Subject: [lisp] On piggyback map rec handling

From: "Rockson Li (zhengyli)" <[email-masked]>
Date: Thu, 4 Jul 2013 06:09:06 +0000

Hello experts,

While going through piggyback map rec handling at sec 6.1.3 of RFC6830

<snip>
   An ITR that is configured with mapping database information (i.e., it
   is also an ETR) MAY optionally include those mappings in a
   Map-Request.  When an ETR configured to accept and verify such
   "piggybacked" mapping data receives such a Map-Request and it does
   not have this mapping in the map-cache, it MAY originate a "verifying
   Map-Request", addressed to the map-requesting ITR and the ETR MAY add
   a Map-Cache entry.  If the ETR has a Map-Cache entry that matches the
   "piggybacked" EID and the RLOC is in the Locator-Set for the entry,
   then it may send the "verifying Map-Request" directly to the
   originating Map-Request source.  If the RLOC is not in the
   Locator-Set, then the ETR MUST send the "verifying Map-Request" to
   the "piggybacked" EID.  Doing this forces the "verifying Map-Request"
   to go through the mapping database system to reach the authoritative
   source of information about that EID, guarding against RLOC-spoofing
   in the "piggybacked" mapping data.
</snip>

I find it describes three scenarios when ETR gets the piggybacked Map records.
1) it does not have this mapping in the map-cache
originate a "verifying Map-Request", addressed to the map-requesting ITR
Question: would the verifying Map-Request sent to the "piggybacked" EID or directly to the ITRs using the one of RLOC in the Map records?
It seems to me we need use EID, as this this is essentially the same as case 3) below.

2) On "If the ETR has a Map-Cache entry that matches the
   "piggybacked" EID and the RLOC is in the Locator-Set for the entry,
   then it may send the "verifying Map-Request" directly to the
   originating Map-Request source. "
3) On "If the RLOC is not in the
   Locator-Set, then the ETR MUST send the "verifying Map-Request" to
   the "piggybacked" EID."

Question: for all the case 1),2),3), do we need to set the "A" bit for the "verifying Map-Request" to avoid RLOC-spoofing?
It seems to me we need do it for case 1) and 3), but not necessary for case 2)

Thanks
Regards,
-Rockson

---

From: Dino Farinacci <[email-masked]>
Date: Fri, 5 Jul 2013 10:48:53 -0700

> Question: would the verifying Map-Request sent to the "piggybacked" EID or directly to the ITRs using the one of RLOC in the Map records?

It can yes.

> It seems to me we need do it for case 1) and 3), but not necessary for case 2)

The A-bit is just telling the receiver of the message that the ETR itself is replying versus the mapping system which may send a proxy-reply (i.e. a map-server sending the Map-Reply).

The way you avoid RLOC spoofing is the same way you avoid any source spoofing which is by use of uRPF operationally.

Dino

> 
> Thanks
> Regards,
> -Rockson
> 
> _______________________________________________
> lisp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/lisp

---

From: "Rockson Li (zhengyli)" <[email-masked]>
Date: Mon, 8 Jul 2013 01:10:31 +0000

Dino,

Are you saying the it's up to ETR to select the either way to go?
I think this is confusing, the case 1) is very similar to case 3),
Why the rfc says "then the ETR MUST send the "verifying Map-Request" to
   the "piggybacked" EID. " but not for case 3)

Thanks
Regards,
-Rockson

On 7/6/13 1:48 AM, "Dino Farinacci" <[email-masked]> wrote:

>>Question: would the verifying Map-Request sent to the "piggybacked" EID
>>or directly to the ITRs using the one of RLOC in the Map records?
>
>It can yes.

---

From: Dino Farinacci <[email-masked]>
Date: Mon, 8 Jul 2013 09:41:38 -0700

> Are you saying the it's up to ETR to select the either way to go?

Well the ETR is getting information from an ITR. If it wants to believe the information, it has the right to. But if it wants to verify the information, it should be able to as well.

> I think this is confusing, the case 1) is very similar to case 3),

It is not confusing. Here is an example Rockson:

(1) You are sending me an email.
(2) I choose to believe it is from you.
(3) This email could be from Darrel. I really don't know.

But my policy is to be on the honor system.

>   the "piggybacked" EID. " but not for case 3)

We had to negotiate RFC language with the working group.

Dino