--- 1/draft-ietf-lisp-rfc6830bis-24.txt 2018-10-21 19:14:11.627960257 -0700 +++ 2/draft-ietf-lisp-rfc6830bis-25.txt 2018-10-21 19:14:11.727962674 -0700 @@ -1,22 +1,22 @@ Network Working Group D. Farinacci Internet-Draft V. Fuller Obsoletes: 6830 (if approved) D. Meyer Intended status: Standards Track D. Lewis -Expires: April 15, 2019 Cisco Systems +Expires: April 24, 2019 Cisco Systems A. Cabellos (Ed.) UPC/BarcelonaTech - October 12, 2018 + October 21, 2018 The Locator/ID Separation Protocol (LISP) - draft-ietf-lisp-rfc6830bis-24 + draft-ietf-lisp-rfc6830bis-25 Abstract This document describes the Data-Plane protocol for the Locator/ID Separation Protocol (LISP). LISP defines two namespaces, End-point Identifiers (EIDs) that identify end-hosts and Routing Locators (RLOCs) that identify network attachment points. With this, LISP effectively separates control from data, and allows routers to create overlay networks. LISP-capable routers exchange encapsulated packets according to EID-to-RLOC mappings stored in a local Map-Cache. @@ -35,21 +35,21 @@ Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." - This Internet-Draft will expire on April 15, 2019. + This Internet-Draft will expire on April 24, 2019. Copyright Notice Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents @@ -89,45 +89,46 @@ 17. Network Management Considerations . . . . . . . . . . . . . . 33 18. Changes since RFC 6830 . . . . . . . . . . . . . . . . . . . 33 19. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 34 19.1. LISP UDP Port Numbers . . . . . . . . . . . . . . . . . 34 20. References . . . . . . . . . . . . . . . . . . . . . . . . . 34 20.1. Normative References . . . . . . . . . . . . . . . . . . 34 20.2. Informative References . . . . . . . . . . . . . . . . . 35 Appendix A. Acknowledgments . . . . . . . . . . . . . . . . . . 39 Appendix B. Document Change Log . . . . . . . . . . . . . . . . 40 B.1. Changes to draft-ietf-lisp-rfc6830bis-24 . . . . . . . . 40 - B.2. Changes to draft-ietf-lisp-rfc6830bis-23 . . . . . . . . 40 - B.3. Changes to draft-ietf-lisp-rfc6830bis-22 . . . . . . . . 40 - B.4. Changes to draft-ietf-lisp-rfc6830bis-21 . . . . . . . . 40 - B.5. Changes to draft-ietf-lisp-rfc6830bis-20 . . . . . . . . 40 - B.6. Changes to draft-ietf-lisp-rfc6830bis-19 . . . . . . . . 40 - B.7. Changes to draft-ietf-lisp-rfc6830bis-18 . . . . . . . . 41 - B.8. Changes to draft-ietf-lisp-rfc6830bis-17 . . . . . . . . 41 - B.9. Changes to draft-ietf-lisp-rfc6830bis-16 . . . . . . . . 41 - B.10. Changes to draft-ietf-lisp-rfc6830bis-15 . . . . . . . . 41 - B.11. Changes to draft-ietf-lisp-rfc6830bis-14 . . . . . . . . 41 - B.12. Changes to draft-ietf-lisp-rfc6830bis-13 . . . . . . . . 41 - B.13. Changes to draft-ietf-lisp-rfc6830bis-12 . . . . . . . . 42 - B.14. Changes to draft-ietf-lisp-rfc6830bis-11 . . . . . . . . 42 - B.15. Changes to draft-ietf-lisp-rfc6830bis-10 . . . . . . . . 42 - B.16. Changes to draft-ietf-lisp-rfc6830bis-09 . . . . . . . . 42 - B.17. Changes to draft-ietf-lisp-rfc6830bis-08 . . . . . . . . 43 - B.18. Changes to draft-ietf-lisp-rfc6830bis-07 . . . . . . . . 43 - B.19. Changes to draft-ietf-lisp-rfc6830bis-06 . . . . . . . . 43 - B.20. Changes to draft-ietf-lisp-rfc6830bis-05 . . . . . . . . 43 - B.21. Changes to draft-ietf-lisp-rfc6830bis-04 . . . . . . . . 44 - B.22. Changes to draft-ietf-lisp-rfc6830bis-03 . . . . . . . . 44 - B.23. Changes to draft-ietf-lisp-rfc6830bis-02 . . . . . . . . 44 - B.24. Changes to draft-ietf-lisp-rfc6830bis-01 . . . . . . . . 44 - B.25. Changes to draft-ietf-lisp-rfc6830bis-00 . . . . . . . . 44 - Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 44 + B.2. Changes to draft-ietf-lisp-rfc6830bis-24 . . . . . . . . 40 + B.3. Changes to draft-ietf-lisp-rfc6830bis-23 . . . . . . . . 40 + B.4. Changes to draft-ietf-lisp-rfc6830bis-22 . . . . . . . . 40 + B.5. Changes to draft-ietf-lisp-rfc6830bis-21 . . . . . . . . 40 + B.6. Changes to draft-ietf-lisp-rfc6830bis-20 . . . . . . . . 