet is very fragile and LISP IS NOT making it worse.
>>       And in some
>>       cases it is making it better with integrated techniques.
>>=20
>>       Dino
>>=20
>>=20
>>   _______________________________________________
>>   lisp mailing list
>>   lisp@ietf.org <mailto:lisp@ietf.org>
>>   https://www.ietf.org/mailman/listinfo/lisp
>>=20
>>=20
>>=20
>> _______________________________________________
>> lisp mailing list
>> lisp@ietf.org
>> https://www.ietf.org/mailman/listinfo/lisp
>=20
> _______________________________________________
> lisp mailing list
> lisp@ietf.org
> https://www.ietf.org/mailman/listinfo/lisp
_______________________________________________
lisp mailing list
lisp@ietf.org
https://www.ietf.org/mailman/listinfo/lisp


From nobody Tue May 27 08:49:56 2014
Return-Path: <farinacci@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2DA7D1A034E for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 08:49:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level: 
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9,  DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0q04HXiO6jDd for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 08:49:53 -0700 (PDT)
Received: from mail-pb0-x232.google.com (mail-pb0-x232.google.com [IPv6:2607:f8b0:400e:c01::232]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1B57E1A0254 for <lisp@ietf.org>; Tue, 27 May 2014 08:49:53 -0700 (PDT)
Received: by mail-pb0-f50.google.com with SMTP id ma3so9452072pbc.23 for <lisp@ietf.org>; Tue, 27 May 2014 08:49:50 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=haWattmyeJdO5WADRVPirz7GPuA33bBmWHRJ+EypYzk=; b=CPdU+YddBP19/zpdR0QwDUxeBY/+rFl3Bp7gRIXZ9CLVUGzplL7kwtALDjlOedSt/H XBytrae5hjAF2v2IWa4YeCuOpBhRKUPW1BubcS3l1uYavNitt5jRZ6y5JgAj/fUFNlvf FYvyk5cMgFmgHnNJDcNIM30cJazSkfFmCJr+8Int7u3mlcX837lVUPyNvH3ZkCYsHGnX BMKS6oEd8+XfiZJP2ctqzk1XxpuHxBPBiwC7rWwLP3SatfHA0x+Xcm/1w/hUF5oiXouI G9a1Bg0VS6746L+vBHzAR3YXQd47QTlWU4wDapLjyI/xC3dteQBr7rL7e3OguGBLNVoJ CYdA==
X-Received: by 10.68.196.137 with SMTP id im9mr37129825pbc.105.1401205789953;  Tue, 27 May 2014 08:49:49 -0700 (PDT)
Received: from [192.168.1.174] ([207.145.253.66]) by mx.google.com with ESMTPSA id ln2sm48901945pab.35.2014.05.27.08.49.43 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 27 May 2014 08:49:47 -0700 (PDT)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\))
From: Dino Farinacci <farinacci@gmail.com>
In-Reply-To: <16a14e1029954a9cb74c6115dd3c1a71@CO2PR05MB636.namprd05.prod.outlook.com>
Date: Tue, 27 May 2014 08:49:42 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <64174C84-3DF2-43B0-891C-2237B84A44CA@gmail.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <B3FF60AE-ED9D-45E6-BBB5-AE3F6C6172F8@gmail.com> <16a14e1029954a9cb74c6115dd3c1a71@CO2PR05MB636.namprd05.prod.outlook.com>
To: Ross Callon <rcallon@juniper.net>
X-Mailer: Apple Mail (2.1874)
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/S0RRUjr7KduKyrIxv8VDB7yhvOM
Cc: LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 27 May 2014 15:49:55 -0000

Ross, see my responses inline.

> Detailed comments below. To summarize, these details include three =
threats which are new to LISP and which are not adequately explained in =
the current threats document:
>=20
> (1) The Control Plane Threat: LISP allows a dataplane DOS attack (lots =
of packets sent to overwhelm a site) to turn into a control plane attack =
(the router is forced to respond to the attack in the control plane, =
which is of course frequently multiple orders of magnitude slower than =
the data plane, particularly for very high speed routers).=20

It turns into a control-plane request stream which is many orders of =
magnitude less than the data packet stream. And since the data-plane =
bandwidth to the control-plane bandwidth inside of the xTR is also =
orders of magnitude of difference, you will find this will protect the =
mapping database control-plane.

That is, no router control-plane will be capable of sending Map-Requests =
at any rate faster than at least 2 orders of magnitude of what the =
control-plane in that router implementation can do. And then, if this =
xTR will rate-limit on top of the Map-Request rate, it is even slower.

This is not speculation. This has been proven with many different =
implementation attempts over the last 7 years.

> (2) The Privacy Threat: LISP provides an attacker with a relatively =
easy way to determine the identity of large numbers of PE and/or CE =
routers (globally, if LISP is deployed on that level) .

We should document this, but there are tons of easily accessible =
databases in protocols, operational data structures, key management =
data, and application systems that do this as well.

But LISP can encrypt or require authentication of this information, so =
it can be hidden from potential attackers.

When we built the mapping database system, we wanted it to look like DNS =
for scale and accessiblility but knew the security concerns and hence =
why we have several mechanisms to allow a mapping database to be a =
closed system, even at Internet scale.

> (3) the Traffic Gleaning Threat: If an xTR gleans EID -> RLOC mappings =
from incoming packets, this provides an easy way for hackers to =
intercept traffic. I put this threat third because gleaning can be =
turned off, and thus this threat can be defeated simply by not gleaning =
EID -> RLOC mappings.=20

This is why the spec says MAY for data gleaning. We put this in the main =
specification because in closed enterprise environments people wanted =
this feature.

> WRT the first of these, Dino has pointed out that the control plane of =
routers already receive BGP packets from sources outside their domain. =
Thus a DOS attack on the control plane of routers can be launched =
through BGP.=20

I don't want to make this a LISP versus BGP debate. Because if we do, we =
won't make any progress.

But with a centrally managed database system, you can put controls in =
without getting an entire Internet peering topology to buy in. The =
security systems we can put into the mapping database, can be =
incrementally added and provide benefit to xTRs that don't even know =
what was added.

The mapping database is distributed like DNS to scale but managed =
centrally. And I am not talking about using SDN type approaches either =
to achieve this.

> However, the number of BGP peers that a router has is limited, and can =
be known a priori. Thus it is possible, and relatively common, for a =
router to be configured to only accept BGP updates from a very limited =
number of identified other routers (in many cases a moderate number of =
external peers plus a few internal route reflectors). Each of these =
known BGP sessions can be individually rate limited, and no other source =
can be allowed to send BGP updates to the router. Also, other control =
traffic to the router can be limited to internal peers (eg, OSPF, IS-IS, =
LDP, and/or RSVP from other internal routers, plus network management =
traffic from internal sources only). Thus today every source of control =
plane traffic to the router can be controlled and rate limited. For C

If you compare the IGPs and protocols that run inside of an AS with =
LISP, then LISP has all the same benefits because a single organization =
is managing the architecture, so they can decide unilaterally decide how =
much security, gleaning, uRPFing they use.

I often compare LISP to BGP because of the scale we want LISP to grow =
to.=20

> E routers the number of BGP peers can be even more limited, possibly =
to one (the PE) or even none (for stub domains use manually configured =
static routes).=20
>=20
> If LISP were ubiquitously and globally deployed across the Internet, =
then mapping requests could come from pretty much anywhere. Similarly =
incoming data plane traffic which contains EID's that are not currently =
listed

But those Map-Requests can be authenticated if the attacker chose a =
Map-Resolver that wanted to operate at a high security level.

There will always be open Map-Resolvers (just like DNS server 8.8.8.8) =
which has to scale for good and bad requests. Those systems have dozens =
of implementation techniques to do signature detection and mitigation of =
suspicious packet-request trains.

>  in your EID -> RLOC mapping would cause a mapping request to be =
generated in the control plane. I understand that mapping requests (both =
incoming and outgoing) can be rate limited, but this simply turns a =
"shut down the router's control plane" attack to turn into a "shut down =
the router's mapping function" attack. If correct operation relies on =
the mapping function, then you have still broken the router.=20

You have to couple rate-limiting with some cacheing and timing =
information.

> The second of these is a big deal which has not been talked about =
much. We don't want hackers to know the identity of all PE and/or CE =
routers. It is difficult to fully anticipate what attacks will occur, =
but there certainly have already been intrusions of various kinds =
against routers and making it fundamentally easier for hackers to know =
the identity of a large number of routers is something that it at least =
important enough to mention.=20

If I traceroute to your house Ross, I know all routers on the path. LISP =
does not make this problem worse.=20

And we cannot practically say every weakness in the Internet is also a =
weakness in LISP, so we may as well not deploy LISP. That will give =
people the wrong impression. We want to be honest and document threats, =
but we can't get out of hand, because we will ALWAYs be incomplete.

And the danger and effort spent on LISP will be what it can't do rather =
than what new things it brings to the Internet.

> Regarding the third of these, there have already been attacks which =
mis-route traffic. Eg:
> http://www.wired.com/2013/12/bgp-hijacking-belarus-iceland/  =20

I recommend that no one use data-packet gleaning in an ETR unless the =
mapping system knows all sources sending map-requests to a closed and =
control mapping system.

Data-plane gleaning should not be used generally on the capital-I =
Internet.

Dino


From nobody Tue May 27 09:06:45 2014
Return-Path: <damien.saucez@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 167911A04AF for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 09:06:38 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.65
X-Spam-Level: 
X-Spam-Status: No, score=-1.65 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HELO_EQ_FR=0.35, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4YHlTCNWR_JU for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 09:06:36 -0700 (PDT)
Received: from mail-wi0-x233.google.com (mail-wi0-x233.google.com [IPv6:2a00:1450:400c:c05::233]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6406E1A0489 for <lisp@ietf.org>; Tue, 27 May 2014 09:06:03 -0700 (PDT)
Received: by mail-wi0-f179.google.com with SMTP id bs8so2013304wib.6 for <lisp@ietf.org>; Tue, 27 May 2014 09:05:58 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=pm4h/bA4toOaykfJYXK6UYeu9NopWzoyVThxhOZlNJQ=; b=GHXskJ317fyfs4bSFBNObsUN2rGmT0/2jGk4Kca7w+uoRfEGbedHtGcot8Hr54p1FM Bk4PPz3hv25QRKvsory8gFY6oWhpV5bvCYl3eqaX+7D8K9mnDHBAPjN/UsIGGTeRLLVD 3Cvq0EQsxPApZ5obNJplrwPrxAvP9ogTyNU+CU4HISLrfttjQfTMmseznU51bT+vpelZ csd5yRap8eviQxKyHbWs/V3NRgi4xAatBeXEX+1yuKAEaJ31/sG1TWVH/sN9G8m7nf84 Lyayec737xQkyCzof6ISzS4xQhsRR2m59VplH3FeoMNuTmtm7gU9oizHmRI69/TfEE1F pK3w==
X-Received: by 10.194.9.8 with SMTP id v8mr42148735wja.53.1401206757262; Tue, 27 May 2014 09:05:57 -0700 (PDT)
Received: from faucon.inria.fr (faucon.inria.fr. [138.96.201.73]) by mx.google.com with ESMTPSA id l2sm9418172wix.13.2014.05.27.09.05.56 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 27 May 2014 09:05:56 -0700 (PDT)
Content-Type: text/plain; charset=iso-8859-1
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.2\))
From: Damien Saucez <damien.saucez@gmail.com>
In-Reply-To: <5384AB4E.2010208@joelhalpern.com>
Date: Tue, 27 May 2014 18:05:55 +0200
Content-Transfer-Encoding: quoted-printable
Message-Id: <8F830D21-5689-476C-97E9-7D92A1CBAA28@gmail.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com> <538361DA.10808@joelhalpern.com> <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <FB6C01EE-2BB8-4848-8AA2-9512F8FE064A@gmail.com> <5384AB4E.2010208@joelhalpern.com>
To: LISP mailing list list <lisp@ietf.org>
X-Mailer: Apple Mail (2.1878.2)
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/5wI5DEd1UIYaj79K5EPBDhzhMM8
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 27 May 2014 16:06:38 -0000

Dear all,

Thank you all for the passion you put in discussing the threats
document.  We have read all the arguments and arrived to the
conclusion that the threat document needs to be reshaped so to clear
all misunderstandings.  We will provide a new version for early July
that does not exclude any scenarios.  Actually most of problems
pinpointed are already covered somehow in the document but
precisions/rephrasing have to be done to make things clear.

For the sake of efficiency, while writing the new proposal in the
coming weeks, we will make point-to-point exchanges with the different
people that contributed to the discussion so to be sure that we
address all their comments.

Thanks,

Damien Saucez

On 27 May 2014, at 17:12, Joel M. Halpern <jmh@joelhalpern.com> wrote:

> Can we please not get into a debate about how well BCP38 is or is not =
deployed, whether violations are remotely detectable, ...This is NOT the =
working group for that.
>=20
> For our purposes, given that source address forging is known to occur, =
we have to allow it in the threat analysis.
>=20
> Yours,
> Joel
>=20
> On 5/27/14, 11:04 AM, Dino Farinacci wrote:
>>=20
>>> Also, recall that large BCP38 holes exist in today's internet.
>>=20
>> And I am going to repeat again, this is not a binary statement. That =
is, if a BCP38 hole exists in one part of the network, source spoofing =
can still be detected in other parts of the network.
>>=20
>> Dino
>>=20
>>=20


From nobody Tue May 27 15:45:15 2014
Return-Path: <rbonica@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C103A1A0790 for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 15:45:13 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.902
X-Spam-Level: 
X-Spam-Status: No, score=-101.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id soPic6PLPHyS for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 15:45:10 -0700 (PDT)
Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1blp0186.outbound.protection.outlook.com [207.46.163.186]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8950D1A0503 for <lisp@ietf.org>; Tue, 27 May 2014 15:45:09 -0700 (PDT)
Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB441.namprd05.prod.outlook.com (10.141.73.147) with Microsoft SMTP Server (TLS) id 15.0.949.11; Tue, 27 May 2014 22:45:02 +0000
Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) with mapi id 15.00.0949.001; Tue, 27 May 2014 22:45:02 +0000
From: Ronald Bonica <rbonica@juniper.net>
To: Paul Vinciguerra <pvinci@VinciConsulting.com>, "Joel M. Halpern" <jmh@joelhalpern.com>, Damien Saucez <damien.saucez@gmail.com>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEIABfmkAgAefyVCAAITngIABbBJggAETbwCABC0O0IAAtqUAgAABTnCAADykgIABvzTg
Date: Tue, 27 May 2014 22:45:02 +0000
Message-ID: <936e209eb2fb49288f3a776aaa4b71cb@CO1PR05MB442.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com> <538361DA.10808@joelhalpern.com>, <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local>
In-Reply-To: <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.14]
x-forefront-prvs: 02243C58C6
x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(24454002)(377454003)(51704005)(52604005)(479174003)(13464003)(199002)(189002)(15975445006)(101416001)(76576001)(21056001)(19580405001)(83322001)(19580395003)(81342001)(81542001)(33646001)(92566001)(74316001)(86362001)(80022001)(66066001)(20776003)(46102001)(76482001)(79102001)(77982001)(64706001)(83072002)(85852003)(2656002)(87936001)(76176999)(54356999)(50986999)(99396002)(74662001)(99286001)(74502001)(4396001)(31966008)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO1PR05MB441; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; 
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/QAKyV-cBkDez99wUR5T4U6m9Lr4
Cc: Roger Jorgensen <rogerj@gmail.com>, LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 27 May 2014 22:45:13 -0000

Hi Paul,

The attack scenario that I envision is slightly different from the on that =
you describe below:

- LISP is widely deployed. Tens of thousands of XTRs are deployed world-wid=
e. The mapping system data base contains hundreds of thousands of EID prefi=
xes.
- The attack stream is large
- Each packet in the attack stream has a unique source LOC
- All packets in the attack stream have the same destination LOC. This LOC =
represents the XTR under attack.
- Each packet in the attack stream has a destination EID that will cause it=
 to reach a valid destination (i.e., a destination that will respond). Howe=
ver, all packets in the attack stream don't have the same destination. The =
attack stream is spread out across multiple valid EID destinations to make =
it less detectable.
- Each packet in the attack stream has a carefully chosen source EID. It is=
 chosen to maximize the ratio of attack packets to map-requests.

