Re: [CCAMP] Alvaro Retana's No Objection on draft-ietf-ccamp-ospf-availability-extension-10: (with COMMENT)

[Alvaro Retana <[e-mail]>]

On Wed, Oct 11, 2017 at 10:48 PM, Yemin (Amy) <[e-mail]> wrote:

Amy:

Hi!

> 3) Where is this signaling defined?  How does a node know that others
> support the Availability ISCD/LSA?
>
>
>
> The Interface Switching Capability Descriptor (ISCD) allows routing
> protocols such as OSPF and ISIS to carry technology specific information in
> the Switching Capability-specific information (SCSI) field.
>
> If a node received the Availability in the ISCD, it knows that the sender
> support Availability.
>
Please add something like that, or point to the appropriate document.


>  4) Security Considerations, how about change the text as following:
>
>
>
> This document extends [RFC4203].  As with [RFC4203], it specifies the
> content of an Opaque LSAs in OSPFv2. As Opaque LSAs are not used for
> Shortest Path First (SPF) computation or normal routing, the extensions
> specified here have no direct effect on IP routing. Tampering with GMPLS
> TE LSAs may have an impact on the ability to set up connections in the
> underlying data plane network. Mechanisms such as [RFC2154] and [RFC5304]
> to protect the transmission of this information are suggested. As the
> additional availability information may represent information that an
> operator may wish to keep private, consideration should be given to
> securing this information. [RFC3630] notes that the security mechanisms
> described in [RFC2328] apply to Opaque LSAs carried in OSPFv2. An analysis
> of the security of OSPF is provided in [RFC6863] and applies to the
> extensions to OSPF as described in this document. Any new mechanisms
> developed to protect the transmission of information carried in Opaque LSAs
> will also automatically protect the extensions defined in this document.
>
>
The text above (1) still says that the extensions have no direct effect on
IP routing, and (2) don't address that threat.  I think that the threat
with tampering may not just impact the ability to set up a connection, but
it may cause routing not to be correct: use a congested path or follow a
path with not enough bw, etc..  It shouldn't result in 100% lost traffic,
but the routing could definitely be suboptimal.

Thanks!

Alvaro.