40 + B.7. Changes to draft-ietf-lisp-rfc6830bis-19 . . . . . . . . 41 + B.8. Changes to draft-ietf-lisp-rfc6830bis-18 . . . . . . . . 41 + B.9. Changes to draft-ietf-lisp-rfc6830bis-17 . . . . . . . . 41 + B.10. Changes to draft-ietf-lisp-rfc6830bis-16 . . . . . . . . 41 + B.11. Changes to draft-ietf-lisp-rfc6830bis-15 . . . . . . . . 41 + B.12. Changes to draft-ietf-lisp-rfc6830bis-14 . . . . . . . . 41 + B.13. Changes to draft-ietf-lisp-rfc6830bis-13 . . . . . . . . 42 + B.14. Changes to draft-ietf-lisp-rfc6830bis-12 . . . . . . . . 42 + B.15. Changes to draft-ietf-lisp-rfc6830bis-11 . . . . . . . . 42 + B.16. Changes to draft-ietf-lisp-rfc6830bis-10 . . . . . . . . 42 + B.17. Changes to draft-ietf-lisp-rfc6830bis-09 . . . . . . . . 42 + B.18. Changes to draft-ietf-lisp-rfc6830bis-08 . . . . . . . . 43 + B.19. Changes to draft-ietf-lisp-rfc6830bis-07 . . . . . . . . 43 + B.20. Changes to draft-ietf-lisp-rfc6830bis-06 . . . . . . . . 43 + B.21. Changes to draft-ietf-lisp-rfc6830bis-05 . . . . . . . . 44 + B.22. Changes to draft-ietf-lisp-rfc6830bis-04 . . . . . . . . 44 + B.23. Changes to draft-ietf-lisp-rfc6830bis-03 . . . . . . . . 44 + B.24. Changes to draft-ietf-lisp-rfc6830bis-02 . . . . . . . . 44 + B.25. Changes to draft-ietf-lisp-rfc6830bis-01 . . . . . . . . 44 + B.26. Changes to draft-ietf-lisp-rfc6830bis-00 . . . . . . . . 45 + Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 45 1. Introduction This document describes the Locator/Identifier Separation Protocol (LISP). LISP is an encapsulation protocol built around the fundamental idea of separating the topological location of a network attachment point from the node's identity [CHIAPPA]. As a result LISP creates two namespaces: Endpoint Identifiers (EIDs), that are used to identify end-hosts (e.g., nodes or Virtual Machines) and routable Routing Locators (RLOCs), used to identify network @@ -1196,28 +1197,33 @@ ETR, if acting also as an ITR, will refrain from encapsulating packets to an RLOC that is indicated as down. It will only resume using that RLOC if the corresponding Locator-Status-Bit returns to a value of 1. Locator-Status-Bits are associated with a Locator-Set per EID-Prefix. Therefore, when a Locator becomes unreachable, the Locator-Status-Bit that corresponds to that Locator's position in the list returned by the last Map-Reply will be set to zero for that particular EID-Prefix. Refer to Section 16 for security related issues regarding Locator-Status-Bits. - When an ETR decapsulates a packet, it knows that it is reachable from - the encapsulating ITR because that is how the packet arrived. In - most cases, the ETR can also reach the ITR but cannot assume this to - be true, due to the possibility of path asymmetry. In the presence - of unidirectional traffic flow from an ITR to an ETR, the ITR SHOULD - NOT use the lack of return traffic as an indication that the ETR is - unreachable. Instead, it MUST use an alternate mechanism to - determine reachability. + If an ITR encapsulates a packet to an ETR and the packet is received + and decapsulated by the ETR, it is implied but not confirmed by the + ITR that the ETR's RLOC is reachable. In most cases, the ETR can + also reach the ITR but cannot assume this to be true, due to the + possibility of path asymmetry. In the presence of unidirectional + traffic flow from an ITR to an ETR, the ITR SHOULD NOT use the lack + of return traffic as an indication that the ETR is unreachable. + Instead, it MUST use an alternate mechanism to determine + reachability. + + The security considerations of Section 16 related with data-plane + reachability applies to the data-plane RLOC reachability mechanisms + described in this section. 