One attack stream attacks an XTR. Multiple simultaneous attacks against mul=
tiple XTRs can DoS the mapping system, itself.

A PxTR probably won't generate this attack stream. However, an attack tool =
might.

Hope this helps.

                                                            Ron

> -----Original Message-----
> From: Paul Vinciguerra [mailto:pvinci@VinciConsulting.com]
> Sent: Monday, May 26, 2014 3:28 PM
> To: Ronald Bonica; Joel M. Halpern; Damien Saucez
> Cc: Roger Jorgensen; LISP mailing list list
> Subject: RE: [lisp] Restarting last call on LISP threats
>=20
> Every host on the Internet is subject to a DoS attack.  An xTR is no more=
 so.  I
> am also not clear on how a DoS attack on an xTR would create any more ris=
k
> than an attack directly against the mapping system.
>=20
> Joel describes Ronald's scenario of an attack where a large stream of pac=
kets
> with different inner source addresses to an ETR.  I don't call this an at=
tack.  I
> call this our steady-state.  These would be the PxTR's we operate across =
the
> US.  The PxTR's on the beta-network are no different.  We take in packets
> from anywhere.  This is a "Free" attacker if you will.  All that really m=
eans is
> that you do not have to incur the computational cost of encapsulating the
> packet.
>=20
> I would defer to Dino and others on the list, but I do not believe that t=
he ETR
> does a reverse lookup on every packet.  At least that is not the behavior=
 we
> observe.  What we see happen is that the packet is decapsulated and sent =
to
> the destination.  If a valid destination host responds, then the ITR does=
 a
> map-request for the reply packet.  There is not a 1:1 relationship betwee=
n
> the number of packets and the number of map-requests.
>=20
> Map-replies for IP addresses return prefixes. These prefixes can cover la=
rger
> address spaces than the map-request and limit the number of future map-
> requests needed.
>=20
> Can you provide more specific details on how you see the xTR rendering th=
e
> mapping system unusable?
>=20
> For what its worth, I still support the decision for last call and not to=
 place
> mitigations within the document.  Without knowing the specifics of a
> configuration and implementation, that just leads to a false sense of sec=
urity.
>=20
>=20
> ________________________________________
> From: lisp [lisp-bounces@ietf.org] on behalf of Ronald Bonica
> [rbonica@juniper.net]
> Sent: Monday, May 26, 2014 11:57 AM
> To: Joel M. Halpern; Damien Saucez
> Cc: Roger Jorgensen; LISP mailing list list
> Subject: Re: [lisp] Restarting last call on LISP threats
>=20
> Inline.....
>=20
> > -----Original Message-----
> > From: Joel M. Halpern [mailto:jmh@joelhalpern.com]
> > Sent: Monday, May 26, 2014 11:47 AM
> > To: Ronald Bonica; Damien Saucez
> > Cc: Roger Jorgensen; LISP mailing list list
> > Subject: Re: [lisp] Restarting last call on LISP threats
> >
> > Top posting to make sure I am understanding:
> >
> > You asssert that any xTR is subject to a DoS attack.  And that such a
> > DoS attack can render the mapping system unusable.
> [RPB]
> Exactly!
>=20
> >
> > It targeting an ITR, this would need to be from within ths cope the ITR
> serves.
> [RPB]
> I don't understand this sentence. Please try again.
>=20
> > I believe that is discussed.
> [RPB]
> Given that I don't understand the sentence above, I have no idea if this
> sentence is true.
>=20
> >
> > If I have connected the dots correctly, the attack you are
> > contemplating is sending a large stream of packets with different
> > inner source addresses to an ETR.  This would prompt the ETR to check
> > with the mapping system about each and every address.
> [RPB]
> Exactly!
>=20
> >
> > If I have understood this properly, while there are several very
> > effective mitigations, that does not change the basic message that
> > this is an attack, and as such ought to be described in the threats
> document.
> [RPB]
> Even if there are effective mitigations, the attack should be described.
>=20
> However, I am not convinced that an effective mitigation exists.
>=20
> >   There are clealry a number of variations on this attack.
> [RPB]
> True!
>=20
>   For example, using
> > the same outer source address makes mitigation easier, while using
> > different outer source addresses either requires a bot-net or a large
> > unchecked BCP38 hole (and those can be used for MANY attacks on many
> > systems.)  Both presumably should be described.
> [RPB]
> Yes, both should be described.
>=20
> Also, recall that large BCP38 holes exist in today's internet.
>=20
> >
> > Have I captured your request accurately?
> [RPB]
> Pretty much.
>=20
> Thanks for taking the effort.
>=20
>                     Ron
>=20
> >
> > Yours,
> > Joel
> >
> > On 5/26/14, 1:06 AM, Ronald Bonica wrote:
> > > *From:*Damien Saucez [mailto:damien.saucez@gmail.com]
> > > *Sent:* Friday, May 23, 2014 9:07 AM
> > > *To:* Ronald Bonica
> > > *Cc:* Dino Farinacci; Roger Jorgensen; LISP mailing list list
> > > *Subject:* Re: [lisp] Restarting last call on LISP threats
> > >
> > > Hello Ronald,
> > >
> > > On 22 May 2014, at 22:57, Ronald Bonica <rbonica@juniper.net
> > > <mailto:rbonica@juniper.net>> wrote:
> > >
> > >
> > >
> > >     Dino,
> > >
> > >     Today's Internet is not as fragile as you think. This mail traver=
sed
> > >     many routers between my house and yours. If those routers are
> > >     well-managed, there is nothing that I can do from my house that w=
ill
> > >     cause any of those routers to consume control plane resources.
> > >     Therefore, there is nothing that I can do from my house that will
> > >     cause a DoS attack against those routers' control planes.
> > >
> > > We tend to disagree with that, for example you have ICMP today...
> > >
> > > */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn't make
> > > a very good routing protocol. That's why we don't use it for
> > > routing. By contrast, LISP map-request messages are susceptible to
> > > DoS attacks and they do carry routing information./*
> > >
> > >
> > >
> > >     In LISP, separation between the forwarding and control plane is
> > >     lost. As a matter of course, forwarding plane activity causes
> > >     control plane activity. Since forwarding plane bandwidth exceeds
> > >     control plane bandwidth, DoS attacks against the control plane ar=
e
> > >     possible.
> > >
> > >     In order to be complete, the threats document must describe the D=
oS
> > >     threat. It should also describe mitigations, if any exist.
> > >
> > > DoS is already explained and the definition given:
> > >
> > > " A Denial of Service (DoS) attack aims at disrupting a specific
> > >
> > >     targeted service either by exhausting the resources of the
> > > victim up
> > >
> > >     to the point that it is not able to provide a reliable service
> > > to
> > >
> > >     legit traffic and/or systems or by exploiting vulnerabilities to
> > > make
> > >
> > >     the targeted service unable to operate properly.
> > >
> > > "
> > >
> > > is covering the case you mention.
> > >
> > > */[RPB] /*
> > >
> > > */You might want to add the following details to section 5.2:/*
> > >
> > > *//*
> > >
> > > -A DoS attack can be launched by anybody who can send a packet to
> > > the XTR's LOC
> > >
> > > -DoS attacks can render an XTR inoperable
> > >
> > > -DDoS attacks can render the mapping system inoperable.
> > >
> > > This is what differentiates LISP from today's routing system.
> > >
> > >                                        Ron
> > >
> > > Damien Saucez
> > >
> > >
> > >
> > >
> > > Ron
> > >
> > >
> > >
> > >         -----Original Message-----
> > >         From: Dino Farinacci [mailto:farinacci@gmail.com]
> > >         Sent: Wednesday, May 21, 2014 6:58 PM
> > >         To: Ronald Bonica
> > >         Cc: Roger Jorgensen; lisp@ietf.org <mailto:lisp@ietf.org>
> > >         Subject: Re: [lisp] Restarting last call on LISP threats
> > >
> > >
> > >             The attacker sends a flow of crafted packets to the victi=
m
> > >             XTR. Each packet
> > >
> > >         is a well-formed LISP data packet. It contains:
> > >
> > >
> > >             - an outer IP header (LOC->LOC)
> > >             - a UDP header
> > >             - a LISP Header
> > >             - an IP header (EID->EID)
> > >             - payload
> > >
> > >
> > >         Just like a regular packet I can send to your home router tod=
ay.
> > >         So yes okay.
> > >         So let's continue. See comments below.
> > >
> > >
> > >             Each packet contains control plane information that is ne=
w
> > >             to the victim
> > >
> > >
> > >         Be more specific about what control information are in these
> > >         encapsulated
> > >         packets.
> > >
> > >
> > >             XTR. For example, the victim XTR has no mapping informati=
on
> > >             regarding
> > >
> > >         either the source LOC or source EID prefix. Rather than glean=
ing
> > >         this mapping
> > >         information from the crafted packet, the victim XTR sends a
> > >         verifying MAP-
> > >         REQUEST to the mapping system.
> > >
> > >
> > >             Assume that the attack flow is large (N packets per secon=
d).
> > >             Assume also
> > >
> > >         that the XTRs rate limit for MAP-REQUEST messages is less tha=
n N
> > >         packets
> > >         per second. Has the attack not effectively DoS'd the victim X=
TR?
> > >
> > >         It caches the rate the rate the packets are coming in and
> > >         eventually stops
> > >         sending Map-Requests completely.
> > >
> > >         It cannot stop the incoming rate of packets today just like a
> > >         roque BGP
> > >         attacker can send millions of packets per second to a peer
> > >         regardless if it
> > >         does or does not have the peer authentication key.
> > >
> > >
> > >             To make this attack work, every packet in the attack flow
> > >             may need to have
> > >
> > >         a unique, spoofed, source LOC.
> > >
> > >         An implementation can detect that after rate limiting 1000s o=
f
> > >         such requests
> > >         are happening that it just stops operation.
> > >
> > >         What if I sent a Juniper 20 million routes today?
> > >
> > >         The Internet is very fragile and LISP IS NOT making it worse.
> > >         And in some
> > >         cases it is making it better with integrated techniques.
> > >
> > >         Dino
> > >
> > >
> > >     _______________________________________________
> > >     lisp mailing list
> > >     lisp@ietf.org <mailto:lisp@ietf.org>
> > >     https://www.ietf.org/mailman/listinfo/lisp
> > >
> > >
> > >
> > > _______________________________________________
> > > lisp mailing list
> > > lisp@ietf.org
> > > https://www.ietf.org/mailman/listinfo/lisp
> > >
>=20
> _______________________________________________
> lisp mailing list
> lisp@ietf.org
> https://www.ietf.org/mailman/listinfo/lisp


From nobody Tue May 27 15:55:07 2014
Return-Path: <rbonica@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2A191A02B0 for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 15:55:01 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.602
X-Spam-Level: 
X-Spam-Status: No, score=-102.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V_JEKy51mqeA for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 15:54:58 -0700 (PDT)
Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2lp0242.outbound.protection.outlook.com [207.46.163.242]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 685791A029F for <lisp@ietf.org>; Tue, 27 May 2014 15:54:58 -0700 (PDT)
Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB444.namprd05.prod.outlook.com (10.141.73.140) with Microsoft SMTP Server (TLS) id 15.0.949.11; Tue, 27 May 2014 22:54:47 +0000
Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) with mapi id 15.00.0949.001; Tue, 27 May 2014 22:54:47 +0000
From: Ronald Bonica <rbonica@juniper.net>
To: Marc Binderberger <marc@sniff.de>, "Joel M. Halpern" <jmh@joelhalpern.com>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEIABfmkAgAefyVCAAITngIABbBJggAETbwCABC0O0IAAtqUAgAABTnCAADykgIAAAb6AgADP7YCAAPi2YA==
Date: Tue, 27 May 2014 22:54:46 +0000
Message-ID: <ffdb31ed7ff74fd4b4a27c646b842f39@CO1PR05MB442.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com> <538361DA.10808@joelhalpern.com> <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> <53839747.1080806@joelhalpern.com> <20140527005843634679.23839638@sniff.de>
In-Reply-To: <20140527005843634679.23839638@sniff.de>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.14]
x-forefront-prvs: 02243C58C6
x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(13464003)(479174003)(377454003)(24454002)(51704005)(52604005)(199002)(189002)(2656002)(77982001)(87936001)(74502001)(31966008)(50986999)(92566001)(99286001)(76576001)(76176999)(85852003)(74662001)(83072002)(81342001)(81542001)(54356999)(33646001)(79102001)(66066001)(101416001)(21056001)(86362001)(20776003)(64706001)(76482001)(19580405001)(83322001)(15975445006)(19580395003)(99396002)(74316001)(80022001)(46102001)(4396001)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO1PR05MB444; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; 
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/qETFufVVotml4IKh_puwSGr5XZU
Cc: Roger Jorgensen <rogerj@gmail.com>, LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 27 May 2014 22:55:01 -0000

>=20
> The discussion was IMHO too much focused on gleaning. LISP is made for a
> large number of EID networks. If e.g. someone scans the address ranges of
> an ISP and the PiTR(s) of the ISP have no forwarding entry then they need=
 to
> send a map-request - a task typically done in control plane. Punting pack=
ets
> from data to control plane may saturate the punt channel for a time T, du=
ring
> which a legitimate request may not be processed.
[RPB]=20
Agreed. The attack scenario that I describe in my previous message relies n=
either on gleening nor source address spoofing.

