[bess] Secdir last call review of draft-ietf-bess-evpn-irb-mcast

[tirumal reddy <[e-mail]>]

Hi,

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written with the intent of improving security requirements
and considerations in IETF drafts.  Comments not addressed in the last call
may be included in AD reviews during the IESG review.  Document editors and
WG chairs should treat these comments just like any other last call
comments.

Reviewer: Tirumaleswar Reddy
Review result:  Ready with issues

Summary:

The document covers the procedure for multicast advertisement and
forwarding among BDs.
I don't see any major security issues presented in the security
considerations and I I have the following comments :

   This document uses protocols and procedures defined in the normative
   references, and inherits the security considerations of those
   references.

Comment> I suggest adding more details to how the security considerations
in the normative references are applicable to this draft.

   Incorrect addition, removal, or modification of those
   flags and/or ECs will cause the procedures defined herein to
   malfunction, in which case loss or diversion of data traffic is
   possible.

Comment> The above text discusses the attacks but not possible
mitigations. Please add more details on how the above attack can be
prevented.

Cheers,
-Tiru