10.1. Echo Nonce Algorithm When data flows bidirectionally between Locators from different sites, a Data-Plane mechanism called "nonce echoing" can be used to determine reachability between an ITR and ETR. When an ITR wants to solicit a nonce echo, it sets the N- and E-bits and places a 24-bit nonce [RFC4086] in the LISP header of the next encapsulated data packet. @@ -1484,42 +1490,56 @@ o A packet's source address or interface the packet was received on can be used to select VRF (Virtual Routing/Forwarding). The VRF's routing table can be used to find EID-to-RLOC mappings. For performance issues related to Map-Cache management, see Section 16. 16. Security Considerations - A complete LISP threat analysis can be found in [RFC7835] in what - follows we provide a summary when LISP is deployed in non-trustable - environments. + A complete LISP threat analysis can be found in [RFC7835]. In what + follows we highlight security considerations that apply when LISP is + deployed in environments such as those specified in Section 1.1. The optional mechanisms of gleaning is offered to directly obtain a mapping from the LISP encapsulated packets. Specifically, an xTR can learn the EID-to-RLOC mapping by inspecting the source RLOC and source EID of an encapsulated packet, and insert this new mapping into its Map-Cache. An off-path attacker can spoof the source EID address to divert the traffic sent to the victim's spoofed EID. If the attacker spoofs the source RLOC, it can mount a DoS attack by redirecting traffic to the spoofed victim's RLOC, potentially overloading it. The LISP Data-Plane defines several mechanisms to monitor RLOC Data- Plane reachability, in this context Locator-Status Bits, Nonce- Present and Echo-Nonce bits of the LISP encapsulation header can be manipulated by an attacker to mount a DoS attack. An off-path - attacker able to spoof the RLOC of a victim's xTR can manipulate such - mechanisms to declare a set of RLOCs unreachable. This can be used - also, for instance, to declare only one RLOC reachable with the aim - of overload it. + attacker able to spoof the RLOC and/or nonce of a victim's xTR can + manipulate such mechanisms to declare false information about the + RLOC's reachability status. + + As an exmple of such attacks an off-path attacker can exploit the + echo-nonce mechanism by sending data packets to an ITR with a random + nonce from an ETR's spoofed RLOC. Note the attacker must guess a + valid nonce the ITR is requesting to be echoed within a small window + of time. The goal is to convince the ITR that the ETR's RLOC is + reachable even when it may not be reachable. If the attack is + successful, the ITR believes the wrong reachability status of the + ETR's RLOC until RLOC-probing detects the correct status. This time + frame is on the order of 10s of seconds. This specific attack can be + mitigated by preventing RLOC spoofing in the network by deploying + uRPF BCP 38 [RFC2827]. In addition and in order to exploit this + vulnerability, the off-path attacker must send echo-nonce packets at + high rate. If the nonces have never been requested by the ITR, it + can protect itself from erroneious reachability attacks. Map-Versioning is a Data-Plane mechanism used to signal a peering xTR that a local EID-to-RLOC mapping has been updated, so that the peering xTR uses LISP Control-Plane signaling message to retrieve a fresh mapping. This can be used by an attacker to forge the map- versioning field of a LISP encapsulated header and force an excessive amount of signaling between xTRs that may overload them. Most of the attack vectors can be mitigated with careful deployment and configuration, information learned opportunistically (such as LSB @@ -1579,21 +1599,21 @@ 20.1. Normative References [I-D.ietf-lisp-6834bis] Iannone, L., Saucez, D., and O. Bonaventure, "Locator/ID Separation Protocol (LISP) Map-Versioning", draft-ietf- lisp-6834bis-02 (work in progress), September 2018. [I-D.ietf-lisp-rfc6833bis] Fuller, V., Farinacci, D., and A. Cabellos-Aparicio, "Locator/ID Separation Protocol (LISP) Control-Plane", - draft-ietf-lisp-rfc6833bis-17 (work in progress), October + draft-ietf-lisp-rfc6833bis-18 (work in progress), October 