>=20
> To be fair, even for a large number of EID networks (e.g. lots of /29) th=
e
> period T should not be more than several minutes (my guess, assuming 1k
> lookup per second) and it would not affect already established flows, onl=
y
> the establishment of new flows during the time T, assuming the (P)iTR can
> hold all the map-cache entries.
>=20
[RPB]=20
Also agreed. We should say something in a threats document about the relati=
onship between period T and the size of memory available for the map-cache.

>=20
> Regards, Marc
>=20
>=20
>=20
> On Mon, 26 May 2014 15:34:31 -0400, Joel M. Halpern wrote:
> > It sounds like the PxTRs you are using are already implementing
> > sensible mitigations.  But the base document does not actually call thi=
s out.
> >
> > On the base document, the ETR can do gleaning (and by some readings
> > mgiht be being encouraged to do so).  Because of the security threat
> > from gleaning, and because the Etr wants to avoid the delay on
> > returning traffic, nor use a false glean to direct returning traffic,
> > there is text suggesting that the ETR would, immediately upon
> > gleaning, check the information with the mapping system.
> >
> > That would mean that a packet flow to an ETR (which all nodes are, as
> > you say, subject to) could become a significant load on the mapping
> system.
> >
> > Making different choices about when to learn or verify entries changes
> > that dramatically.  But since the document does currently include the
> > problematic behavior as legitimate, we need to document that it can
> > cause problems.
> >
> > I am glad to hear that sensible implementations are already dealing
> > with this well.
> >
> > Yours,
> > Joel
> >
> > On 5/26/14, 3:28 PM, Paul Vinciguerra wrote:
> >> Every host on the Internet is subject to a DoS attack.  An xTR is no
> >> more so.  I am also not clear on how a DoS attack on an xTR would
> >> create any more risk than an attack directly against the mapping
> >> system.
> >>
> >> Joel describes Ronald's scenario of an attack where a large stream of
> >> packets with different inner source addresses to an ETR.  I don't
> >> call this an attack.  I call this our steady-state.  These would be
> >> the PxTR's we operate across the US.  The PxTR's on the beta-network
> >> are no different.  We take in packets from anywhere.  This is a
> >> "Free" attacker if you will.  All that really means is that you do
> >> not have to incur the computational cost of encapsulating the packet.
> >>
> >> I would defer to Dino and others on the list, but I do not believe
> >> that the ETR does a reverse lookup on every packet.  At least that is
> >> not the behavior we observe.  What we see happen is that the packet
> >> is decapsulated and sent to the destination.  If a valid destination
> >> host responds, then the ITR does a map-request for the reply packet.
> >> There is not a 1:1 relationship between the number of packets and the
> >> number of map-requests.
> >>
> >> Map-replies for IP addresses return prefixes. These prefixes can
> >> cover larger address spaces than the map-request and limit the number
> >> of future map-requests needed.
> >>
> >> Can you provide more specific details on how you see the xTR
> >> rendering the mapping system unusable?
> >>
> >> For what its worth, I still support the decision for last call and
> >> not to place mitigations within the document.  Without knowing the
> >> specifics of a configuration and implementation, that just leads to a
> >> false sense of security.
> >>
> >>
> >> ________________________________________ From: lisp
> >> [lisp-bounces@ietf.org] on behalf of Ronald Bonica
> >> [rbonica@juniper.net] Sent: Monday, May 26, 2014 11:57 AM To: Joel M.
> >> Halpern; Damien Saucez Cc: Roger Jorgensen; LISP mailing list list
> >> Subject: Re: [lisp] Restarting last call on LISP threats
> >>
> >> Inline.....
> >>
> >>> -----Original Message----- From: Joel M. Halpern
> >>> [mailto:jmh@joelhalpern.com] Sent: Monday, May 26, 2014 11:47 AM
> >>> To: Ronald Bonica; Damien Saucez Cc: Roger Jorgensen; LISP mailing
> >>> list list Subject: Re: [lisp] Restarting last call on LISP threats
> >>>
> >>> Top posting to make sure I am understanding:
> >>>
> >>> You asssert that any xTR is subject to a DoS attack.  And that such
> >>> a DoS attack can render the mapping system unusable.
> >> [RPB] Exactly!
> >>
> >>>
> >>> It targeting an ITR, this would need to be from within ths cope the
> >>> ITR serves.
> >> [RPB] I don't understand this sentence. Please try again.
> >>
> >>> I believe that is discussed.
> >> [RPB] Given that I don't understand the sentence above, I have no
> >> idea if this sentence is true.
> >>
> >>>
> >>> If I have connected the dots correctly, the attack you are
> >>> contemplating is sending a large stream of packets with different
> >>> inner source addresses to an ETR.  This would prompt the ETR to
> >>> check with the mapping system about each and every address.
> >> [RPB] Exactly!
> >>
> >>>
> >>> If I have understood this properly, while there are several very
> >>> effective mitigations, that does not change the basic message that
> >>> this is an attack, and as such ought to be described in the threats
> >>> document.
> >> [RPB] Even if there are effective mitigations, the attack should be
> >> described.
> >>
> >> However, I am not convinced that an effective mitigation exists.
> >>
> >>> There are clealry a number of variations on this attack.
> >> [RPB] True!
> >>
> >> For example, using
> >>> the same outer source address makes mitigation easier, while using
> >>> different outer source addresses either requires a bot-net or a
> >>> large unchecked BCP38 hole (and those can be used for MANY attacks
> >>> on many systems.)  Both presumably should be described.
> >> [RPB] Yes, both should be described.
> >>
> >> Also, recall that large BCP38 holes exist in today's internet.
> >>
> >>>
> >>> Have I captured your request accurately?
> >> [RPB] Pretty much.
> >>
> >> Thanks for taking the effort.
> >>
> >> Ron
> >>
> >>>
> >>> Yours, Joel
> >>>
> >>> On 5/26/14, 1:06 AM, Ronald Bonica wrote:
> >>>> *From:*Damien Saucez [mailto:damien.saucez@gmail.com] *Sent:*
> >>>> Friday, May 23, 2014 9:07 AM *To:* Ronald Bonica *Cc:* Dino
> >>>> Farinacci; Roger Jorgensen; LISP mailing list list *Subject:* Re:
> >>>> [lisp] Restarting last call on LISP threats
> >>>>
> >>>> Hello Ronald,
> >>>>
> >>>> On 22 May 2014, at 22:57, Ronald Bonica <rbonica@juniper.net
> >>>> <mailto:rbonica@juniper.net>> wrote:
> >>>>
> >>>>
> >>>>
> >>>> Dino,
> >>>>
> >>>> Today's Internet is not as fragile as you think. This mail
> >>>> traversed many routers between my house and yours. If those routers
> >>>> are well-managed, there is nothing that I can do from my house that
> >>>> will cause any of those routers to consume control plane resources.
> >>>> Therefore, there is nothing that I can do from my house that will
> >>>> cause a DoS attack against those routers'
> >>>> control planes.
> >>>>
> >>>> We tend to disagree with that, for example you have ICMP today...
> >>>>
> >>>> */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn't
> >>>> make a very good routing protocol. That's why we don't use it for
> >>>> routing. By contrast, LISP map-request messages are susceptible to
> >>>> DoS attacks and they do carry routing information./*
> >>>>
> >>>>
> >>>>
> >>>> In LISP, separation between the forwarding and control plane is
> >>>> lost. As a matter of course, forwarding plane activity causes
> >>>> control plane activity. Since forwarding plane bandwidth exceeds
> >>>> control plane bandwidth, DoS attacks against the control plane are
> >>>> possible.
> >>>>
> >>>> In order to be complete, the threats document must describe the DoS
> >>>> threat. It should also describe mitigations, if any exist.
> >>>>
> >>>> DoS is already explained and the definition given:
> >>>>
> >>>> " A Denial of Service (DoS) attack aims at disrupting a specific
> >>>>
> >>>> targeted service either by exhausting the resources of the victim
> >>>> up
> >>>>
> >>>> to the point that it is not able to provide a reliable service to
> >>>>
> >>>> legit traffic and/or systems or by exploiting vulnerabilities to
> >>>> make
> >>>>
> >>>> the targeted service unable to operate properly.
> >>>>
> >>>> "
> >>>>
> >>>> is covering the case you mention.
> >>>>
> >>>> */[RPB] /*
> >>>>
> >>>> */You might want to add the following details to section 5.2:/*
> >>>>
> >>>> *//*
> >>>>
> >>>> -A DoS attack can be launched by anybody who can send a packet to
> >>>> the XTR's LOC
> >>>>
> >>>> -DoS attacks can render an XTR inoperable
> >>>>
> >>>> -DDoS attacks can render the mapping system inoperable.
> >>>>
> >>>> This is what differentiates LISP from today's routing system.
> >>>>
> >>>> Ron
> >>>>
> >>>> Damien Saucez
> >>>>
> >>>>
> >>>>
> >>>>
> >>>> Ron
> >>>>
> >>>>
> >>>>
> >>>> -----Original Message----- From: Dino Farinacci
> >>>> [mailto:farinacci@gmail.com] Sent: Wednesday, May 21, 2014 6:58 PM
> >>>> To: Ronald Bonica Cc: Roger Jorgensen; lisp@ietf.org
> >>>> <mailto:lisp@ietf.org> Subject: Re: [lisp] Restarting last call on
> >>>> LISP threats
> >>>>
> >>>>
> >>>> The attacker sends a flow of crafted packets to the victim XTR.
> >>>> Each packet
> >>>>
> >>>> is a well-formed LISP data packet. It contains:
> >>>>
> >>>>
> >>>> - an outer IP header (LOC->LOC) - a UDP header - a LISP Header - an
> >>>> IP header (EID->EID) - payload
> >>>>
> >>>>
> >>>> Just like a regular packet I can send to your home router today.
> >>>> So yes okay. So let's continue. See comments below.
> >>>>
> >>>>
> >>>> Each packet contains control plane information that is new to the
> >>>> victim
> >>>>
> >>>>
> >>>> Be more specific about what control information are in these
> >>>> encapsulated packets.
> >>>>
> >>>>
> >>>> XTR. For example, the victim XTR has no mapping information
> >>>> regarding
> >>>>
> >>>> either the source LOC or source EID prefix. Rather than gleaning
> >>>> this mapping information from the crafted packet, the victim XTR
> >>>> sends a verifying MAP- REQUEST to the mapping system.
> >>>>
> >>>>
> >>>> Assume that the attack flow is large (N packets per second).
> >>>> Assume also
> >>>>
> >>>> that the XTRs rate limit for MAP-REQUEST messages is less than N
> >>>> packets per second. Has the attack not effectively DoS'd the victim
> >>>> XTR?
> >>>>
> >>>> It caches the rate the rate the packets are coming in and
> >>>> eventually stops sending Map-Requests completely.
> >>>>
> >>>> It cannot stop the incoming rate of packets today just like a roque
> >>>> BGP attacker can send millions of packets per second to a peer
> >>>> regardless if it does or does not have the peer authentication key.
> >>>>
> >>>>
> >>>> To make this attack work, every packet in the attack flow may need
> >>>> to have
> >>>>
> >>>> a unique, spoofed, source LOC.
> >>>>
> >>>> An implementation can detect that after rate limiting 1000s of such
> >>>> requests are happening that it just stops operation.
> >>>>
> >>>> What if I sent a Juniper 20 million routes today?
> >>>>
> >>>> The Internet is very fragile and LISP IS NOT making it worse. And
> >>>> in some cases it is making it better with integrated techniques.
> >>>>
> >>>> Dino
> >>>>
> >>>>
> >>>> _______________________________________________ lisp
> mailing list
> >>>> lisp@ietf.org <mailto:lisp@ietf.org>
> >>>> https://www.ietf.org/mailman/listinfo/lisp
> >>>>
> >>>>
> >>>>
> >>>> _______________________________________________ lisp
> mailing list
> >>>> lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp
> >>>>
> >>
> >> _______________________________________________ lisp mailing
> list
> >> lisp@ietf.org https://www.ietf.org/mailman/listinfo/lisp
> >>
> >
> > _______________________________________________
> > lisp mailing list
> > lisp@ietf.org
> > https://www.ietf.org/mailman/listinfo/lisp
> >


From nobody Tue May 27 16:18:47 2014
Return-Path: <farinacci@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 625F11A0704 for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 16:18:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level: 
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9,  DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id avXE7eVi0xBO for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 16:18:45 -0700 (PDT)
Received: from mail-ig0-x234.google.com (mail-ig0-x234.google.com [IPv6:2607:f8b0:4001:c05::234]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 10AD61A02AF for <lisp@ietf.org>; Tue, 27 May 2014 16:18:45 -0700 (PDT)
Received: by mail-ig0-f180.google.com with SMTP id c1so1778394igq.7 for <lisp@ietf.org>; Tue, 27 May 2014 16:18:41 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=XAfNGbR6ARhrSm1cxmkhvlx10ikaL3yIAQL9GJPacxE=; b=1Gcm2RWJ8bZgW1xbw9EUmTbNgbBtcqNmypDp4JLtOliHKaTxng+Qkv9KzgPzvkrsoA Y/wzUJ5GzG2iBF9FQlNo2n1c9lr3qZKx5crNDtaP98yGPnjpGz+IH4xwptz4XZlIcB1D rC67ulqSsDW7dz5fiL6yqPafwCKIDPKblvei5bett4f5EZg1uPnArxV0zdFMRRewgYpY acdDZ8ctorpwPhV+FDZxS5omzP2UwRKdKoqiD9/zrTGpNDTgKfHH+AhlGjdvSd7Krle1 3SejoW02ASBi5I8QBVvwvwN3GRDayChg3oRpEbUIIPFCema+xx9w97lwrKNFbPymj75q WCzQ==
X-Received: by 10.50.30.6 with SMTP id o6mr38030123igh.43.1401232721552; Tue, 27 May 2014 16:18:41 -0700 (PDT)
Received: from [192.168.1.10] ([50.141.65.3]) by mx.google.com with ESMTPSA id ng17sm8347989igb.13.2014.05.27.16.18.40 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 27 May 2014 16:18:40 -0700 (PDT)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\))
From: Dino Farinacci <farinacci@gmail.com>
In-Reply-To: <936e209eb2fb49288f3a776aaa4b71cb@CO1PR05MB442.namprd05.prod.outlook.com>
Date: Tue, 27 May 2014 16:18:37 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <7E76C55E-CCD0-4A52-A481-5BA9BF6A6689@gmail.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com> <538361DA.10808@joelhalpern.com>, <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> <936e209eb2fb49288f3a776aaa4b71cb@CO1PR05MB442.namprd05.prod.outlook.com>
To: Ronald Bonica <rbonica@juniper.net>
X-Mailer: Apple Mail (2.1874)
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/Xu4IzvqnIn4tc8zt3JMnn4bix5U
Cc: Roger Jorgensen <rogerj@gmail.com>, LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 27 May 2014 23:18:46 -0000

> Hi Paul,
>=20
> The attack scenario that I envision is slightly different from the on =
that you describe below:
>=20
> - LISP is widely deployed. Tens of thousands of XTRs are deployed =
world-wide. The mapping system data base contains hundreds of thousands =
of EID prefixes.
> - The attack stream is large
> - Each packet in the attack stream has a unique source LOC
> - All packets in the attack stream have the same destination LOC. This =
LOC represents the XTR under attack.
> - Each packet in the attack stream has a destination EID that will =
cause it to reach a valid destination (i.e., a destination that will =
respond). However, all packets in the attack stream don't have the same =
destination. The attack stream is spread out across multiple valid EID =
destinations to make it less detectable.
> - Each packet in the attack stream has a carefully chosen source EID. =
It is chosen to maximize the ratio of attack packets to map-requests.
>=20
> One attack stream attacks an XTR. Multiple simultaneous attacks =
against multiple XTRs can DoS the mapping system, itself.
>=20
> A PxTR probably won't generate this attack stream. However, an attack =
tool might.

