Subject: [secdir] Secdir review (early review) of draft-ietf-nvo3-geneve

From: Magnus Nyström <[email-masked]>
Date: Tue, 23 Oct 2018 21:00:48 -0700

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG. These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

This document describes "Geneve," a protocol for GEneric NEtwork
Virtualization Encapsulation. The document is written in a clear manner and
with a thorough Security Considerations section. I have just a few
questions/comments:

- Section 3.4: The "MUST ignore" for the reserved bits should presumably
state "SHALL be ignored for this version of the Geneve protocol." - as I
imagine that in a future version, these bits may not be ignored?
- Section 3.5.1: I wonder about the simultaneous requirement that one
option must not affect the parsing or interpretation of another option but
that the sequencing (order) of options may be significant - they seem to be
contradictory since if the sequencing *is* significant, then some option
must be impacted by a previous one's value? From a security perspective, I
also wonder if there could be security consequences of re-ordering options
(and how to tell if someone did re-order - see below)?
- Section 6.2, shouldn't such an Option be defined to reduce the risk of
under-specified or subpar specifications of such integrity mechanisms? Or
also from an interop perspective?

Thanks.
-- Magnus

---

From: "Ganga, Ilango S" <[email-masked]>
Date: Wed, 31 Oct 2018 01:12:34 +0000

Hi Magnus,

Thanks for your review and feedback. Please see inline for my responses.

Regards,
Ilango

From: Magnus Nyström [mailto:[email-masked]]
Sent: Tuesday, October 23, 2018 9:01 PM
To: [email-masked]; [email-masked]
Subject: Secdir review (early review) of draft-ietf-nvo3-geneve

This document describes "Geneve," a protocol for GEneric NEtwork Virtualization Encapsulation. The document is written in a clear manner and with a thorough Security Considerations section. I have just a few questions/comments:

- Section 3.4: The "MUST ignore" for the reserved bits should presumably state "SHALL be ignored for this version of the Geneve protocol." - as I imagine that in a future version, these bits may not be ignored?

<Ilango> In theory, a future version may change the behavior of any of the header fields including the reserved bits.  The header definition is for this version of the protocol.

Please see if the following text would satisfy the intent of your comment.
“Reserved field which MUST be zero on transmission and MUST be ignored on receipt.”

Or let us know if you still want to have this qualified with “for this version of the protocol”
</>

- Section 3.5.1: I wonder about the simultaneous requirement that one option must not affect the parsing or interpretation of another option but that the sequencing (order) of options may be significant - they seem to be contradictory since if the sequencing *is* significant, then some option must be impacted by a previous one's value? From a security perspective, I also wonder if there could be security consequences of re-ordering options (and how to tell if someone did re-order - see below)?

<Ilango> You raise a good point. The intent of this statement is, parsing and interpretation of options should not be dependent on one another. We are discussing among the authors to see how we can include appropriate clarifying statements to address your point. I will update you shortly.
</>

- Section 6.2, shouldn't such an Option be defined to reduce the risk of under-specified or subpar specifications of such integrity mechanisms? Or also from an interop perspective?

<Ilango> Using a Geneve option for the purpose of data integrity is more of an optimization. Otherwise data integrity could be provided by using existing mechanisms like IPsec (as stated in second paragraph of 6.2). We included the last paragraph to show other possibilities. We could remove this paragraph if it may cause any confusion.

We would like to keep the Geneve base specification independent of options specifications, options could be a defined in a future standards action.
</>

Thanks.
-- Magnus

---

From: Magnus Nyström <[email-masked]>
Date: Wed, 31 Oct 2018 11:34:01 -0700

Hi Ilango,
For 3.4, I think this may be sufficient. 

For 6.2, I will defer to the IETF director/telechat discussion that will occur at some point for this draft. If the intent is interoperability and robustness of such an option, then I would recommend it to be specified in the IETF, but I can also see how you would prefer that such specification work occurs outside this particular draft – which should be doable. Perhaps staying silent on the option alternative and just recommend leveraging layer-provided infrastructure such as ipsec may be best for now?

I'll await your suggested updated language for 3.5.1.

Thanks,

Sent from my Windows 10 phone

From: Ganga, Ilango S
Sent: Tuesday, October 30, 2018 18:12
To: Magnus Nyström; [email-masked]; [email-masked]
Subject: RE: Secdir review (early review) of draft-ietf-nvo3-geneve

Hi Magnus,

Regards,
Ilango

Thanks.
-- Magnus