Subject: [sfc] Adam Roach's No Objection on draft-ietf-sfc-nsh-24: (with COMMENT)

From: Adam Roach <[email-masked]>
Date: Wed, 27 Sep 2017 17:29:11 -0700

Adam Roach has entered the following ballot position for
draft-ietf-sfc-nsh-24: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-sfc-nsh/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I have the same concern as Kathleen's DISCUSS, and would have blocked the draft
on the same grounds if such a position were not already in place. The "crunchy
perimeter, soft center" model of security was flawed to start with; and, even
in those arenas where it was once fashionable, it's starting to be considered
dated (e.g., much of the traffic inside data centers is secured using TLS --
see the recent discussions in the TLS working group for evidence of this
situation). More notably, this "unconditionally trusted network zone" approach
to security has led to some spectacular exploits recently (cf.
https://www.wired.com/2016/04/the-critical-hole-at-the-heart-of-cell-phone-infrastructure/).
Rather than explicitly fostering this model, the security section really needs
to normatively disallow it.

(n.b., I reviewed version -21 of the document -- but I don't find the changes
between that version and -24 to address the issue Kathleen raises)

----

Section 3 says the following about reclassification behavior:

       When the logical classifier performs re-
       classification that results in a change of service path, it MUST
       replace the existing NSH with a new NSH with the Base Header and
       Service Path Header reflecting the new service path information
       and MUST set the initial SI.  The O bit, as well as unassigned
       flags, MUST be copied transparently from the old NSH to a new
       NSH.  Metadata MAY be preserved in the new NSH.

I don't see anything here about copying the TTL. If the TTL isn't copied, you
can end up with a stable (and unending) loop involving two classifiers (which
seems even more damaging than usual, as the SI value won't generally survive a
reclassification, right?). I would suggest adding "TTL" to the list of things
that MUST be copied when reclassification occurs.

---

From: "Carlos Pignataro (cpignata)" <[email-masked]>
Date: Thu, 28 Sep 2017 12:42:22 +0000

Adam,

Thanks for the comments, please see inline.

> On Sep 27, 2017, at 8:29 PM, Adam Roach <[email-masked]> wrote:
> 
> perimeter, soft center" model of security was flawed to start with;

I understand your statement, but that is not what the draft says. If it is not clear, we will clarify.

However, often people read what their our preconditioned to expect as opposed to what is there — and then group thinking takes over….

> and, even
> I don't see anything here about copying the TTL.

You are correct and found a bug by omission. Thank you!

Fixed in our working copy.

> If the TTL isn't copied, you

Thanks,

Carlos.