Ignoring the unique source RLOC (which makes no difference in this =
attack because we are not doing a RPF check on the ETR), it is the same =
as if a PITR was encapsulating from the same set of source-EIDs to the =
same set of destination-EIDs you describe above.

That was his point.

So some clarifications:

(1) What does unique source LOC mean? I assume you mean each packet as a =
different source RLOC and that the address is not duplicated from =
multiple sites (i.e. is it not a private address like 192.168.1.1), or =
do you meawn something else?

(2) And what is carefully chosen mean? You might mean a scan of =
differnet source EIDs in each packet so the xTR that returns packets =
will get more map-cache misses?=20

Dino


From nobody Tue May 27 17:18:39 2014
Return-Path: <rbonica@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6075E1A07DD for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 17:18:38 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -99.602
X-Spam-Level: 
X-Spam-Status: No, score=-99.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MANGLED_WRLDWD=2.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VgsSRbYdhVoh for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 17:18:36 -0700 (PDT)
Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0142.outbound.protection.outlook.com [207.46.163.142]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 415471A02E4 for <lisp@ietf.org>; Tue, 27 May 2014 17:18:36 -0700 (PDT)
Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB443.namprd05.prod.outlook.com (10.141.73.152) with Microsoft SMTP Server (TLS) id 15.0.949.11; Wed, 28 May 2014 00:18:29 +0000
Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.68]) with mapi id 15.00.0949.001; Wed, 28 May 2014 00:18:29 +0000
From: Ronald Bonica <rbonica@juniper.net>
To: Dino Farinacci <farinacci@gmail.com>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58LSm48HWl6Wky1MR3KNHiENZs9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAlhbEIABfmkAgAefyVCAAITngIABbBJggAETbwCABC0O0IAAtqUAgAABTnCAADykgIABvzTggAATfICAAA/EoA==
Date: Wed, 28 May 2014 00:18:29 +0000
Message-ID: <9091dab3083e460abb2080f1e9315aba@CO1PR05MB442.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com> <538361DA.10808@joelhalpern.com>, <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> <936e209eb2fb49288f3a776aaa4b71cb@CO1PR05MB442.namprd05.prod.outlook.com> <7E76C55E-CCD0-4A52-A481-5BA9BF6A6689@gmail.com>
In-Reply-To: <7E76C55E-CCD0-4A52-A481-5BA9BF6A6689@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.14]
x-forefront-prvs: 0225B0D5BC
x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(377454003)(13464003)(51704005)(199002)(189002)(1411001)(21056001)(76482001)(81342001)(74502001)(74662001)(81542001)(74316001)(76576001)(79102001)(2656002)(76176999)(86362001)(87936001)(101416001)(31966008)(33646001)(83072002)(4396001)(99396002)(77982001)(19580405001)(19580395003)(83322001)(99286001)(46102001)(92566001)(50986999)(80022001)(64706001)(20776003)(54356999)(66066001)(85852003)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO1PR05MB443; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rbonica@juniper.net; 
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/VPuIynrHIRoLHv0yEqSCPnPr0EE
Cc: Roger Jorgensen <rogerj@gmail.com>, LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 28 May 2014 00:18:38 -0000

Inline....

> -----Original Message-----
> From: Dino Farinacci [mailto:farinacci@gmail.com]
> Sent: Tuesday, May 27, 2014 7:19 PM
> To: Ronald Bonica
> Cc: Paul Vinciguerra; Joel M. Halpern; Damien Saucez; Roger Jorgensen; LI=
SP
> mailing list list
> Subject: Re: [lisp] Restarting last call on LISP threats
>=20
>=20
> > Hi Paul,
> >
> > The attack scenario that I envision is slightly different from the on t=
hat you
> describe below:
> >
> > - LISP is widely deployed. Tens of thousands of XTRs are deployed world=
-
> wide. The mapping system data base contains hundreds of thousands of EID
> prefixes.
> > - The attack stream is large
> > - Each packet in the attack stream has a unique source LOC
> > - All packets in the attack stream have the same destination LOC. This =
LOC
> represents the XTR under attack.
> > - Each packet in the attack stream has a destination EID that will caus=
e it to
> reach a valid destination (i.e., a destination that will respond). Howeve=
r, all
> packets in the attack stream don't have the same destination. The attack
> stream is spread out across multiple valid EID destinations to make it le=
ss
> detectable.
> > - Each packet in the attack stream has a carefully chosen source EID. I=
t is
> chosen to maximize the ratio of attack packets to map-requests.
> >
> > One attack stream attacks an XTR. Multiple simultaneous attacks against
> multiple XTRs can DoS the mapping system, itself.
> >
> > A PxTR probably won't generate this attack stream. However, an attack t=
ool
> might.
>=20
> Ignoring the unique source RLOC (which makes no difference in this attack
> because we are not doing a RPF check on the ETR), it is the same as if a =
PITR
> was encapsulating from the same set of source-EIDs to the same set of
> destination-EIDs you describe above.
>=20
> That was his point.
>=20
> So some clarifications:
>=20
> (1) What does unique source LOC mean? I assume you mean each packet as
> a different source RLOC and that the address is not duplicated from multi=
ple
> sites (i.e. is it not a private address like 192.168.1.1), or do you meaw=
n
> something else?
[RPB]=20
No two packets in the attack stream have the same Source RLOC.

>=20
> (2) And what is carefully chosen mean? You might mean a scan of differnet
> source EIDs in each packet so the xTR that returns packets will get more =
map-
> cache misses?
[RPB]=20
Exactly. Source EIDs are chosen to maximize the ratio of attack packets to =
map-requests sent by the victim XTR.

This is what make the attack stream so different from a stream that a PiTR =
is likely to send during normal operation.

                                                                           =
                      Ron

>=20
> Dino


From nobody Tue May 27 18:12:39 2014
Return-Path: <farinacci@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5D7C1A0850 for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 18:12:33 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level: 
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9,  DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WNNMCqDfzyVu for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 18:12:29 -0700 (PDT)
Received: from mail-pb0-x236.google.com (mail-pb0-x236.google.com [IPv6:2607:f8b0:400e:c01::236]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 197AE1A084A for <lisp@ietf.org>; Tue, 27 May 2014 18:12:29 -0700 (PDT)
Received: by mail-pb0-f54.google.com with SMTP id jt11so10261096pbb.27 for <lisp@ietf.org>; Tue, 27 May 2014 18:12:25 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=QjijGiaREw2bfLEvWiFtGT/8G/kpDI/UyiS+ZizI5Tw=; b=eOLVeL624rc7l93WSEy22n7ygEDeiFkRm0Jkq78p8yWe8DEuZ38pPMDaeS7JBb9Pbw x6WeKHA0ZDVjfxc9lZ83z+xiBV+OaY7kUgp6dfHnsmXYXLo7ZHwQdFwE4H9XIhad1xHH AH9E4oZ3xV0SvgRpIJ6bvsVeHZqbxpw7gPAvM/wkYVLJtXuwJyXO0//by71CEdY7G/JU vXGrFiCOifQu86WU9JBn0Dh8ArwIkmdkKi7lcmlI2ZoHxcA0qGywJ7h/Ym7o8uI0ce2b Hg5sNs3XS6rka62Cw21NMCjBHPgonD+ywrh00LHWyIpg8tJzafq1JStC4qqM+DKy7nJq Fxug==
X-Received: by 10.68.134.169 with SMTP id pl9mr40951924pbb.133.1401239545795;  Tue, 27 May 2014 18:12:25 -0700 (PDT)
Received: from [192.168.1.7] (173-8-188-29-SFBA.hfc.comcastbusiness.net. [173.8.188.29]) by mx.google.com with ESMTPSA id z3sm80596717pas.15.2014.05.27.18.12.24 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 27 May 2014 18:12:24 -0700 (PDT)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (1.0)
From: Dino Farinacci <farinacci@gmail.com>
X-Mailer: iPad Mail (11D201)
In-Reply-To: <9091dab3083e460abb2080f1e9315aba@CO1PR05MB442.namprd05.prod.outlook.com>
Date: Tue, 27 May 2014 18:12:24 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <4B057F83-72DF-44B8-A6D5-2DF6829C8948@gmail.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com> <538361DA.10808@joelhalpern.com> <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> <936e209eb2fb49288f3a776aaa4b71cb@CO1PR05MB442.namprd05.prod.outlook.com> <7E76C55E-CCD0-4A52-A481-5BA9BF6A6689@gmail.com> <9091dab3083e460abb2080f1e9315aba@CO1PR05MB442.namprd05.prod.outlook.com>
To: Ronald Bonica <rbonica@juniper.net>
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/bse790RnRgVV-7ZRt655ZYY_l7w
Cc: Roger Jorgensen <rogerj@gmail.com>, LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 28 May 2014 01:12:33 -0000

> On May 27, 2014, at 5:18 PM, Ronald Bonica <rbonica@juniper.net> wrote:
>=20
> RPB]=20
> Exactly. Source EIDs are chosen to maximize the ratio of attack packets to=
 map-requests sent by the victim XTR.
>=20
> This is what make the attack stream so different from a stream that a PiTR=
 is likely to send during normal operation.

It is not different for that reason. It is different because packets encapsu=
lated by PITRs originate from non-LISP sources. Thereby the ITR at the LISP s=
ite will natively-forward to those random places. And those native-forward m=
ap-cache entries are very coarse since the mapping system returns the least s=
pecific prefix that covers all non-LISP sites.=20

I believe Paul is still right IMO.=20

Dino=


From nobody Tue May 27 22:50:51 2014
Return-Path: <fcoras@ac.upc.edu>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A073A1A0358 for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 22:50:48 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.553
X-Spam-Level: 
X-Spam-Status: No, score=-2.553 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.651, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CatqCIwM1our for <lisp@ietfa.amsl.com>; Tue, 27 May 2014 22:50:44 -0700 (PDT)
Received: from roura.ac.upc.es (roura.ac.upc.edu [147.83.33.10]) by ietfa.amsl.com (Postfix) with ESMTP id C986F1A033E for <lisp@ietf.org>; Tue, 27 May 2014 22:50:43 -0700 (PDT)
Received: from gw-3.ac.upc.es (gw-3.ac.upc.es [147.83.30.9]) by roura.ac.upc.es (8.13.8/8.13.8) with ESMTP id s4S5jcYj025307; Wed, 28 May 2014 07:45:38 +0200
Received: from [192.168.1.16] (unknown [90.163.230.43]) by gw-3.ac.upc.es (Postfix) with ESMTPSA id C3D4944F; Wed, 28 May 2014 07:50:38 +0200 (CEST)
Message-ID: <5385792B.1010103@ac.upc.edu>
Date: Wed, 28 May 2014 07:50:35 +0200
From: Florin Coras <fcoras@ac.upc.edu>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.5.0
MIME-Version: 1.0
To: lisp@ietf.org
References: <536CFA13.4010102@joelhalpern.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com> <538361DA.10808@joelhalpern.com>, <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> <936e209eb2fb49288f3a776aaa4b71cb@CO1PR05MB442.namprd05.prod.outlook.com>
In-Reply-To: <936e209eb2fb49288f3a776aaa4b71cb@CO1PR05MB442.namprd05.prod.outlook.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/vFAfoMI-FYFZ-rxjV0NZX-8Mm_I
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 28 May 2014 05:50:48 -0000

Hi Ron,

It turns out that just doing a flat scan of the EID-prefix space, i.e., 
using as source EID an IP in each existing EID-prefix, has the most 
damaging consequences (see fig. 5 in [1]). This, if you contrast it with 
the case when you try to craft packets whose replies (coming from 
intra-domain sources) will always generate misses in the xTR under attack.

If the attack intensity (attack packet rate to legitimate traffic rate 
ratio) is high, say above 0.01, you are right to assume that such an 
attack could cripple an xTR and generate lots of misses. However, as we 
mention in the paper, some simple solutions could be set in place to 
avoid this. For instance:

1) When the attack is detected (due to the higher than normal miss 
rate), the most important entries in the cache, the most popular (say, 
Google, Fb, Amazon ..) can be protected from eviction. Thereby, on the 
one hand, set up flows won't have their entries evicted and on the 
other, this set of entries will ensure that a very large part of the new 
outgoing flows will cache hit.

2) Just add more memory! Besides the TCAM in the xTR we could use a 
large second level memory able to cache the whole EID address space.  
Alternatively, you could imagine having an xTR per site, capable of 
holding the whole EID address space, that could act as default for 
packets that miss in all the other sub-provisioned xTRs.

