diff --git a/draft-ymbk-idr-l3nd.xml b/draft-ymbk-idr-l3nd.xml index ce99388..86607fc 100644 --- a/draft-ymbk-idr-l3nd.xml +++ b/draft-ymbk-idr-l3nd.xml @@ -11,7 +11,7 @@ - + @@ -389,7 +389,7 @@
@@ -397,27 +397,18 @@ 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -| Version = 0 | PDU Type = 0 | Payload Length = 3 ~ +| Version = 0 | PDU Type = 0 | Payload Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -~ | Flags | Port ~ +| | Transport | Flags | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -~ | -+-+-+-+-+-+-+-+-+ - -Flags (bit): - 0 - 0 Raw TCP, 1 TLS - 1 - 0 Self-Signed Cert for TLS, 1 CA-based +| Port | ++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- The Payload Length is 3 to cover the Flags and Port fields. + The Payload Length is 4 to cover the Transport, Flags, and Port + fields. - The Port is the two octet TCP Port Number (default is TBD3) on - which the HELLO sender MUST have a waiting TLS/TCP (as specified in - Flags) server listening. Though the IANA assigned well-known port - SHOULD be used, this field allows configuration of alternate - ports. - The IPv4 UDP packets are sent to the IPv4 link local multicast address (TBD1) and the IPv6 UDP packets are sent to an IPv6 link Local multicast address (TBD2). See for why @@ -447,7 +438,8 @@ Flags (bit): and network noise and adjust the inter-HELLO timer accordingly. By default, GTSM, , SHOULD be enabled to - test that a received HELLO MUST be on the local link. It MAY be + test that a received HELLO MUST be on the local link; thus leaving + no middle on which a monkey in the middle might stand. It MAY be disabled by configuration. GTSM check failures SHOULD be logged, though with rate limiting to keep from overwhelming logs. @@ -466,15 +458,74 @@ Flags (bit): A device with a TLS/TCP listener SHOULD log or otherwise report repeated failed inbound attempts. +
+ + The Transport signals the type of transport security for the + session. + + The actual transport options are actually pre-configured in the + devices by provisioning, as most require certificates etc. It is + best to think of this field as in-band signaling to conform the + correctness of the pre-configurations. Any disagreements MUST BE + considered to indicate an error condition and brought to the + attention of the operator. + + The Transport field is an enumeration with the following values: + + + TLS is not used. + TLS using a self-signed server + certificate. + TLS using a CA-Based server + certificate, with no IP address extension. + TLS using a CA-Based server + certificate, with the server's IP address in the subject + alternative name extension (see + Section 4.2.1.6). + Reserved. + + + + If server certificates are to be used, they may be locally + generated and then signed by a CA or generated by the CA and + loaded. See . + +
+ +
+ + Though the Working Group scope for this protocol is within a + data center, an issue was raised that, on an internet echange with + route server(s), it would attempt to form adjacencies with all + members of the exchange. Hence a Flag field is provided to + indicate that a device does not intend to field a TLS/TCP server + on the announcing interface, but does seek one or more from + peers. + + Currently, only one Flags field is defined + + + This interface does not + provide a TLS/TCP server. + Reserved. + + + +
+ +
+ + The Port is the two octet TCP Port Number (default is TBD3) on + which the HELLO sender SHOULD have a waiting TLS/TCP (as specified + in Flags) server listening unless the Client Only Flag is set. + Though the IANA assigned well-known port SHOULD be used, this + field allows configuration of alternate ports. + +
- If the receiver of a HELLO does not agree with the sender's - choice of TLS/TCP or does not agree with the verification choice, - Self-Signed or CA-based, the receiver SHOULD respond with a HELLO - specifying its preferences. - As it is assumed that the configured deployment of a data center would have compatible parameters on all devices, any disagreement over TLS/TCP or trust anchors MUST be logged; with rate limiting of @@ -1284,13 +1335,7 @@ Flags (bit):
- Many kind people helped with the Layer-2 cousin of this protocol, - L3DL. Cristel Pelsser provided multiple reviews, Harsha Kovuru - commented during implementation, Jeff Haas reviewed and commented, - Joerg Ott did an early but deep transport review, Joe Clarke - provided a useful ops review, John Scudder a deeply serious review - and comments, Martijn Schmidt contributed, and Neeraj Malhotra - reviewed. + The authors thank Ben Maddison and Jeff Haas.
@@ -1304,9 +1349,10 @@ Flags (bit): - + +