Re: [Isis-wg] Stephen Farrell's No Objection on draft-ietf-isis-extended-sequence-no-tlv-05: (with COMMENT)

[Uma Chunduri <[e-mail]>]

Hi Stephen,

Thanks for your comments. In-line [Uma]:

-----Original Message-----
From: Stephen Farrell [mailto:[e-mail]] 
Sent: Tuesday, April 21, 2015 9:14 AM
To: The IESG
Cc: [e-mail]; [e-mail]; [e-mail]; [e-mail]; [e-mail]; [e-mail]
Subject: Stephen Farrell's No Objection on draft-ietf-isis-extended-sequence-no-tlv-05: (with COMMENT)

Stephen Farrell has entered the following ballot position for
draft-ietf-isis-extended-sequence-no-tlv-05: No Objection

When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.)


Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-isis-extended-sequence-no-tlv/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------


- last para of section 5 (before 5.1) could do with a bit of a re-write, it's not very clear.
[Uma]: Still working with Ben on this to address  his comment and shall confirm with you too after the change to see if it is any better.

- section 7: When this mechanism is used, can an attacker who can delete or re-order packets (which is v. similar to one who can replay
packets) cause any new bad outcomes due to the verification of the out-of-order arrival? (Sorry, I don't know IS-IS enough to know the answer there, it's probably obvious.) If so, then maybe that argues that one ought note that this doesn't address such threats (but that this is still I guess worthwhile).

[Uma]: Out of ordered packets with lower sequence numbers would naturally be discarded by the receiving node. In that sense this feature actually helps for some 
                IS-IS PDUs where there is no  mechanism in place before this doc. But if the packets are deleted/not-forwarded then this mechanism can't mitigate  the situation. 
                This is kind of documented in https://tools.ietf.org/html/rfc6862#section-3.3 , I can state this particular aspect and refer the same in Section 7. 
               Does this address your concern? Thx!