[1] http://arxiv.org/pdf/1312.1378v2.pdf

Florin


On 05/28/2014 12:45 AM, Ronald Bonica wrote:
> Hi Paul,
>
> The attack scenario that I envision is slightly different from the on that you describe below:
>
> - LISP is widely deployed. Tens of thousands of XTRs are deployed world-wide. The mapping system data base contains hundreds of thousands of EID prefixes.
> - The attack stream is large
> - Each packet in the attack stream has a unique source LOC
> - All packets in the attack stream have the same destination LOC. This LOC represents the XTR under attack.
> - Each packet in the attack stream has a destination EID that will cause it to reach a valid destination (i.e., a destination that will respond). However, all packets in the attack stream don't have the same destination. The attack stream is spread out across multiple valid EID destinations to make it less detectable.
> - Each packet in the attack stream has a carefully chosen source EID. It is chosen to maximize the ratio of attack packets to map-requests.
>
> One attack stream attacks an XTR. Multiple simultaneous attacks against multiple XTRs can DoS the mapping system, itself.
>
> A PxTR probably won't generate this attack stream. However, an attack tool might.
>
> Hope this helps.
>
>                                                              Ron
>
>> -----Original Message-----
>> From: Paul Vinciguerra [mailto:pvinci@VinciConsulting.com]
>> Sent: Monday, May 26, 2014 3:28 PM
>> To: Ronald Bonica; Joel M. Halpern; Damien Saucez
>> Cc: Roger Jorgensen; LISP mailing list list
>> Subject: RE: [lisp] Restarting last call on LISP threats
>>
>> Every host on the Internet is subject to a DoS attack.  An xTR is no more so.  I
>> am also not clear on how a DoS attack on an xTR would create any more risk
>> than an attack directly against the mapping system.
>>
>> Joel describes Ronald's scenario of an attack where a large stream of packets
>> with different inner source addresses to an ETR.  I don't call this an attack.  I
>> call this our steady-state.  These would be the PxTR's we operate across the
>> US.  The PxTR's on the beta-network are no different.  We take in packets
>> from anywhere.  This is a "Free" attacker if you will.  All that really means is
>> that you do not have to incur the computational cost of encapsulating the
>> packet.
>>
>> I would defer to Dino and others on the list, but I do not believe that the ETR
>> does a reverse lookup on every packet.  At least that is not the behavior we
>> observe.  What we see happen is that the packet is decapsulated and sent to
>> the destination.  If a valid destination host responds, then the ITR does a
>> map-request for the reply packet.  There is not a 1:1 relationship between
>> the number of packets and the number of map-requests.
>>
>> Map-replies for IP addresses return prefixes. These prefixes can cover larger
>> address spaces than the map-request and limit the number of future map-
>> requests needed.
>>
>> Can you provide more specific details on how you see the xTR rendering the
>> mapping system unusable?
>>
>> For what its worth, I still support the decision for last call and not to place
>> mitigations within the document.  Without knowing the specifics of a
>> configuration and implementation, that just leads to a false sense of security.
>>
>>
>> ________________________________________
>> From: lisp [lisp-bounces@ietf.org] on behalf of Ronald Bonica
>> [rbonica@juniper.net]
>> Sent: Monday, May 26, 2014 11:57 AM
>> To: Joel M. Halpern; Damien Saucez
>> Cc: Roger Jorgensen; LISP mailing list list
>> Subject: Re: [lisp] Restarting last call on LISP threats
>>
>> Inline.....
>>
>>> -----Original Message-----
>>> From: Joel M. Halpern [mailto:jmh@joelhalpern.com]
>>> Sent: Monday, May 26, 2014 11:47 AM
>>> To: Ronald Bonica; Damien Saucez
>>> Cc: Roger Jorgensen; LISP mailing list list
>>> Subject: Re: [lisp] Restarting last call on LISP threats
>>>
>>> Top posting to make sure I am understanding:
>>>
>>> You asssert that any xTR is subject to a DoS attack.  And that such a
>>> DoS attack can render the mapping system unusable.
>> [RPB]
>> Exactly!
>>
>>> It targeting an ITR, this would need to be from within ths cope the ITR
>> serves.
>> [RPB]
>> I don't understand this sentence. Please try again.
>>
>>> I believe that is discussed.
>> [RPB]
>> Given that I don't understand the sentence above, I have no idea if this
>> sentence is true.
>>
>>> If I have connected the dots correctly, the attack you are
>>> contemplating is sending a large stream of packets with different
>>> inner source addresses to an ETR.  This would prompt the ETR to check
>>> with the mapping system about each and every address.
>> [RPB]
>> Exactly!
>>
>>> If I have understood this properly, while there are several very
>>> effective mitigations, that does not change the basic message that
>>> this is an attack, and as such ought to be described in the threats
>> document.
>> [RPB]
>> Even if there are effective mitigations, the attack should be described.
>>
>> However, I am not convinced that an effective mitigation exists.
>>
>>>    There are clealry a number of variations on this attack.
>> [RPB]
>> True!
>>
>>    For example, using
>>> the same outer source address makes mitigation easier, while using
>>> different outer source addresses either requires a bot-net or a large
>>> unchecked BCP38 hole (and those can be used for MANY attacks on many
>>> systems.)  Both presumably should be described.
>> [RPB]
>> Yes, both should be described.
>>
>> Also, recall that large BCP38 holes exist in today's internet.
>>
>>> Have I captured your request accurately?
>> [RPB]
>> Pretty much.
>>
>> Thanks for taking the effort.
>>
>>                      Ron
>>
>>> Yours,
>>> Joel
>>>
>>> On 5/26/14, 1:06 AM, Ronald Bonica wrote:
>>>> *From:*Damien Saucez [mailto:damien.saucez@gmail.com]
>>>> *Sent:* Friday, May 23, 2014 9:07 AM
>>>> *To:* Ronald Bonica
>>>> *Cc:* Dino Farinacci; Roger Jorgensen; LISP mailing list list
>>>> *Subject:* Re: [lisp] Restarting last call on LISP threats
>>>>
>>>> Hello Ronald,
>>>>
>>>> On 22 May 2014, at 22:57, Ronald Bonica <rbonica@juniper.net
>>>> <mailto:rbonica@juniper.net>> wrote:
>>>>
>>>>
>>>>
>>>>      Dino,
>>>>
>>>>      Today's Internet is not as fragile as you think. This mail traversed
>>>>      many routers between my house and yours. If those routers are
>>>>      well-managed, there is nothing that I can do from my house that will
>>>>      cause any of those routers to consume control plane resources.
>>>>      Therefore, there is nothing that I can do from my house that will
>>>>      cause a DoS attack against those routers' control planes.
>>>>
>>>> We tend to disagree with that, for example you have ICMP today...
>>>>
>>>> */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn't make
>>>> a very good routing protocol. That's why we don't use it for
>>>> routing. By contrast, LISP map-request messages are susceptible to
>>>> DoS attacks and they do carry routing information./*
>>>>
>>>>
>>>>
>>>>      In LISP, separation between the forwarding and control plane is
>>>>      lost. As a matter of course, forwarding plane activity causes
>>>>      control plane activity. Since forwarding plane bandwidth exceeds
>>>>      control plane bandwidth, DoS attacks against the control plane are
>>>>      possible.
>>>>
>>>>      In order to be complete, the threats document must describe the DoS
>>>>      threat. It should also describe mitigations, if any exist.
>>>>
>>>> DoS is already explained and the definition given:
>>>>
>>>> " A Denial of Service (DoS) attack aims at disrupting a specific
>>>>
>>>>      targeted service either by exhausting the resources of the
>>>> victim up
>>>>
>>>>      to the point that it is not able to provide a reliable service
>>>> to
>>>>
>>>>      legit traffic and/or systems or by exploiting vulnerabilities to
>>>> make
>>>>
>>>>      the targeted service unable to operate properly.
>>>>
>>>> "
>>>>
>>>> is covering the case you mention.
>>>>
>>>> */[RPB] /*
>>>>
>>>> */You might want to add the following details to section 5.2:/*
>>>>
>>>> *//*
>>>>
>>>> -A DoS attack can be launched by anybody who can send a packet to
>>>> the XTR's LOC
>>>>
>>>> -DoS attacks can render an XTR inoperable
>>>>
>>>> -DDoS attacks can render the mapping system inoperable.
>>>>
>>>> This is what differentiates LISP from today's routing system.
>>>>
>>>>                                         Ron
>>>>
>>>> Damien Saucez
>>>>
>>>>
>>>>
>>>>
>>>> Ron
>>>>
>>>>
>>>>
>>>>          -----Original Message-----
>>>>          From: Dino Farinacci [mailto:farinacci@gmail.com]
>>>>          Sent: Wednesday, May 21, 2014 6:58 PM
>>>>          To: Ronald Bonica
>>>>          Cc: Roger Jorgensen; lisp@ietf.org <mailto:lisp@ietf.org>
>>>>          Subject: Re: [lisp] Restarting last call on LISP threats
>>>>
>>>>
>>>>              The attacker sends a flow of crafted packets to the victim
>>>>              XTR. Each packet
>>>>
>>>>          is a well-formed LISP data packet. It contains:
>>>>
>>>>
>>>>              - an outer IP header (LOC->LOC)
>>>>              - a UDP header
>>>>              - a LISP Header
>>>>              - an IP header (EID->EID)
>>>>              - payload
>>>>
>>>>
>>>>          Just like a regular packet I can send to your home router today.
>>>>          So yes okay.
>>>>          So let's continue. See comments below.
>>>>
>>>>
>>>>              Each packet contains control plane information that is new
>>>>              to the victim
>>>>
>>>>
>>>>          Be more specific about what control information are in these
>>>>          encapsulated
>>>>          packets.
>>>>
>>>>
>>>>              XTR. For example, the victim XTR has no mapping information
>>>>              regarding
>>>>
>>>>          either the source LOC or source EID prefix. Rather than gleaning
>>>>          this mapping
>>>>          information from the crafted packet, the victim XTR sends a
>>>>          verifying MAP-
>>>>          REQUEST to the mapping system.
>>>>
>>>>
>>>>              Assume that the attack flow is large (N packets per second).
>>>>              Assume also
>>>>
>>>>          that the XTRs rate limit for MAP-REQUEST messages is less than N
>>>>          packets
>>>>          per second. Has the attack not effectively DoS'd the victim XTR?
>>>>
>>>>          It caches the rate the rate the packets are coming in and
>>>>          eventually stops
>>>>          sending Map-Requests completely.
>>>>
>>>>          It cannot stop the incoming rate of packets today just like a
>>>>          roque BGP
>>>>          attacker can send millions of packets per second to a peer
>>>>          regardless if it
>>>>          does or does not have the peer authentication key.
>>>>
>>>>
>>>>              To make this attack work, every packet in the attack flow
>>>>              may need to have
>>>>
>>>>          a unique, spoofed, source LOC.
>>>>
>>>>          An implementation can detect that after rate limiting 1000s of
>>>>          such requests
>>>>          are happening that it just stops operation.
>>>>
>>>>          What if I sent a Juniper 20 million routes today?
>>>>
>>>>          The Internet is very fragile and LISP IS NOT making it worse.
>>>>          And in some
>>>>          cases it is making it better with integrated techniques.
>>>>
>>>>          Dino
>>>>
>>>>
>>>>      _______________________________________________
>>>>      lisp mailing list
>>>>      lisp@ietf.org <mailto:lisp@ietf.org>
>>>>      https://www.ietf.org/mailman/listinfo/lisp
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> lisp mailing list
>>>> lisp@ietf.org
>>>> https://www.ietf.org/mailman/listinfo/lisp
>>>>
>> _______________________________________________
>> lisp mailing list
>> lisp@ietf.org
>> https://www.ietf.org/mailman/listinfo/lisp
> _______________________________________________
> lisp mailing list
> lisp@ietf.org
> https://www.ietf.org/mailman/listinfo/lisp


From nobody Wed May 28 00:38:03 2014
Return-Path: <marc@sniff.de>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E33181A03CD for <lisp@ietfa.amsl.com>; Wed, 28 May 2014 00:38:00 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.201
X-Spam-Level: 
X-Spam-Status: No, score=-2.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, RP_MATCHES_RCVD=-0.651] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XTOv2eH3jPHQ for <lisp@ietfa.amsl.com>; Wed, 28 May 2014 00:37:55 -0700 (PDT)
Received: from door.sniff.de (door.sniff.de [IPv6:2001:6f8:94f:1::1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D9021A03A2 for <lisp@ietf.org>; Wed, 28 May 2014 00:37:55 -0700 (PDT)
Received: from [IPv6:::1] (localhost.sniff.de [127.0.0.1]) by door.sniff.de (Postfix) with ESMTP id 0B1412AA0F; Wed, 28 May 2014 07:37:48 +0000 (GMT)
Date: Wed, 28 May 2014 00:37:56 -0700
From: Marc Binderberger <marc@sniff.de>
To: Florin Coras <fcoras@ac.upc.edu>, Ronald Bonica <rbonica@juniper.net>
Message-ID: <20140528003756040812.38ca9d6c@sniff.de>
In-Reply-To: <5385792B.1010103@ac.upc.edu>
References: <536CFA13.4010102@joelhalpern.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com> <538361DA.10808@joelhalpern.com> <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> <936e209eb2fb49288f3a776aaa4b71cb@CO1PR05MB442.namprd05.prod.outlook.com> <5385792B.1010103@ac.upc.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Mailer: GyazMail version 1.5.15
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/Cp61k_3_qYbnH0PBns6dSljz5FE
Cc: lisp@ietf.org
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 28 May 2014 07:38:01 -0000

Hello Florin et al.,

interesting discussion and I think some aspects should continue to be 
discussed. But I start wondering: where is this thread heading? It doesn't 
seem to move forward with respect to the "last call" topic :-)

Florin, your reply seems to indicate that Ronald's scenario is a valid attack 
as you describe mitigation strategies. But is Ronald's scenario really _new_ 
with respect to the draft?  It seems to be covered by section 4.2/4.3.1.1 (?).

If the opinion is that Ron's scenario is not covered by the draft yet then do 
we need additional text in the draft?  Any proposal, Ron?


Myself I'm expecting from the draft that it provides an overview of the 
potential problems and some attack vectors to stimulate ideas. I do not 
assume that the level of details in the draft and the "relevance" of the 
attack correspond - what is relevant or not may depend on whom you ask. 


