Re: [Isis-wg] WG Last Call for for draft-ietf-isis-pcr

Hi Eric,

Thank you very much for your review and comments!

On 9/2/2015 9:39 PM, Eric Gray wrote:
>
> Authors,
>
> I have the following comments on the draft…
>
> We start section 4 with the statement: “An explicit tree is determined 
> by a Path Computation
>
> Element (PCE) …”
>
> I believe that explicit trees may be determined without using a PCE, 
> even if we might prefer
>
> to use a PCE.  One could, for example, construct one on paper.
>
I agree.

>
> I suspect we could say:
>
> -“Explicit trees may be determined in some fashion.  For example, an 
> explicit tree may be
>
> determined by a Path Computation Element (PCE) [_RFC4655_].  A PCE is 
> an entity that is
>
> capable of computing a topology for forwarding based on a network 
> topology, its
>
> corresponding attributes, and potential constraints.  If a PCE is 
> used, it MUST explicitly
>
> describe a forwarding tree as described in _Section 6.1_.  Either a 
> single PCE or multiple
>
> PCEs determine explicit trees for a domain.  Even if there are 
> multiple PCEs in a domain,
>
> each explicit tree MUST be determined only by one PCE, which is 
> referred to as the owner
>
> PCE of that tree.  PCEs and IS-IS PCR can  be used in combination with 
> IS-IS shortest path
>
> bridging.
>
> “The remainder of this section, and subsequent sections, are written 
> assuming PCE use.”
>
> A few minor points (reflected in the above re-wording):
>
> -“MUST be only determined by one PCE” is awkward (implies everything 
> else has to be done by
>
> another PCE).
>
> -“SPB shortest path routing” is either redundant or incorrect.
>
> -It would  be very difficult to re-write the section to avoid 
> dependence on PCE, but I suspect a
>
> statement to the effect that PCE is assumed will allow it to be read 
> without loss of generality.
>
> -I left out the bit about not being required to follow shortest path 
> as this seems obvious.
>
I agree with the wording you propose.
I will update the text according to your proposal if there are no 
further comments on it.

> I am not sure how the second paragraph in the security considerations 
> section is related to security, as
>
> it is currently worded.
>
> As I understand it, the issue that the paragraph aims to address has 
> to do with a vulnerability that may
>
> exist when multiple PCEs are used and may be independently managed.  
> In particular, the */importance/*
>
> parameter could be used maliciously by one PCE to ensure that it gets 
> reservations.
>
> This is simply one variation of a general PCE issue; an independently 
> managed, non-cooperating PCE is
>
> indistinguishable from a */PCE impersonation/* (in the sense used in 
> the Security Considerations section of
>
> RFC 4655).
>
I agree with your points.
I agree that referring to PCE security considerations of RFC 4655 is 
missing; and adding it makes the security considerations more generic 
and thus covering the particular case pointed on in the current version.

> We may want to consider replacing the current second paragraph with 
> the following two paragraphs.
>
> Any mechanism that chooses forwarding paths, and allocates resources 
> to those paths, is potentially
>
> vulnerable to attack.  The security considerations section of RFC 4655 
> describes the risks associated
>
> with the use of PCE for this purpose and should be referred to. Use of 
> any other means to determine
>
> paths should only be used after considering similar concerns.
>
> Because the mechanism assumed for distributing tree information relies 
> on IS-IS routing, IS-IS routing
>
> security considerations (Section 6, RFC 1195) and mechanisms (e.g. – 
> RFC 5310)  used to authenticate
>
> peer advertisements apply.
>
I will replace the second paragraph with these ones you suggested if 
there are no further comments.

Thank you and regards,
Janos

> --
>
> Eric
>
> *Subject: *
>
> 	
>
> [Isis-wg] WG Last Call for for draft-ietf-isis-pcr
>
> *Date: *
>
> 	
>
> Mon, 24 Aug 2015 09:54:27 -0400
>
> *From: *
>
> 	
>
> Christian Hopps <chopps@chopps.org> <mailto:chopps@chopps.org>
>
> *To: *
>
> 	
>
> ISIS-WG <isis-wg@ietf.org> <mailto:isis-wg@ietf.org>
>
> *CC: *
>
> 	
>
> Hannes Gredler <hannes@gredler.at> <mailto:hannes@gredler.at>
>
> Hi Folks,
>   
> We are starting a WG Last Call on the following draft.
>   
> “IS-IS Path Computation and Reservation”
> https://datatracker.ietf.org/doc/draft-ietf-isis-pcr/
>   
> The LC is set to expire 3 weeks from now (allowing for common vacation
> time) on Monday, September 14, 2015.
>   
> Thanks,
> Chris & Hannes.
>   
> _______________________________________________
> Isis-wg mailing list
> Isis-wg@ietf.org  <mailto:Isis-wg@ietf.org>
> https://www.ietf.org/mailman/listinfo/isis-wg
>