2018. [RFC0768] Postel, J., "User Datagram Protocol", STD 6, RFC 768, DOI 10.17487/RFC0768, August 1980, . [RFC0791] Postel, J., "Internet Protocol", STD 5, RFC 791, DOI 10.17487/RFC0791, September 1981, . @@ -1601,20 +1621,25 @@ Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC2474] Nichols, K., Blake, S., Baker, F., and D. Black, "Definition of the Differentiated Services Field (DS Field) in the IPv4 and IPv6 Headers", RFC 2474, DOI 10.17487/RFC2474, December 1998, . + [RFC2827] Ferguson, P. and D. Senie, "Network Ingress Filtering: + Defeating Denial of Service Attacks which employ IP Source + Address Spoofing", BCP 38, RFC 2827, DOI 10.17487/RFC2827, + May 2000, . + [RFC6040] Briscoe, B., "Tunnelling of Explicit Congestion Notification", RFC 6040, DOI 10.17487/RFC6040, November 2010, . [RFC8126] Cotton, M., Leiba, B., and T. Narten, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 8126, DOI 10.17487/RFC8126, June 2017, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC @@ -1813,170 +1838,177 @@ robustness of the LISP architecture and protocols. Appendix B. Document Change Log [RFC Editor: Please delete this section on publication as RFC.] B.1. Changes to draft-ietf-lisp-rfc6830bis-24 o Posted mid October 2018. + o Added more to the Security Considerations section with discussion + about echo-nonce attacks. + +B.2. Changes to draft-ietf-lisp-rfc6830bis-24 + + o Posted mid October 2018. + o Final editorial changes for Eric and Ben. -B.2. Changes to draft-ietf-lisp-rfc6830bis-23 +B.3. Changes to draft-ietf-lisp-rfc6830bis-23 o Posted early October 2018. o Added an applicability statement in section 1 to address security concerns from Telechat. -B.3. Changes to draft-ietf-lisp-rfc6830bis-22 +B.4. Changes to draft-ietf-lisp-rfc6830bis-22 o Posted early October 2018. o Changes to reflect comments post Telechat. -B.4. Changes to draft-ietf-lisp-rfc6830bis-21 +B.5. Changes to draft-ietf-lisp-rfc6830bis-21 o Posted late-September 2018. o Changes to reflect comments from Sep 27th Telechat. -B.5. Changes to draft-ietf-lisp-rfc6830bis-20 +B.6. Changes to draft-ietf-lisp-rfc6830bis-20 o Posted late-September 2018. o Fix old reference to RFC3168, changed to RFC6040. -B.6. Changes to draft-ietf-lisp-rfc6830bis-19 +B.7. Changes to draft-ietf-lisp-rfc6830bis-19 o Posted late-September 2018. o More editorial changes. -B.7. Changes to draft-ietf-lisp-rfc6830bis-18 +B.8. Changes to draft-ietf-lisp-rfc6830bis-18 o Posted mid-September 2018. o Changes to reflect comments from Secdir review (Mirja). -B.8. Changes to draft-ietf-lisp-rfc6830bis-17 +B.9. Changes to draft-ietf-lisp-rfc6830bis-17 o Posted September 2018. o Indicate in the "Changes since RFC 6830" section why the document has been shortened in length. o Make reference to RFC 8085 about UDP congestion control. o More editorial changes from multiple IESG reviews. -B.9. Changes to draft-ietf-lisp-rfc6830bis-16 +B.10. Changes to draft-ietf-lisp-rfc6830bis-16 o Posted late August 2018. o Distinguish the message type names between ICMP for IPv4 and ICMP for IPv6 for handling MTU issues. -B.10. Changes to draft-ietf-lisp-rfc6830bis-15 +B.11. Changes to draft-ietf-lisp-rfc6830bis-15 o Posted August 2018. o Final editorial changes before RFC submission for Proposed Standard. o Added section "Changes since RFC 6830" so implementers are informed of any changes since the last RFC publication. -B.11. Changes to draft-ietf-lisp-rfc6830bis-14 +B.12. Changes to draft-ietf-lisp-rfc6830bis-14 o Posted July 2018 IETF week. o Put obsolete of RFC 6830 in Intro section in addition to abstract. -B.12. Changes to draft-ietf-lisp-rfc6830bis-13 +B.13. Changes to draft-ietf-lisp-rfc6830bis-13 o Posted March IETF Week 2018. o Clarified that a new nonce is required per RLOC. o Removed 'Clock Sweep' section. This text must be placed in a new OAM document. o Some references changed from normative to informative -B.13. Changes to draft-ietf-lisp-rfc6830bis-12 +B.14. Changes to draft-ietf-lisp-rfc6830bis-12 