Thanks & Regards,
Marc



On Wed, 28 May 2014 07:50:35 +0200, Florin Coras wrote:
> Hi Ron,
> 
> It turns out that just doing a flat scan of the EID-prefix space, i.e., 
> using as source EID an IP in each existing EID-prefix, has the most 
> damaging consequences (see fig. 5 in [1]). This, if you contrast it with 
> the case when you try to craft packets whose replies (coming from 
> intra-domain sources) will always generate misses in the xTR under attack.
> 
> If the attack intensity (attack packet rate to legitimate traffic rate 
> ratio) is high, say above 0.01, you are right to assume that such an attack 
> could cripple an xTR and generate lots of misses. However, as we mention in 
> the paper, some simple solutions could be set in place to avoid this. For 
> instance:
> 
> 1) When the attack is detected (due to the higher than normal miss rate), 
> the most important entries in the cache, the most popular (say, Google, Fb, 
> Amazon ..) can be protected from eviction. Thereby, on the one hand, set up 
> flows won't have their entries evicted and on the other, this set of 
> entries will ensure that a very large part of the new outgoing flows will 
> cache hit.
> 
> 2) Just add more memory! Besides the TCAM in the xTR we could use a large 
> second level memory able to cache the whole EID address space.  
> Alternatively, you could imagine having an xTR per site, capable of holding 
> the whole EID address space, that could act as default for packets that 
> miss in all the other sub-provisioned xTRs.
> 
> [1] http://arxiv.org/pdf/1312.1378v2.pdf
> 
> Florin
> 
> 
> On 05/28/2014 12:45 AM, Ronald Bonica wrote:
>> Hi Paul,
>> 
>> The attack scenario that I envision is slightly different from the on that 
>> you describe below:
>> 
>> - LISP is widely deployed. Tens of thousands of XTRs are deployed 
>> world-wide. The mapping system data base contains hundreds of thousands of 
>> EID prefixes.
>> - The attack stream is large
>> - Each packet in the attack stream has a unique source LOC
>> - All packets in the attack stream have the same destination LOC. This LOC 
>> represents the XTR under attack.
>> - Each packet in the attack stream has a destination EID that will cause 
>> it to reach a valid destination (i.e., a destination that will respond). 
>> However, all packets in the attack stream don't have the same destination. 
>> The attack stream is spread out across multiple valid EID destinations to 
>> make it less detectable.
>> - Each packet in the attack stream has a carefully chosen source EID. It 
>> is chosen to maximize the ratio of attack packets to map-requests.
>> 
>> One attack stream attacks an XTR. Multiple simultaneous attacks against 
>> multiple XTRs can DoS the mapping system, itself.
>> 
>> A PxTR probably won't generate this attack stream. However, an attack tool 
>> might.
>> 
>> Hope this helps.
>> 
>>                                                              Ron
>> 
>>> -----Original Message-----
>>> From: Paul Vinciguerra [mailto:pvinci@VinciConsulting.com]
>>> Sent: Monday, May 26, 2014 3:28 PM
>>> To: Ronald Bonica; Joel M. Halpern; Damien Saucez
>>> Cc: Roger Jorgensen; LISP mailing list list
>>> Subject: RE: [lisp] Restarting last call on LISP threats
>>> 
>>> Every host on the Internet is subject to a DoS attack.  An xTR is no more 
>>> so.  I
>>> am also not clear on how a DoS attack on an xTR would create any more risk
>>> than an attack directly against the mapping system.
>>> 
>>> Joel describes Ronald's scenario of an attack where a large stream of 
>>> packets
>>> with different inner source addresses to an ETR.  I don't call this an 
>>> attack.  I
>>> call this our steady-state.  These would be the PxTR's we operate across 
>>> the
>>> US.  The PxTR's on the beta-network are no different.  We take in packets
>>> from anywhere.  This is a "Free" attacker if you will.  All that really 
>>> means is
>>> that you do not have to incur the computational cost of encapsulating the
>>> packet.
>>> 
>>> I would defer to Dino and others on the list, but I do not believe that 
>>> the ETR
>>> does a reverse lookup on every packet.  At least that is not the behavior 
>>> we
>>> observe.  What we see happen is that the packet is decapsulated and sent 
>>> to
>>> the destination.  If a valid destination host responds, then the ITR does 
>>> a
>>> map-request for the reply packet.  There is not a 1:1 relationship between
>>> the number of packets and the number of map-requests.
>>> 
>>> Map-replies for IP addresses return prefixes. These prefixes can cover 
>>> larger
>>> address spaces than the map-request and limit the number of future map-
>>> requests needed.
>>> 
>>> Can you provide more specific details on how you see the xTR rendering the
>>> mapping system unusable?
>>> 
>>> For what its worth, I still support the decision for last call and not to 
>>> place
>>> mitigations within the document.  Without knowing the specifics of a
>>> configuration and implementation, that just leads to a false sense of 
>>> security.
>>> 
>>> 
>>> ________________________________________
>>> From: lisp [lisp-bounces@ietf.org] on behalf of Ronald Bonica
>>> [rbonica@juniper.net]
>>> Sent: Monday, May 26, 2014 11:57 AM
>>> To: Joel M. Halpern; Damien Saucez
>>> Cc: Roger Jorgensen; LISP mailing list list
>>> Subject: Re: [lisp] Restarting last call on LISP threats
>>> 
>>> Inline.....
>>> 
>>>> -----Original Message-----
>>>> From: Joel M. Halpern [mailto:jmh@joelhalpern.com]
>>>> Sent: Monday, May 26, 2014 11:47 AM
>>>> To: Ronald Bonica; Damien Saucez
>>>> Cc: Roger Jorgensen; LISP mailing list list
>>>> Subject: Re: [lisp] Restarting last call on LISP threats
>>>> 
>>>> Top posting to make sure I am understanding:
>>>> 
>>>> You asssert that any xTR is subject to a DoS attack.  And that such a
>>>> DoS attack can render the mapping system unusable.
>>> [RPB]
>>> Exactly!
>>> 
>>>> It targeting an ITR, this would need to be from within ths cope the ITR
>>> serves.
>>> [RPB]
>>> I don't understand this sentence. Please try again.
>>> 
>>>> I believe that is discussed.
>>> [RPB]
>>> Given that I don't understand the sentence above, I have no idea if this
>>> sentence is true.
>>> 
>>>> If I have connected the dots correctly, the attack you are
>>>> contemplating is sending a large stream of packets with different
>>>> inner source addresses to an ETR.  This would prompt the ETR to check
>>>> with the mapping system about each and every address.
>>> [RPB]
>>> Exactly!
>>> 
>>>> If I have understood this properly, while there are several very
>>>> effective mitigations, that does not change the basic message that
>>>> this is an attack, and as such ought to be described in the threats
>>> document.
>>> [RPB]
>>> Even if there are effective mitigations, the attack should be described.
>>> 
>>> However, I am not convinced that an effective mitigation exists.
>>> 
>>>>    There are clealry a number of variations on this attack.
>>> [RPB]
>>> True!
>>> 
>>>    For example, using
>>>> the same outer source address makes mitigation easier, while using
>>>> different outer source addresses either requires a bot-net or a large
>>>> unchecked BCP38 hole (and those can be used for MANY attacks on many
>>>> systems.)  Both presumably should be described.
>>> [RPB]
>>> Yes, both should be described.
>>> 
>>> Also, recall that large BCP38 holes exist in today's internet.
>>> 
>>>> Have I captured your request accurately?
>>> [RPB]
>>> Pretty much.
>>> 
>>> Thanks for taking the effort.
>>> 
>>>                      Ron
>>> 
>>>> Yours,
>>>> Joel
>>>> 
>>>> On 5/26/14, 1:06 AM, Ronald Bonica wrote:
>>>>> *From:*Damien Saucez [mailto:damien.saucez@gmail.com]
>>>>> *Sent:* Friday, May 23, 2014 9:07 AM
>>>>> *To:* Ronald Bonica
>>>>> *Cc:* Dino Farinacci; Roger Jorgensen; LISP mailing list list
>>>>> *Subject:* Re: [lisp] Restarting last call on LISP threats
>>>>> 
>>>>> Hello Ronald,
>>>>> 
>>>>> On 22 May 2014, at 22:57, Ronald Bonica <rbonica@juniper.net
>>>>> <mailto:rbonica@juniper.net>> wrote:
>>>>> 
>>>>> 
>>>>> 
>>>>>      Dino,
>>>>> 
>>>>>      Today's Internet is not as fragile as you think. This mail 
>>>>> traversed
>>>>>      many routers between my house and yours. If those routers are
>>>>>      well-managed, there is nothing that I can do from my house that 
>>>>> will
>>>>>      cause any of those routers to consume control plane resources.
>>>>>      Therefore, there is nothing that I can do from my house that will
>>>>>      cause a DoS attack against those routers' control planes.
>>>>> 
>>>>> We tend to disagree with that, for example you have ICMP today...
>>>>> 
>>>>> */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn't make
>>>>> a very good routing protocol. That's why we don't use it for
>>>>> routing. By contrast, LISP map-request messages are susceptible to
>>>>> DoS attacks and they do carry routing information./*
>>>>> 
>>>>> 
>>>>> 
>>>>>      In LISP, separation between the forwarding and control plane is
>>>>>      lost. As a matter of course, forwarding plane activity causes
>>>>>      control plane activity. Since forwarding plane bandwidth exceeds
>>>>>      control plane bandwidth, DoS attacks against the control plane are
>>>>>      possible.
>>>>> 
>>>>>      In order to be complete, the threats document must describe the DoS
>>>>>      threat. It should also describe mitigations, if any exist.
>>>>> 
>>>>> DoS is already explained and the definition given:
>>>>> 
>>>>> " A Denial of Service (DoS) attack aims at disrupting a specific
>>>>> 
>>>>>      targeted service either by exhausting the resources of the
>>>>> victim up
>>>>> 
>>>>>      to the point that it is not able to provide a reliable service
>>>>> to
>>>>> 
>>>>>      legit traffic and/or systems or by exploiting vulnerabilities to
>>>>> make
>>>>> 
>>>>>      the targeted service unable to operate properly.
>>>>> 
>>>>> "
>>>>> 
>>>>> is covering the case you mention.
>>>>> 
>>>>> */[RPB] /*
>>>>> 
>>>>> */You might want to add the following details to section 5.2:/*
>>>>> 
>>>>> *//*
>>>>> 
>>>>> -A DoS attack can be launched by anybody who can send a packet to
>>>>> the XTR's LOC
>>>>> 
>>>>> -DoS attacks can render an XTR inoperable
>>>>> 
>>>>> -DDoS attacks can render the mapping system inoperable.
>>>>> 
>>>>> This is what differentiates LISP from today's routing system.
>>>>> 
>>>>>                                         Ron
>>>>> 
>>>>> Damien Saucez
>>>>> 
>>>>> 
>>>>> 
>>>>> 
>>>>> Ron
>>>>> 
>>>>> 
>>>>> 
>>>>>          -----Original Message-----
>>>>>          From: Dino Farinacci [mailto:farinacci@gmail.com]
>>>>>          Sent: Wednesday, May 21, 2014 6:58 PM
>>>>>          To: Ronald Bonica
>>>>>          Cc: Roger Jorgensen; lisp@ietf.org <mailto:lisp@ietf.org>
>>>>>          Subject: Re: [lisp] Restarting last call on LISP threats
>>>>> 
>>>>> 
>>>>>              The attacker sends a flow of crafted packets to the victim
>>>>>              XTR. Each packet
>>>>> 
>>>>>          is a well-formed LISP data packet. It contains:
>>>>> 
>>>>> 
>>>>>              - an outer IP header (LOC->LOC)
>>>>>              - a UDP header
>>>>>              - a LISP Header
>>>>>              - an IP header (EID->EID)
>>>>>              - payload
>>>>> 
>>>>> 
>>>>>          Just like a regular packet I can send to your home router 
>>>>> today.
>>>>>          So yes okay.
>>>>>          So let's continue. See comments below.
>>>>> 
>>>>> 
>>>>>              Each packet contains control plane information that is new
>>>>>              to the victim
>>>>> 
>>>>> 
>>>>>          Be more specific about what control information are in these
>>>>>          encapsulated
>>>>>          packets.
>>>>> 
>>>>> 
>>>>>              XTR. For example, the victim XTR has no mapping information
>>>>>              regarding
>>>>> 
>>>>>          either the source LOC or source EID prefix. Rather than 
>>>>> gleaning
>>>>>          this mapping
>>>>>          information from the crafted packet, the victim XTR sends a
>>>>>          verifying MAP-
>>>>>          REQUEST to the mapping system.
>>>>> 
>>>>> 
>>>>>              Assume that the attack flow is large (N packets per 
>>>>> second).
>>>>>              Assume also
>>>>> 
>>>>>          that the XTRs rate limit for MAP-REQUEST messages is less than 
>>>>> N
>>>>>          packets
>>>>>          per second. Has the attack not effectively DoS'd the victim 
>>>>> XTR?
>>>>> 
>>>>>          It caches the rate the rate the packets are coming in and
>>>>>          eventually stops
>>>>>          sending Map-Requests completely.
>>>>> 
>>>>>          It cannot stop the incoming rate of packets today just like a
>>>>>          roque BGP
>>>>>          attacker can send millions of packets per second to a peer
>>>>>          regardless if it
>>>>>          does or does not have the peer authentication key.
>>>>> 
>>>>> 
>>>>>              To make this attack work, every packet in the attack flow
>>>>>              may need to have
>>>>> 
>>>>>          a unique, spoofed, source LOC.
>>>>> 
>>>>>          An implementation can detect that after rate limiting 1000s of
>>>>>          such requests
>>>>>          are happening that it just stops operation.
>>>>> 
>>>>>          What if I sent a Juniper 20 million routes today?
>>>>> 
>>>>>          The Internet is very fragile and LISP IS NOT making it worse.
>>>>>          And in some
>>>>>          cases it is making it better with integrated techniques.
>>>>> 
>>>>>          Dino
>>>>> 
>>>>> 
>>>>>      _______________________________________________
>>>>>      lisp mailing list
>>>>>      lisp@ietf.org <mailto:lisp@ietf.org>
>>>>>      https://www.ietf.org/mailman/listinfo/lisp
>>>>> 
>>>>> 
>>>>> 
>>>>> _______________________________________________
>>>>> lisp mailing list
>>>>> lisp@ietf.org
>>>>> https://www.ietf.org/mailman/listinfo/lisp
>>>>> 
>>> _______________________________________________
>>> lisp mailing list
>>> lisp@ietf.org
>>> https://www.ietf.org/mailman/listinfo/lisp
>> _______________________________________________
>> lisp mailing list
>> lisp@ietf.org
>> https://www.ietf.org/mailman/listinfo/lisp
> 
> _______________________________________________
> lisp mailing list
> lisp@ietf.org
> https://www.ietf.org/mailman/listinfo/lisp
> 


From nobody Wed May 28 01:50:44 2014
Return-Path: <fcoras@ac.upc.edu>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 66C451A03D3 for <lisp@ietfa.amsl.com>; Wed, 28 May 2014 01:50:42 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.553
X-Spam-Level: 
X-Spam-Status: No, score=-2.553 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.651, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ExNhRBNVxVkE for <lisp@ietfa.amsl.com>; Wed, 28 May 2014 01:50:39 -0700 (PDT)
Received: from roura.ac.upc.es (roura.ac.upc.edu [147.83.33.10]) by ietfa.amsl.com (Postfix) with ESMTP id 901C81A03D1 for <lisp@ietf.org>; Wed, 28 May 2014 01:50:38 -0700 (PDT)
Received: from gw-3.ac.upc.es (gw-3.ac.upc.es [147.83.30.9]) by roura.ac.upc.es (8.13.8/8.13.8) with ESMTP id s4S8oY9d031161; Wed, 28 May 2014 10:50:34 +0200
Received: from [10.8.0.18] (gw-2-vpn-i.ac.upc.es [147.83.35.76]) by gw-3.ac.upc.es (Postfix) with ESMTPSA id 02FFD3CE; Wed, 28 May 2014 10:50:32 +0200 (CEST)
Message-ID: <5385A353.1050300@ac.upc.edu>
Date: Wed, 28 May 2014 10:50:27 +0200
From: Florin Coras <fcoras@ac.upc.edu>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.5.0
MIME-Version: 1.0
To: Marc Binderberger <marc@sniff.de>, Ronald Bonica <rbonica@juniper.net>
References: <536CFA13.4010102@joelhalpern.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com> <538361DA.10808@joelhalpern.com> <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <3519A6AD5B18C44EB0291EC6C880A906012FD3@NYDC-EXCH01.vinci-consulting-corp.local> <936e209eb2fb49288f3a776aaa4b71cb@CO1PR05MB442.namprd05.prod.outlook.com> <5385792B.1010103@ac.upc.edu> <20140528003756040812.38ca9d6c@sniff.de>
In-Reply-To: <20140528003756040812.38ca9d6c@sniff.de>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/AUKqol4mimstIWW5lrExwwR2HOs
Cc: lisp@ietf.org
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 28 May 2014 08:50:42 -0000

Hi Marc,

Thanks for the reply and apologies for not being clear enough. More inline.

