Re: [Lsr] I-D Action: draft-ietf-lsr-pce-discovery-security-support-02.txt

Qin Wu <bill.wu@huawei.com> Fri, 01 November 2019 06:18 UTC

Return-Path: <bill.wu@huawei.com>
X-Original-To: lsr@ietfa.amsl.com
Delivered-To: lsr@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0D570120059 for <lsr@ietfa.amsl.com>; Thu, 31 Oct 2019 23:18:51 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.2
X-Spam-Level:
X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j7Q6CSDIUFxw for <lsr@ietfa.amsl.com>; Thu, 31 Oct 2019 23:18:48 -0700 (PDT)
Received: from huawei.com (lhrrgout.huawei.com [185.176.76.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B1D3812001E for <lsr@ietf.org>; Thu, 31 Oct 2019 23:18:47 -0700 (PDT)
Received: from lhreml704-cah.china.huawei.com (unknown [172.18.7.108]) by Forcepoint Email with ESMTP id 9A267A12725E6F9AE221 for <lsr@ietf.org>; Fri, 1 Nov 2019 06:18:45 +0000 (GMT)
Received: from lhreml711-chm.china.huawei.com (10.201.108.62) by lhreml704-cah.china.huawei.com (10.201.108.45) with Microsoft SMTP Server (TLS) id 14.3.408.0; Fri, 1 Nov 2019 06:18:44 +0000
Received: from lhreml711-chm.china.huawei.com (10.201.108.62) by lhreml711-chm.china.huawei.com (10.201.108.62) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1713.5; Fri, 1 Nov 2019 06:18:45 +0000
Received: from DGGEML423-HUB.china.huawei.com (10.1.199.40) by lhreml711-chm.china.huawei.com (10.201.108.62) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.1.1713.5 via Frontend Transport; Fri, 1 Nov 2019 06:18:44 +0000
Received: from DGGEML511-MBX.china.huawei.com ([169.254.1.72]) by dggeml423-hub.china.huawei.com ([10.1.199.40]) with mapi id 14.03.0439.000; Fri, 1 Nov 2019 14:18:41 +0800
From: Qin Wu <bill.wu@huawei.com>
To: "Les Ginsberg (ginsberg)" <ginsberg@cisco.com>, "lsr@ietf.org" <lsr@ietf.org>
Thread-Topic: I-D Action: draft-ietf-lsr-pce-discovery-security-support-02.txt
Thread-Index: AdWQe1Hd+VixnHXkRPCLcOMwHZgang==
Date: Fri, 1 Nov 2019 06:18:41 +0000
Message-ID: <B8F9A780D330094D99AF023C5877DABAA93C1C07@dggeml511-mbx.china.huawei.com>
Accept-Language: zh-CN, en-US
Content-Language: zh-CN
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.134.31.203]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-CFilter-Loop: Reflected
Archived-At: <https://mailarchive.ietf.org/arch/msg/lsr/2NLfk58d5mGtN6maRzGYyaJAq5c>
Subject: Re: [Lsr] I-D Action: draft-ietf-lsr-pce-discovery-security-support-02.txt
X-BeenThere: lsr@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Link State Routing Working Group <lsr.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lsr>, <mailto:lsr-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/lsr/>
List-Post: <mailto:lsr@ietf.org>
List-Help: <mailto:lsr-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lsr>, <mailto:lsr-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 01 Nov 2019 06:18:51 -0000

Les:
-----邮件原件-----
发件人: Les Ginsberg (ginsberg) [mailto:ginsberg@cisco.com] 
发送时间: 2019年9月30日 12:34
收件人: Qin Wu <bill.wu@huawei.com>;; lsr@ietf.org
主题: RE: I-D Action: draft-ietf-lsr-pce-discovery-security-support-02.txt

Qin -

Apologies for the tardy response. I was on vacation when you sent the update - and it has taken me a while to catch up.

I would agree with Adrian that the new version is a significant improvement - but there are still two points of concern for me.

1)Although you now mention the restrictions in RFC 5088/5089 against further IGP extensions, you do not reinforce that this restriction should still be considered to be in place after the allowance of the two additional exceptions. Something to the effect:

OLD

" Section 4 of [RFC5089] states that no new sub-TLVs will be added to
   the PCED TLV, and no new PCE information will be carried in the
   Router CAPABLITY TLV.  This document updates [RFC5089] by allowing
   the two new sub-TLVs defined in this document to be carried in the
   PCED TLV of the for use in the Router CAPABILITY TLV."

