RE: Gen-ART review of draft-ietf-bfd-mib-17

"Nobo Akiya (nobo)" <nobo@cisco.com> Thu, 17 April 2014 21:18 UTC

Return-Path: <nobo@cisco.com>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E519A1A0168; Thu, 17 Apr 2014 14:18:40 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -114.773
X-Spam-Level:
X-Spam-Status: No, score=-114.773 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.272, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_WHITELIST=-100] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w6XFA6VeeC2l; Thu, 17 Apr 2014 14:18:34 -0700 (PDT)
Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by ietfa.amsl.com (Postfix) with ESMTP id 135CD1A0054; Thu, 17 Apr 2014 14:18:34 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=6800; q=dns/txt; s=iport; t=1397769510; x=1398979110; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=hLKYK5Tid4Oymx7mWHA3JWXrFKs8DPKGdfamuUTiTOw=; b=ONWRRAQZXfZt/cLeHmsVHE371nt7WfIarDx/E8judYe+J8CvEXPeaSaQ M/UEDFThlYNkKA+k2V0PcXFLBos4irsS/R4YWyhmQxZqkIN4SRKCtdTA+ c7ROZAx4hwCEYcvDX6gAYGLbe6lZlop1N0n6XDWi6i0lJu+NHON9uhUVg 4=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AgUFAGNEUFOtJA2K/2dsb2JhbABWA4JlITtXw2eBJxZ0giUBAQEDAXkMBAIBCBEDAQEBCx0HMhQJCAEBBAENBQgBh2sIAQzMHBeMb4FCIRACBQYLgxOBFASIdDaLVoUlkRaDMYIr
X-IronPort-AV: E=Sophos;i="4.97,881,1389744000"; d="scan'208";a="318644398"
Received: from alln-core-5.cisco.com ([173.36.13.138]) by rcdn-iport-4.cisco.com with ESMTP; 17 Apr 2014 21:18:30 +0000
Received: from xhc-rcd-x15.cisco.com (xhc-rcd-x15.cisco.com [173.37.183.89]) by alln-core-5.cisco.com (8.14.5/8.14.5) with ESMTP id s3HLITFG025344 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Thu, 17 Apr 2014 21:18:29 GMT
Received: from xmb-aln-x01.cisco.com ([fe80::747b:83e1:9755:d453]) by xhc-rcd-x15.cisco.com ([173.37.183.89]) with mapi id 14.03.0123.003; Thu, 17 Apr 2014 16:18:29 -0500
From: "Nobo Akiya (nobo)" <nobo@cisco.com>
To: "Black, David" <david.black@emc.com>, "tnadeau@lucidvision.com" <tnadeau@lucidvision.com>, "Zafar Ali (zali)" <zali@cisco.com>, "General Area Review Team (gen-art@ietf.org)" <gen-art@ietf.org>
Subject: RE: Gen-ART review of draft-ietf-bfd-mib-17
Thread-Topic: Gen-ART review of draft-ietf-bfd-mib-17
Thread-Index: Ac9Zy+Zk0qHspTLsTUq2+7kL82/PpAAiJosQ
Date: Thu, 17 Apr 2014 21:18:28 +0000
Message-ID: <CECE764681BE964CBE1DFF78F3CDD3941E10B9F3@xmb-aln-x01.cisco.com>
References: <8D3D17ACE214DC429325B2B98F3AE712076C2EC24D@MX15A.corp.emc.com>
In-Reply-To: <8D3D17ACE214DC429325B2B98F3AE712076C2EC24D@MX15A.corp.emc.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [161.44.212.138]
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/ietf/ICtj5Qc8_GVY_j-lxpygE53kGlY
Cc: "rtg-bfd@ietf.org" <rtg-bfd@ietf.org>, "ietf@ietf.org" <ietf@ietf.org>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 17 Apr 2014 21:18:41 -0000

Hi David,

Thank you for thorough review of this document.
Please see replies in-line.

> -----Original Message-----
> From: Black, David [mailto:david.black@emc.com]
> Sent: Wednesday, April 16, 2014 7:31 PM
> To: tnadeau@lucidvision.com; Zafar Ali (zali); Nobo Akiya (nobo); General
> Area Review Team (gen-art@ietf.org)
> Cc: rtg-bfd@ietf.org; ietf@ietf.org; Black, David
> Subject: Gen-ART review of draft-ietf-bfd-mib-17
> 
> I am the assigned Gen-ART reviewer for this draft. For background on Gen-
> ART, please see the FAQ at
> 
> <http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq>.
> 
> Please resolve these comments along with any other Last Call comments
> you may receive.
> 
> Document: draft-ietf-bfd-mib-17
> Reviewer: David L. Black
> Review Date: April 16, 2014
> IETF LC End Date: April 28, 2014
> 
> Summary: This draft is on the right track, but has open issues
> 		described in the review.
> 
> This draft is a MIB module for the BFD protocol, which is an important low-
> level routing protocol.  The draft is reasonable for a MIB draft; one needs to
> go read the protocol documents to understand how the protocol works, and
> significant portions of the text are derived from the usual MIB "boilerplate"
> as one would expect.  The "Brief Description of MIB Objects" is indeed brief,
> but reasonable.  The shepherd writeup indicates that there are multiple
> implementations.
> 
> Major issues:
> 
> This MIB contains many writable objects, so the authors should take note of
> the IESG statement on writable MIB modules:
> 
> 	http://www.ietf.org/iesg/statement/writable-mib-module.html
> 
> I did not see this mentioned in the shepherd writeup.  If the OPS Area has
> not been consulted, I strongly suggest doing so during IETF Last Call, e.g.,
> starting with Benoit Claise (AD).