On 05/28/2014 09:37 AM, Marc Binderberger wrote:
> Hello Florin et al.,
>
> interesting discussion and I think some aspects should continue to be
> discussed. But I start wondering: where is this thread heading? It doesn't
> seem to move forward with respect to the "last call" topic :-)
>
> Florin, your reply seems to indicate that Ronald's scenario is a valid attack
> as you describe mitigation strategies. But is Ronald's scenario really _new_
> with respect to the draft?  It seems to be covered by section 4.2/4.3.1.1 (?).
It is. We've previously had discussions concerning cache poisoning on 
the mailing list and I wrongly assumed the subject as 
known-and-documented in the draft. In fact, Damien mentioned this 
several times in his replies. My previous email was only meant to bring 
this up to Ron's attention and answer his specific concerns.

So, to clear up the confusion: Section 4.2 already mentions cache 
poisoning attacks and offers a pointer to an analysis and possible 
mitigation strategies.

> If the opinion is that Ron's scenario is not covered by the draft yet then do
> we need additional text in the draft?  Any proposal, Ron?

IMO, we do not need additional text.

Regards,
Florin

> Myself I'm expecting from the draft that it provides an overview of the
> potential problems and some attack vectors to stimulate ideas. I do not
> assume that the level of details in the draft and the "relevance" of the
> attack correspond - what is relevant or not may depend on whom you ask.
>
>
> Thanks & Regards,
> Marc
>
>
>
> On Wed, 28 May 2014 07:50:35 +0200, Florin Coras wrote:
>> Hi Ron,
>>
>> It turns out that just doing a flat scan of the EID-prefix space, i.e.,
>> using as source EID an IP in each existing EID-prefix, has the most
>> damaging consequences (see fig. 5 in [1]). This, if you contrast it with
>> the case when you try to craft packets whose replies (coming from
>> intra-domain sources) will always generate misses in the xTR under attack.
>>
>> If the attack intensity (attack packet rate to legitimate traffic rate
>> ratio) is high, say above 0.01, you are right to assume that such an attack
>> could cripple an xTR and generate lots of misses. However, as we mention in
>> the paper, some simple solutions could be set in place to avoid this. For
>> instance:
>>
>> 1) When the attack is detected (due to the higher than normal miss rate),
>> the most important entries in the cache, the most popular (say, Google, Fb,
>> Amazon ..) can be protected from eviction. Thereby, on the one hand, set up
>> flows won't have their entries evicted and on the other, this set of
>> entries will ensure that a very large part of the new outgoing flows will
>> cache hit.
>>
>> 2) Just add more memory! Besides the TCAM in the xTR we could use a large
>> second level memory able to cache the whole EID address space.
>> Alternatively, you could imagine having an xTR per site, capable of holding
>> the whole EID address space, that could act as default for packets that
>> miss in all the other sub-provisioned xTRs.
>>
>> [1] http://arxiv.org/pdf/1312.1378v2.pdf
>>
>> Florin
>>
>>
>> On 05/28/2014 12:45 AM, Ronald Bonica wrote:
>>> Hi Paul,
>>>
>>> The attack scenario that I envision is slightly different from the on that
>>> you describe below:
>>>
>>> - LISP is widely deployed. Tens of thousands of XTRs are deployed
>>> world-wide. The mapping system data base contains hundreds of thousands of
>>> EID prefixes.
>>> - The attack stream is large
>>> - Each packet in the attack stream has a unique source LOC
>>> - All packets in the attack stream have the same destination LOC. This LOC
>>> represents the XTR under attack.
>>> - Each packet in the attack stream has a destination EID that will cause
>>> it to reach a valid destination (i.e., a destination that will respond).
>>> However, all packets in the attack stream don't have the same destination.
>>> The attack stream is spread out across multiple valid EID destinations to
>>> make it less detectable.
>>> - Each packet in the attack stream has a carefully chosen source EID. It
>>> is chosen to maximize the ratio of attack packets to map-requests.
>>>
>>> One attack stream attacks an XTR. Multiple simultaneous attacks against
>>> multiple XTRs can DoS the mapping system, itself.
>>>
>>> A PxTR probably won't generate this attack stream. However, an attack tool
>>> might.
>>>
>>> Hope this helps.
>>>
>>>                                                               Ron
>>>
>>>> -----Original Message-----
>>>> From: Paul Vinciguerra [mailto:pvinci@VinciConsulting.com]
>>>> Sent: Monday, May 26, 2014 3:28 PM
>>>> To: Ronald Bonica; Joel M. Halpern; Damien Saucez
>>>> Cc: Roger Jorgensen; LISP mailing list list
>>>> Subject: RE: [lisp] Restarting last call on LISP threats
>>>>
>>>> Every host on the Internet is subject to a DoS attack.  An xTR is no more
>>>> so.  I
>>>> am also not clear on how a DoS attack on an xTR would create any more risk
>>>> than an attack directly against the mapping system.
>>>>
>>>> Joel describes Ronald's scenario of an attack where a large stream of
>>>> packets
>>>> with different inner source addresses to an ETR.  I don't call this an
>>>> attack.  I
>>>> call this our steady-state.  These would be the PxTR's we operate across
>>>> the
>>>> US.  The PxTR's on the beta-network are no different.  We take in packets
>>>> from anywhere.  This is a "Free" attacker if you will.  All that really
>>>> means is
>>>> that you do not have to incur the computational cost of encapsulating the
>>>> packet.
>>>>
>>>> I would defer to Dino and others on the list, but I do not believe that
>>>> the ETR
>>>> does a reverse lookup on every packet.  At least that is not the behavior
>>>> we
>>>> observe.  What we see happen is that the packet is decapsulated and sent
>>>> to
>>>> the destination.  If a valid destination host responds, then the ITR does
>>>> a
>>>> map-request for the reply packet.  There is not a 1:1 relationship between
>>>> the number of packets and the number of map-requests.
>>>>
>>>> Map-replies for IP addresses return prefixes. These prefixes can cover
>>>> larger
>>>> address spaces than the map-request and limit the number of future map-
>>>> requests needed.
>>>>
>>>> Can you provide more specific details on how you see the xTR rendering the
>>>> mapping system unusable?
>>>>
>>>> For what its worth, I still support the decision for last call and not to
>>>> place
>>>> mitigations within the document.  Without knowing the specifics of a
>>>> configuration and implementation, that just leads to a false sense of
>>>> security.
>>>>
>>>>
>>>> ________________________________________
>>>> From: lisp [lisp-bounces@ietf.org] on behalf of Ronald Bonica
>>>> [rbonica@juniper.net]
>>>> Sent: Monday, May 26, 2014 11:57 AM
>>>> To: Joel M. Halpern; Damien Saucez
>>>> Cc: Roger Jorgensen; LISP mailing list list
>>>> Subject: Re: [lisp] Restarting last call on LISP threats
>>>>
>>>> Inline.....
>>>>
>>>>> -----Original Message-----
>>>>> From: Joel M. Halpern [mailto:jmh@joelhalpern.com]
>>>>> Sent: Monday, May 26, 2014 11:47 AM
>>>>> To: Ronald Bonica; Damien Saucez
>>>>> Cc: Roger Jorgensen; LISP mailing list list
>>>>> Subject: Re: [lisp] Restarting last call on LISP threats
>>>>>
>>>>> Top posting to make sure I am understanding:
>>>>>
>>>>> You asssert that any xTR is subject to a DoS attack.  And that such a
>>>>> DoS attack can render the mapping system unusable.
>>>> [RPB]
>>>> Exactly!
>>>>
>>>>> It targeting an ITR, this would need to be from within ths cope the ITR
>>>> serves.
>>>> [RPB]
>>>> I don't understand this sentence. Please try again.
>>>>
>>>>> I believe that is discussed.
>>>> [RPB]
>>>> Given that I don't understand the sentence above, I have no idea if this
>>>> sentence is true.
>>>>
>>>>> If I have connected the dots correctly, the attack you are
>>>>> contemplating is sending a large stream of packets with different
>>>>> inner source addresses to an ETR.  This would prompt the ETR to check
>>>>> with the mapping system about each and every address.
>>>> [RPB]
>>>> Exactly!
>>>>
>>>>> If I have understood this properly, while there are several very
>>>>> effective mitigations, that does not change the basic message that
>>>>> this is an attack, and as such ought to be described in the threats
>>>> document.
>>>> [RPB]
>>>> Even if there are effective mitigations, the attack should be described.
>>>>
>>>> However, I am not convinced that an effective mitigation exists.
>>>>
>>>>>     There are clealry a number of variations on this attack.
>>>> [RPB]
>>>> True!
>>>>
>>>>     For example, using
>>>>> the same outer source address makes mitigation easier, while using
>>>>> different outer source addresses either requires a bot-net or a large
>>>>> unchecked BCP38 hole (and those can be used for MANY attacks on many
>>>>> systems.)  Both presumably should be described.
>>>> [RPB]
>>>> Yes, both should be described.
>>>>
>>>> Also, recall that large BCP38 holes exist in today's internet.
>>>>
>>>>> Have I captured your request accurately?
>>>> [RPB]
>>>> Pretty much.
>>>>
>>>> Thanks for taking the effort.
>>>>
>>>>                       Ron
>>>>
>>>>> Yours,
>>>>> Joel
>>>>>
>>>>> On 5/26/14, 1:06 AM, Ronald Bonica wrote:
>>>>>> *From:*Damien Saucez [mailto:damien.saucez@gmail.com]
>>>>>> *Sent:* Friday, May 23, 2014 9:07 AM
>>>>>> *To:* Ronald Bonica
>>>>>> *Cc:* Dino Farinacci; Roger Jorgensen; LISP mailing list list
>>>>>> *Subject:* Re: [lisp] Restarting last call on LISP threats
>>>>>>
>>>>>> Hello Ronald,
>>>>>>
>>>>>> On 22 May 2014, at 22:57, Ronald Bonica <rbonica@juniper.net
>>>>>> <mailto:rbonica@juniper.net>> wrote:
>>>>>>
>>>>>>
>>>>>>
>>>>>>       Dino,
>>>>>>
>>>>>>       Today's Internet is not as fragile as you think. This mail
>>>>>> traversed
>>>>>>       many routers between my house and yours. If those routers are
>>>>>>       well-managed, there is nothing that I can do from my house that
>>>>>> will
>>>>>>       cause any of those routers to consume control plane resources.
>>>>>>       Therefore, there is nothing that I can do from my house that will
>>>>>>       cause a DoS attack against those routers' control planes.
>>>>>>
>>>>>> We tend to disagree with that, for example you have ICMP today...
>>>>>>
>>>>>> */[RPB] Because ICMP is susceptible to DoS attacks, it wouldn't make
>>>>>> a very good routing protocol. That's why we don't use it for
>>>>>> routing. By contrast, LISP map-request messages are susceptible to
>>>>>> DoS attacks and they do carry routing information./*
>>>>>>
>>>>>>
>>>>>>
>>>>>>       In LISP, separation between the forwarding and control plane is
>>>>>>       lost. As a matter of course, forwarding plane activity causes
>>>>>>       control plane activity. Since forwarding plane bandwidth exceeds
>>>>>>       control plane bandwidth, DoS attacks against the control plane are
>>>>>>       possible.
>>>>>>
>>>>>>       In order to be complete, the threats document must describe the DoS
>>>>>>       threat. It should also describe mitigations, if any exist.
>>>>>>
>>>>>> DoS is already explained and the definition given:
>>>>>>
>>>>>> " A Denial of Service (DoS) attack aims at disrupting a specific
>>>>>>
>>>>>>       targeted service either by exhausting the resources of the
>>>>>> victim up
>>>>>>
>>>>>>       to the point that it is not able to provide a reliable service
>>>>>> to
>>>>>>
>>>>>>       legit traffic and/or systems or by exploiting vulnerabilities to
>>>>>> make
>>>>>>
>>>>>>       the targeted service unable to operate properly.
>>>>>>
>>>>>> "
>>>>>>
>>>>>> is covering the case you mention.
>>>>>>
>>>>>> */[RPB] /*
>>>>>>
>>>>>> */You might want to add the following details to section 5.2:/*
>>>>>>
>>>>>> *//*
>>>>>>
>>>>>> -A DoS attack can be launched by anybody who can send a packet to
>>>>>> the XTR's LOC
>>>>>>
>>>>>> -DoS attacks can render an XTR inoperable
>>>>>>
>>>>>> -DDoS attacks can render the mapping system inoperable.
>>>>>>
>>>>>> This is what differentiates LISP from today's routing system.
>>>>>>
>>>>>>                                          Ron
>>>>>>
>>>>>> Damien Saucez
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>> Ron
>>>>>>
>>>>>>
>>>>>>
>>>>>>           -----Original Message-----
>>>>>>           From: Dino Farinacci [mailto:farinacci@gmail.com]
>>>>>>           Sent: Wednesday, May 21, 2014 6:58 PM
>>>>>>           To: Ronald Bonica
>>>>>>           Cc: Roger Jorgensen; lisp@ietf.org <mailto:lisp@ietf.org>
>>>>>>           Subject: Re: [lisp] Restarting last call on LISP threats
>>>>>>
>>>>>>
>>>>>>               The attacker sends a flow of crafted packets to the victim
>>>>>>               XTR. Each packet
>>>>>>
>>>>>>           is a well-formed LISP data packet. It contains:
>>>>>>
>>>>>>
>>>>>>               - an outer IP header (LOC->LOC)
>>>>>>               - a UDP header
>>>>>>               - a LISP Header
>>>>>>               - an IP header (EID->EID)
>>>>>>               - payload
>>>>>>
>>>>>>
>>>>>>           Just like a regular packet I can send to your home router
>>>>>> today.
>>>>>>           So yes okay.
>>>>>>           So let's continue. See comments below.
>>>>>>
>>>>>>
>>>>>>               Each packet contains control plane information that is new
>>>>>>               to the victim
>>>>>>
>>>>>>
>>>>>>           Be more specific about what control information are in these
>>>>>>           encapsulated
>>>>>>           packets.
>>>>>>
>>>>>>
>>>>>>               XTR. For example, the victim XTR has no mapping information
>>>>>>               regarding
>>>>>>
>>>>>>           either the source LOC or source EID prefix. Rather than
>>>>>> gleaning
>>>>>>           this mapping
>>>>>>           information from the crafted packet, the victim XTR sends a
>>>>>>           verifying MAP-
>>>>>>           REQUEST to the mapping system.
>>>>>>
>>>>>>
>>>>>>               Assume that the attack flow is large (N packets per
>>>>>> second).
>>>>>>               Assume also
>>>>>>
>>>>>>           that the XTRs rate limit for MAP-REQUEST messages is less than
>>>>>> N
>>>>>>           packets
>>>>>>           per second. Has the attack not effectively DoS'd the victim
>>>>>> XTR?
>>>>>>
>>>>>>           It caches the rate the rate the packets are coming in and
>>>>>>           eventually stops
>>>>>>           sending Map-Requests completely.
>>>>>>
>>>>>>           It cannot stop the incoming rate of packets today just like a
>>>>>>           roque BGP
>>>>>>           attacker can send millions of packets per second to a peer
>>>>>>           regardless if it
>>>>>>           does or does not have the peer authentication key.
>>>>>>
>>>>>>
>>>>>>               To make this attack work, every packet in the attack flow
>>>>>>               may need to have
>>>>>>
>>>>>>           a unique, spoofed, source LOC.
>>>>>>
>>>>>>           An implementation can detect that after rate limiting 1000s of
>>>>>>           such requests
>>>>>>           are happening that it just stops operation.
>>>>>>
>>>>>>           What if I sent a Juniper 20 million routes today?
>>>>>>
>>>>>>           The Internet is very fragile and LISP IS NOT making it worse.
>>>>>>           And in some
>>>>>>           cases it is making it better with integrated techniques.
>>>>>>
>>>>>>           Dino
>>>>>>
>>>>>>
>>>>>>       _______________________________________________
>>>>>>       lisp mailing list
>>>>>>       lisp@ietf.org <mailto:lisp@ietf.org>
>>>>>>       https://www.ietf.org/mailman/listinfo/lisp
>>>>>>
>>>>>>
>>>>>>
>>>>>> _______________________________________________
>>>>>> lisp mailing list
>>>>>> lisp@ietf.org
>>>>>> https://www.ietf.org/mailman/listinfo/lisp
>>>>>>
>>>> _______________________________________________
>>>> lisp mailing list
>>>> lisp@ietf.org
>>>> https://www.ietf.org/mailman/listinfo/lisp
>>> _______________________________________________
>>> lisp mailing list
>>> lisp@ietf.org
>>> https://www.ietf.org/mailman/listinfo/lisp
>> _______________________________________________
>> lisp mailing list
>> lisp@ietf.org
>> https://www.ietf.org/mailman/listinfo/lisp
>>