NEW

" Section 4 of [RFC5089] states that no new sub-TLVs will be added to
   the PCED sub-TLV, and no new PCE information will be carried in the
   Router CAPABLITY TLV.  This document updates [RFC5089] by allowing
   the two new sub-TLVs defined in this document to be carried in the
   PCED TLV of the for use in the Router CAPABILITY TLV. The introduction of
  the additional sub-TLVs should be viewed as an exception to the [RFC5089] policy
  justified by the need to know the new information prior to establishing a PCEP session.
  The restrictions defined in  [RFC5089] should still
  be considered  to be in place."
[Qin]: The proposed change looks good, I think it also applies to new TLV for OSPF. So I will tweak a little bit the text your proposed, thanks.
2)I still do not know what position the PCE WG has regarding this work.
[Qin]: If you followed discussion in last PCE WG, I presented this draft in PCE session in Montreal, PCE chair agreed to remove such restriction on RFC5089.
Based on this agreement, Adrian responded to my email raised on the lsr list and suggest not open door to new future extension. Your proposed text perfectly
close the door, thanks.
Hope this clarifies.

   Les


> -----Original Message-----
> From: Lsr <lsr-bounces@ietf.org>; On Behalf Of Qin Wu
> Sent: Tuesday, September 03, 2019 4:03 AM
> To: lsr@ietf.org
> Subject: Re: [Lsr] I-D Action: 
> draft-ietf-lsr-pce-discovery-security-support-
> 02.txt
> 
> The v-02 is posted to address remaining comments on the list, thanks 
> Adrain, Aijun, Les for comments and input.
> The diff is:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-lsr-pce-discovery-securit
> y-
> support-02
> 
> -Qin
> -----邮件原件-----
> 发件人: I-D-Announce [mailto:i-d-announce-bounces@ietf.org] 代表
> internet-drafts@ietf.org
> 发送时间: 2019年9月3日 18:58
> 收件人: i-d-announce@ietf.org
> 抄送: lsr@ietf.org
> 主题: I-D Action: draft-ietf-lsr-pce-discovery-security-support-02.txt
> 
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Link State Routing WG of the IETF.
> 
>         Title           : IGP extension for PCEP security capability support in the PCE
> discovery
>         Authors         : Diego R. Lopez
>                           Qin Wu
>                           Dhruv Dhody
>                           Michael Wang
>                           Daniel King
> 	Filename        : draft-ietf-lsr-pce-discovery-security-support-02.txt
> 	Pages           : 9
> 	Date            : 2019-09-03
> 
> Abstract:
>    When a Path Computation Element (PCE) is a Label Switching Router
>    (LSR) participating in the Interior Gateway Protocol (IGP), or even a
>    server participating in IGP, its presence and path computation
>    capabilities can be advertised using IGP flooding.  The IGP
>    extensions for PCE discovery (RFC 5088 and RFC 5089) define a method
>    to advertise path computation capabilities using IGP flooding for
>    OSPF and IS-IS respectively.  However these specifications lack a
>    method to advertise PCEP security (e.g., Transport Layer
>    Security(TLS), TCP Authentication Option (TCP-AO)) support
>    capability.
> 
>    This document proposes new capability flag bits for PCE-CAP-FLAGS
>    sub-TLV that can be announced as attribute in the IGP advertisement
>    to distribute PCEP security support information.  In addition, this
>    document updates RFC 5088 and RFC 5089 to allow advertisement of Key
>    ID or Key Chain Name Sub-TLV to support TCP AO security capability.
> 
> 
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-lsr-pce-discovery-security
> -
> support/
> 
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-ietf-lsr-pce-discovery-security-supp
> ort-02
> https://datatracker.ietf.org/doc/html/draft-ietf-lsr-pce-discovery-sec
> urity-
> support-02
> 
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-lsr-pce-discovery-securit
> y-
> support-02
> 
> 
> Please note that it may take a couple of minutes from the time of 
> submission until the htmlized version and diff are available at tools.ietf.org.
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> _______________________________________________
> I-D-Announce mailing list
> I-D-Announce@ietf.org
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html or 
> ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> _______________________________________________
> Lsr mailing list
> Lsr@ietf.org
> https://www.ietf.org/mailman/listinfo/lsr