I remember seeing the statement from IESG, which I agree is a good direction for new charter items. [This] BFD MIB, on the other hand, is almost 10 years old, with several implementations already around. I highly suspect the WG will not want to see *change of direction* at this point. With that said, let me take this up with the AD and the Shepherd.

> 
> Minor issues:
> 
> The security considerations section includes considerations for
> unauthorized modification of bfdSessAdminStatus and bfdSessOperStatus,
> but omits the corresponding considerations for bfdAdminStatus and
> bfdSessNotificationsEnable.  Both of the latter objects are global, so
> significant damage can be inflicted via these objects with a small number of
> unauthorized modifications, so they need to be included in the first list of
> sensitive objects.

Good point. I will add bfdAdminStatus and bfdOperStatus in the security considerations section.

> 
> I suggest that the authors recheck the entire MIB to ensure that every object
> or table that should be included in the security considerations section is
> appropriately included.

I've gone through them. There are set of objects which really should not be modified once a session is functioning. I've added this in the security considerations section.

   o  Some management objects define the BFD session whilst other
      management objects define the parameter of the BFD session.  It is
      particularly important to control the support for SET access to
      those management objects that define the BFD session, as changes
      to them can be disruptive.  Implementation SHOULD NOT allow
      changes to following management objects when bfdSessState is
      up(4):

      *  bfdSessVersionNumber
      *  bfdSessType
      *  bfdSessDestinationUdpPort
      *  bfdSessMultipointFlag
      *  bfdSessInterface
      *  bfdSessSrcAddrType
      *  bfdSessSrcAddr
      *  bfdSessDstAddrType
      *  bfdSessDstAddr

> 
> Also, as a General Variable, would bfdSessNotificationsEnable be better
> named bfdNotificationsEnable, as it's not in the BFD Session Table?

That's true. Renamed as suggested.

> 
> I did not see a compliance requirement for a system that only implements
> BFD protocol version 0.  That absence should at least be mentioned
> somewhere.  For example, if this reflects a considered and deliberate
> decision by the WG, that should be mentioned in the introduction.

Good point. If I remember correctly, BFD version 0 had a problem in the state machine that can cause the two ends to fall into a deadlock. It would be, therefore, very bad for anybody to have BFD version 0 deployed out there, and asking for any MIB compliance requirement for such. Consensus on absence of compliance requirement for BFD version 0 was never polled in the WG, but I can say that there shouldn't be any desire for that.

I will add a short statement on lack of BFD version 0 compliance requirement in the introduction section, as you suggested.

> 
> Nits/editorial comments:
> 
> In the security considerations for authentication-related objects:
> 
> OLD
>    In order for these sensitive information
>    from being improperly accessed, implementers MAY wish to disallow
>    access to these objects.
> NEW
>    In order to prevent this sensitive information
>    from being improperly accessed, implementers MAY disallow
>    access to these objects.

Thanks for the text. Updated in local copy.

> 
> idnits 2.13.01 found a truly minor nit that should be corrected when the
> draft is next revised:
> 
>   == Outdated reference: A later version (-05) exists of
>      draft-ietf-bfd-tc-mib-04

Agree, non-issue.

> 
> it also generated a warning that probably does not reflect an actual
> problem:
> 
>   -- The document seems to lack a disclaimer for pre-RFC5378 work, but may
>      have content which was first submitted before 10 November 2008.  If you
>      have contacted all the original authors and they are all willing to grant
>      the BCP78 rights to the IETF Trust, then this is fine, and you can ignore
>      this comment.  If not, you may need to add the pre-RFC5378 disclaimer.
>      (See the Legal Provisions document at
>      http://trustee.ietf.org/license-info for more information.)

Agree, non-issue.

Thanks again!

-Nobo

> 
> Thanks,
> --David
> ----------------------------------------------------
> David L. Black, Distinguished Engineer
> EMC Corporation, 176 South St., Hopkinton, MA  01748
> +1 (508) 293-7953             FAX: +1 (508) 293-7786
> david.black@emc.com        Mobile: +1 (978) 394-7754
> ----------------------------------------------------