o Posted July 2018. o Fixed Luigi editorial comments to ready draft for RFC status. -B.14. Changes to draft-ietf-lisp-rfc6830bis-11 +B.15. Changes to draft-ietf-lisp-rfc6830bis-11 o Posted March 2018. o Removed sections 16, 17 and 18 (Mobility, Deployment and Traceroute considerations). This text must be placed in a new OAM document. -B.15. Changes to draft-ietf-lisp-rfc6830bis-10 +B.16. Changes to draft-ietf-lisp-rfc6830bis-10 o Posted March 2018. o Updated section 'Router Locator Selection' stating that the Data- Plane MUST follow what's stored in the Map-Cache (priorities and weights). o Section 'Routing Locator Reachability': Removed bullet point 2 (ICMP Network/Host Unreachable),3 (hints from BGP),4 (ICMP Port Unreachable),5 (receive a Map-Reply as a response) and RLOC probing o Removed 'Solicit-Map Request'. -B.16. Changes to draft-ietf-lisp-rfc6830bis-09 +B.17. Changes to draft-ietf-lisp-rfc6830bis-09 o Posted January 2018. o Add more details in section 5.3 about DSCP processing during encapsulation and decapsulation. o Added clarity to definitions in the Definition of Terms section from various commenters. o Removed PA and PI definitions from Definition of Terms section. o More editorial changes. o Removed 4342 from IANA section and move to RFC6833 IANA section. -B.17. Changes to draft-ietf-lisp-rfc6830bis-08 +B.18. Changes to draft-ietf-lisp-rfc6830bis-08 o Posted January 2018. o Remove references to research work for any protocol mechanisms. o Document scanned to make sure it is RFC 2119 compliant. o Made changes to reflect comments from document WG shepherd Luigi Iannone. o Ran IDNITs on the document. -B.18. Changes to draft-ietf-lisp-rfc6830bis-07 +B.19. Changes to draft-ietf-lisp-rfc6830bis-07 o Posted November 2017. o Rephrase how Instance-IDs are used and don't refer to [RFC1918] addresses. -B.19. Changes to draft-ietf-lisp-rfc6830bis-06 +B.20. Changes to draft-ietf-lisp-rfc6830bis-06 o Posted October 2017. o Put RTR definition before it is used. o Rename references that are now working group drafts. o Remove "EIDs MUST NOT be used as used by a host to refer to other hosts. Note that EID blocks MAY LISP RLOCs". @@ -1985,68 +2017,69 @@ o ETRs may, rather than will, be the ones to send Map-Replies. o Recommend, rather than mandate, max encapsulation headers to 2. o Reference VPN draft when introducing Instance-ID. o Indicate that SMRs can be sent when ITR/ETR are in the same node. o Clarify when private addresses can be used. -B.20. Changes to draft-ietf-lisp-rfc6830bis-05 +B.21. Changes to draft-ietf-lisp-rfc6830bis-05 o Posted August 2017. o Make it clear that a Re-encapsulating Tunnel Router is an RTR. -B.21. Changes to draft-ietf-lisp-rfc6830bis-04 +B.22. Changes to draft-ietf-lisp-rfc6830bis-04 o Posted July 2017. o Changed reference of IPv6 RFC2460 to RFC8200. o Indicate that the applicability statement for UDP zero checksums over IPv6 adheres to RFC6936. -B.22. Changes to draft-ietf-lisp-rfc6830bis-03 +B.23. Changes to draft-ietf-lisp-rfc6830bis-03 o Posted May 2017. o Move the control-plane related codepoints in the IANA Considerations section to RFC6833bis. -B.23. Changes to draft-ietf-lisp-rfc6830bis-02 +B.24. Changes to draft-ietf-lisp-rfc6830bis-02 o Posted April 2017. o Reflect some editorial comments from Damien Sausez. -B.24. Changes to draft-ietf-lisp-rfc6830bis-01 +B.25. Changes to draft-ietf-lisp-rfc6830bis-01 o Posted March 2017. o Include references to new RFCs published. o Change references from RFC6833 to RFC6833bis. o Clarified LCAF text in the IANA section. o Remove references to "experimental". -B.25. Changes to draft-ietf-lisp-rfc6830bis-00 +B.26. Changes to draft-ietf-lisp-rfc6830bis-00 o Posted December 2016. o Created working group document from draft-farinacci-lisp -rfc6830-00 individual submission. No other changes made. Authors' Addresses + Dino Farinacci Cisco Systems Tasman Drive San Jose, CA 95134 USA EMail: farinacci@gmail.com Vince Fuller Cisco Systems