Subject: Re: [lisp] EID Address space

From: [email-masked] (Noel Chiappa)
Date: Tue, 24 May 2011 16:15:32 -0400 (EDT)

> From: Ronald Bonica <[email-masked]>

    > I realize that the ETR, MS and the upstream all need to be
    > misconfigured (or as you say, compromised) for this to happen. But
    > isn't that easy to do?

I don't know about 'easy' - 'possible', yes.

Sure, in the long run, if LISP becomes widespread, it would be desirable
to plug this hole (preferably with a crypto-based authorization system
rooted at the namespace allocation authority), but with limited time and
manpower (unless Juniper wants to donate a big chunk :-), there are
probably a lot of other things to work on before that gets to the top of
the list.

    > I assume that the owner of the ETR configures the ETR and sends
    > registrations to the control infrastructure. How does the control
    > infrastructure know that the registration is bogus?

Now you're talking operational - I don't do operational! :-)

But to be serious, that sort of configuration/management issue is really a bit
outside the scope of a protocol spec, no? (Does the BGP spec define how to
stop a national ISP from 'black-holing' a major content site because that
nation's government is peeved at said content provider?)

	Noel

---

From: Ronald Bonica <[email-masked]>
Date: Tue, 24 May 2011 16:28:14 -0400

Hi Noel,

> Now you're talking operational - I don't do operational! :-)

I confess, me neither ;-)

> nation's government is peeved at said content provider?)

We may don't need to solve the problem today, but we do need to demonstrate that a solution is possible. If a central authority is unavaoidable, we should probably own up to that on day one.

                                        Ron