Re: WG LC: draft-ietf-l3vpn-2547bis-mcast

[Thomas Morin <[e-mail]>]

Hi Eric,

Eric Rosen :
> > Indeed there is no valid semantic for S-PMSI Join packets received from
> > a CE.  But a wrong semantic can very easily be given to such packets by
> > a implementation not having been carefully written in this respect,
> 
> Implementation  errors which cause  packets to  be processed  with incorrect
> semantics can  cause a variety of  problems.  However, we  cannot expect the
> security   considerations  section   to  list   all  the   things   that  an
> implementation could possibly get wrong.

Of course. But among all the things that an implementation can get
wrong, not all of them are likely, not all are security issues, and few
or them are both.  So, if there happens to be one thing that is easy to
get wrong (and that actually happened in the past) and has significant
impact on security, it seems wise to raise a warning.


> However, if it makes you happy, I suppose we could replace:
> 
>    If one uses the UDP-based protocol for switching to S-PMSI (as
>    specified in Section 7.2.1), then by default each PE router MUST
>    install packet filters that would result in discarding all UDP
>    packets with the destination port 3232 that the PE router receives
>    from the CE routers connected to the PE router.
> 
> with
> 
>    The S-PMSI  Join messages  defined in section  7.4.2 are valid  only when
>    received over a PMSI, and MUST NOT be processed in other contexts.

This is "less wrong" than previous wording, but I think that it does not
yet restrict things enough in the light of past issues.

I would propose:

     The S-PMSI  Join messages  defined in section  7.4.2 are valid 
     only when received over an MI-PMSI, and with a destination address
     of ALL-PIM-ROUTERS, and MUST NOT be processed in other contexts.

Ideally, I think it would be good to add some text to explain (a) why
this is a MUST NOT and (b) why this is expected to prevent illegitimate
S-PMSI Join packets sent by a CE to be processed by a PE (*because*
messages sent to the ALL-PIM-ROUTERS address are link local and *not*
forwarded). Tell me if you want text for this.

Thanks,

-Thomas