From nobody Wed May 28 10:53:07 2014
Return-Path: <rcallon@juniper.net>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EAEAF1A01C1 for <lisp@ietfa.amsl.com>; Wed, 28 May 2014 10:53:04 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Level: 
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XsQbCHL_2bXV for <lisp@ietfa.amsl.com>; Wed, 28 May 2014 10:53:02 -0700 (PDT)
Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0142.outbound.protection.outlook.com [207.46.163.142]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0D1F51A01B6 for <lisp@ietf.org>; Wed, 28 May 2014 10:53:01 -0700 (PDT)
Received: from CO2PR05MB636.namprd05.prod.outlook.com (10.141.199.24) by CO2PR05MB634.namprd05.prod.outlook.com (10.141.199.17) with Microsoft SMTP Server (TLS) id 15.0.944.11; Wed, 28 May 2014 17:52:56 +0000
Received: from CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) by CO2PR05MB636.namprd05.prod.outlook.com ([10.141.199.24]) with mapi id 15.00.0944.000; Wed, 28 May 2014 17:52:56 +0000
From: Ross Callon <rcallon@juniper.net>
To: Damien Saucez <damien.saucez@gmail.com>
Thread-Topic: [lisp] Restarting last call on LISP threats
Thread-Index: AQHPa58M9eFhkxJvMEaw1MEc+Ryfdps9MyiAgAD04oCAAJ/u8IAAAtXQgADypICAAm1DAIABaYEAgAeql4CAAHoZgIABcK6AgAEO0wCABDDNAIAAsuYAgAADFoCAAYOMAIAAAhsAgAAPAICAAa+MAA==
Date: Wed, 28 May 2014 17:52:55 +0000
Message-ID: <de313a035023423f9eb79ec08b4f4245@CO2PR05MB636.namprd05.prod.outlook.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com> <538361DA.10808@joelhalpern.com> <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <FB6C01EE-2BB8-4848-8AA2-9512F8FE064A@gmail.com> <5384AB4E.2010208@joelhalpern.com> <8F830D21-5689-476C-97E9-7D92A1CBAA28@gmail.com>
In-Reply-To: <8F830D21-5689-476C-97E9-7D92A1CBAA28@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [66.129.241.15]
x-forefront-prvs: 0225B0D5BC
x-forefront-antispam-report: SFV:NSPM; SFS:(6009001)(428001)(13464003)(164054003)(24454002)(52604005)(199002)(189002)(51704005)(377454003)(479174003)(99396002)(74662001)(64706001)(79102001)(19580405001)(20776003)(80022001)(561944003)(99286001)(74502001)(76482001)(33646001)(83072002)(81542001)(31966008)(15975445006)(19580395003)(77982001)(87936001)(2656002)(83322001)(46102001)(54356999)(50986999)(101416001)(77096999)(74316001)(21056001)(76176999)(66066001)(92566001)(4396001)(81342001)(76576001)(86362001)(85852003)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:CO2PR05MB634; H:CO2PR05MB636.namprd05.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; 
received-spf: None (: juniper.net does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rcallon@juniper.net; 
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/LLJjRRt3RgBHx0YqYqBadi2GCV4
Cc: LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 28 May 2014 17:53:05 -0000

Thanks for agreeing to update the document. I would be happy to contribute =
to discussions related to the update. Please include me on the appropriate =
point to point exchanges.=20

Thanks, Ross

-----Original Message-----
From: lisp [mailto:lisp-bounces@ietf.org] On Behalf Of Damien Saucez
Sent: Tuesday, May 27, 2014 12:06 PM
To: LISP mailing list list
Subject: Re: [lisp] Restarting last call on LISP threats

Dear all,

Thank you all for the passion you put in discussing the threats
document.  We have read all the arguments and arrived to the
conclusion that the threat document needs to be reshaped so to clear
all misunderstandings.  We will provide a new version for early July
that does not exclude any scenarios.  Actually most of problems
pinpointed are already covered somehow in the document but
precisions/rephrasing have to be done to make things clear.

For the sake of efficiency, while writing the new proposal in the
coming weeks, we will make point-to-point exchanges with the different
people that contributed to the discussion so to be sure that we
address all their comments.

Thanks,

Damien Saucez

On 27 May 2014, at 17:12, Joel M. Halpern <jmh@joelhalpern.com> wrote:

> Can we please not get into a debate about how well BCP38 is or is not dep=
loyed, whether violations are remotely detectable, ...This is NOT the worki=
ng group for that.
>=20
> For our purposes, given that source address forging is known to occur, we=
 have to allow it in the threat analysis.
>=20
> Yours,
> Joel
>=20
> On 5/27/14, 11:04 AM, Dino Farinacci wrote:
>>=20
>>> Also, recall that large BCP38 holes exist in today's internet.
>>=20
>> And I am going to repeat again, this is not a binary statement. That is,=
 if a BCP38 hole exists in one part of the network, source spoofing can sti=
ll be detected in other parts of the network.
>>=20
>> Dino
>>=20
>>=20

_______________________________________________
lisp mailing list
lisp@ietf.org
https://www.ietf.org/mailman/listinfo/lisp


From nobody Wed May 28 11:31:14 2014
Return-Path: <farinacci@gmail.com>
X-Original-To: lisp@ietfa.amsl.com
Delivered-To: lisp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D93771A04A8 for <lisp@ietfa.amsl.com>; Wed, 28 May 2014 11:31:12 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level: 
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9,  DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nwqyb-bNJ0NC for <lisp@ietfa.amsl.com>; Wed, 28 May 2014 11:31:11 -0700 (PDT)
Received: from mail-ob0-x231.google.com (mail-ob0-x231.google.com [IPv6:2607:f8b0:4003:c01::231]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6C8E71A0493 for <lisp@ietf.org>; Wed, 28 May 2014 11:31:11 -0700 (PDT)
Received: by mail-ob0-f177.google.com with SMTP id wp4so10930814obc.36 for <lisp@ietf.org>; Wed, 28 May 2014 11:31:07 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=XwBuP4EC6GhulbDJjLGbjmho/evJJSG4BYD4dvC18fE=; b=mYX4iwBvvjSPAMFdcofJONLBmRlnKIcJrLzBEgFbwJjzsTG8fNZKZqy+ouvxfO5Wgr n7GEB4tt81XQeVT+UcHC9aUH7+swJMGvpSZM83Ql2SxQ95uduqFiclMsdifzTZTMjkNJ 8aHRU0zpTeQM815MPjRQyolJpITCO+9+KzSnTgUmSt4/RMGzgHnfOXVqbKzome0uKpoX 0O0A1gknTDf07x9g4ymCKFyS8aLzNqPYGKhTWKO8LgseDM4Kqxm9mVQLN/gXYbBTaflS aPSBAa5AEWbUIC7z5rzYn8EMQCkWerpU9PSKEJLYiIfRUYacDu8Ey3VogC3jPVobScMr dkfQ==
X-Received: by 10.60.94.231 with SMTP id df7mr2049780oeb.26.1401301867588; Wed, 28 May 2014 11:31:07 -0700 (PDT)
Received: from [10.0.0.196] ([12.7.174.218]) by mx.google.com with ESMTPSA id xg9sm22235525oeb.17.2014.05.28.11.31.05 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 28 May 2014 11:31:05 -0700 (PDT)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\))
From: Dino Farinacci <farinacci@gmail.com>
In-Reply-To: <de313a035023423f9eb79ec08b4f4245@CO2PR05MB636.namprd05.prod.outlook.com>
Date: Wed, 28 May 2014 11:31:03 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <A97311B8-C324-4A25-869B-D4F879B71837@gmail.com>
References: <536CFA13.4010102@joelhalpern.com> <4e6c0aaac8fb4aba87ab137cc49b51dc@CO2PR05MB636.namprd05.prod.outlook.com> <CAKFn1SH_gu1+e6EsWESBsRw9EGiSQ+Z5r9E7GEhMO1FdNuM9nQ@mail.gmail.com> <1a200c5f5de041fbaf88edd1a5c3159c@CO1PR05MB442.namprd05.prod.outlook.com> <CAKFn1SEAZyydpQ4cx77mthsUx1HZqMwsM6xNuL4LJjG=oL1mjw@mail.gmail.com> <860b7987207345afb282a82862ff42c0@CO1PR05MB442.namprd05.prod.outlook.com> <F4799A7A-BAEF-458A-8C43-9DF16C9B7828@gmail.com> <e3be912f6afd4f0aa6c8414fede37c74@CO1PR05MB442.namprd05.prod.outlook.com> <2CF699DA-2BAA-4A76-BFF1-64625E001184@gmail.com> <09d3b0d276004c88b6de1a59cf863062@CO1PR05MB442.namprd05.prod.outlook.com> <3269BEE4-C3E5-4D76-A1C0-0B70B6928A12@gmail.com> <dd849ce0cca749c885c5b8a1e989f758@CO1PR05MB442.namprd05.prod.outlook.com> <538361DA.10808@joelhalpern.com> <029e0f8bc7ba433ba4d3ee70b8431f9f@CO1PR05MB442.namprd05.prod.outlook.com> <FB6C01EE-2BB8-4848-8AA2-9512F8FE064A@gmail.com> <5384AB4E.2010208@joelhalpern.com> <8F830D21-5689-476C-97E9-7D92A1CBAA28@gmail.com> <de313a035023423f9eb79ec08b4f4245@CO2PR05MB636.namprd05.prod.outlook.com>
To: Ross Callon <rcallon@juniper.net>
X-Mailer: Apple Mail (2.1874)
Archived-At: http://mailarchive.ietf.org/arch/msg/lisp/zBDJ17TVGEiCWkqxwqzL85q-jV8
Cc: LISP mailing list list <lisp@ietf.org>
Subject: Re: [lisp] Restarting last call on LISP threats
X-BeenThere: lisp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: List for the discussion of the Locator/ID Separation Protocol <lisp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lisp>, <mailto:lisp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/lisp/>
List-Post: <mailto:lisp@ietf.org>
List-Help: <mailto:lisp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lisp>, <mailto:lisp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 28 May 2014 18:31:13 -0000

> Thanks for agreeing to update the document. I would be happy to =
contribute to discussions related to the update. Please include me on =
the appropriate point to point exchanges.=20

Thanks a lot Ross. And I'd be willing to help with the document that =
identifies mitigation techniques to each of the threats in the threats =
document.

Dino

>=20
> Thanks, Ross
>=20
> -----Original Message-----
> From: lisp [mailto:lisp-bounces@ietf.org] On Behalf Of Damien Saucez
> Sent: Tuesday, May 27, 2014 12:06 PM
> To: LISP mailing list list
> Subject: Re: [lisp] Restarting last call on LISP threats
>=20
> Dear all,
>=20
> Thank you all for the passion you put in discussing the threats
> document.  We have read all the arguments and arrived to the
> conclusion that the threat document needs to be reshaped so to clear
> all misunderstandings.  We will provide a new version for early July
> that does not exclude any scenarios.  Actually most of problems
> pinpointed are already covered somehow in the document but
> precisions/rephrasing have to be done to make things clear.
>=20
> For the sake of efficiency, while writing the new proposal in the
> coming weeks, we will make point-to-point exchanges with the different
> people that contributed to the discussion so to be sure that we
> address all their comments.
>=20
> Thanks,
>=20
> Damien Saucez
>=20
> On 27 May 2014, at 17:12, Joel M. Halpern <jmh@joelhalpern.com> wrote:
>=20
>> Can we please not get into a debate about how well BCP38 is or is not =
deployed, whether violations are remotely detectable, ...This is NOT the =
working group for that.
>>=20
>> For our purposes, given that source address forging is known to =
occur, we have to allow it in the threat analysis.
>>=20
>> Yours,
>> Joel
>>=20
>> On 5/27/14, 11:04 AM, Dino Farinacci wrote:
>>>=20
>>>> Also, recall that large BCP38 holes exist in today's internet.
>>>=20
>>> And I am going to repeat again, this is not a binary statement. That =
is, if a BCP38 hole exists in one part of the network, source spoofing =
can still be detected in other parts of the network.
>>>=20
>>> Dino
>>>=20
>>>=20
>=20
> _______________________________________________
> lisp mailing list
> lisp@ietf.org
> https://www.ietf.org/mailman/listinfo/lisp
>=20
> _______________________________________________
> lisp mailing list
> lisp@ietf.org
> https://www.ietf.org/mailman/listinfo/lisp

