Re: [Lsr] I-D Action: draft-ietf-lsr-pce-discovery-security-support-01.txt

"Les Ginsberg (ginsberg)" <ginsberg@cisco.com> Mon, 03 June 2019 06:21 UTC

Return-Path: <ginsberg@cisco.com>
X-Original-To: lsr@ietfa.amsl.com
Delivered-To: lsr@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7679F120135 for <lsr@ietfa.amsl.com>; Sun, 2 Jun 2019 23:21:53 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.5
X-Spam-Level:
X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=jIJaF6Yp; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=q3loSZUI
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VdlaFZQ19EyV for <lsr@ietfa.amsl.com>; Sun, 2 Jun 2019 23:21:51 -0700 (PDT)
Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 46A4C120130 for <lsr@ietf.org>; Sun, 2 Jun 2019 23:21:51 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4678; q=dns/txt; s=iport; t=1559542911; x=1560752511; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=C9jqHeALXxoXUdtVWUF1lmHZyAYkEskU9KclXdhwgbo=; b=jIJaF6YpTJac84yajKR+Da72mhJwQav2q4uu0FZXGLYgXyEHSOJZr4q4 cg0sxalYJMqsvjR0S0IXETYodaJAff1+Ft8PnLn4mHXd4HoL+mG8guyP8 k+WA2FJgeWxCiJ7FWvv7NH9e0oO50VcQXyARIaBoHSot8Np3pQA1LPtE/ 8=;
IronPort-PHdr: =?us-ascii?q?9a23=3AlE3Ahxxx4njGSEjXCy+N+z0EezQntrPoPwUc9p?= =?us-ascii?q?sgjfdUf7+++4j5YhWN/u1j2VnOW4iTq+lJjebbqejBYSQB+t7A1RJKa5lQT1?= =?us-ascii?q?kAgMQSkRYnBZuKCEvgJvPwYAQxHd9JUxlu+HToeUU=3D?=
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BKAAC1u/Rc/5xdJa1mHAEBAQQBAQc?= =?us-ascii?q?EAQGBUQcBAQsBgT0kLANqVSAECyiHWwOEUooggleXL4EugSQDVAkBAQEMAQE?= =?us-ascii?q?YDQgCAQGEQAKDCSM0CQ4BAwEBBAEBAgEEbRwBC4VKAQEBAQMBARAoBgEBLAw?= =?us-ascii?q?LBAIBCBEEAQEfECcLHQgCBBMIGoMBgWoDHQECDJ1nAoE4iF+CIoJ5AQEFgTY?= =?us-ascii?q?CDkGCcxiCDwmBNAGLWReBQD+BEAFGgkw+gmEBAQIBARaBMRgkgxaCJpMilVs?= =?us-ascii?q?JAoINhj+NDoIiaIYJjVuNAIcLjxMCBAIEBQIOAQEFgU84gVhwFRohgmwJgga?= =?us-ascii?q?DcIUUhT9yDIEdkCoBAQ?=
X-IronPort-AV: E=Sophos;i="5.60,545,1549929600"; d="scan'208";a="348984354"
Received: from rcdn-core-5.cisco.com ([173.37.93.156]) by rcdn-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 03 Jun 2019 06:21:49 +0000
Received: from XCH-ALN-008.cisco.com (xch-aln-008.cisco.com [173.36.7.18]) by rcdn-core-5.cisco.com (8.15.2/8.15.2) with ESMTPS id x536Lnrx000633 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL) for <lsr@ietf.org>; Mon, 3 Jun 2019 06:21:49 GMT
Received: from xhs-rtp-002.cisco.com (64.101.210.229) by XCH-ALN-008.cisco.com (173.36.7.18) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 3 Jun 2019 01:21:48 -0500
Received: from xhs-rcd-001.cisco.com (173.37.227.246) by xhs-rtp-002.cisco.com (64.101.210.229) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 3 Jun 2019 02:21:47 -0400
Received: from NAM03-CO1-obe.outbound.protection.outlook.com (72.163.14.9) by xhs-rcd-001.cisco.com (173.37.227.246) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Mon, 3 Jun 2019 01:21:47 -0500
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=blsGRSsmfY/+L61tO08B8qcKCJxZ+YhmdNE/HuV6law=; b=q3loSZUIO6iUwNyiVtrTWDeqhAzNP7FIMYgkuaCNk+X7GnPEwhqvN86hsYAxongZRknRP8K0hJ+TO9Zpc1s3nUU9rFRxEAFimzsFdtp1zRXIFR5xmp7xMxkPeloqvyqhbN3ElgENj5flskSSAcVqbWLgyqva5A9L7iTE5+Ad5N4=
Received: from BYAPR11MB3638.namprd11.prod.outlook.com (20.178.237.19) by BYAPR11MB3525.namprd11.prod.outlook.com (20.177.227.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1943.22; Mon, 3 Jun 2019 06:21:46 +0000
Received: from BYAPR11MB3638.namprd11.prod.outlook.com ([fe80::ace2:8693:202d:5a30]) by BYAPR11MB3638.namprd11.prod.outlook.com ([fe80::ace2:8693:202d:5a30%7]) with mapi id 15.20.1943.018; Mon, 3 Jun 2019 06:21:46 +0000
From: "Les Ginsberg (ginsberg)" <ginsberg@cisco.com>
To: "lsr@ietf.org" <lsr@ietf.org>
Thread-Topic: [Lsr] I-D Action: draft-ietf-lsr-pce-discovery-security-support-01.txt
Thread-Index: AQHVGb7XYvB2HV8clE60nbKuVn4cRaaJb0zg
Date: Mon, 3 Jun 2019 06:21:46 +0000
Message-ID: <BYAPR11MB3638D2C9D9D5E8AC8174ADCFC1140@BYAPR11MB3638.namprd11.prod.outlook.com>
References: <155953350234.21547.271455258761348084@ietfa.amsl.com>
In-Reply-To: <155953350234.21547.271455258761348084@ietfa.amsl.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=ginsberg@cisco.com;
x-originating-ip: [2001:420:c0c8:1002::146]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 3ba98008-3688-41b4-9588-08d6e7ebc13b
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:BYAPR11MB3525;
x-ms-traffictypediagnostic: BYAPR11MB3525:
x-ms-exchange-purlcount: 5
x-microsoft-antispam-prvs: <BYAPR11MB35255EB6CECD614D710AD2F1C1140@BYAPR11MB3525.namprd11.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:9508;
x-forefront-prvs: 0057EE387C
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(346002)(376002)(39860400002)(366004)(136003)(13464003)(199004)(189003)(54094003)(15374003)(6506007)(53546011)(305945005)(102836004)(7696005)(6246003)(76176011)(7736002)(66446008)(52536014)(186003)(86362001)(14454004)(316002)(66574012)(76116006)(64756008)(73956011)(66946007)(66476007)(53936002)(66556008)(46003)(5660300002)(71190400001)(71200400001)(68736007)(486006)(476003)(966005)(2501003)(256004)(11346002)(446003)(14444005)(478600001)(2906002)(33656002)(2351001)(8676002)(1730700003)(81156014)(81166006)(25786009)(6916009)(74316002)(8936002)(6306002)(229853002)(15650500001)(5640700003)(55016002)(9686003)(6116002)(99286004)(6436002); DIR:OUT; SFP:1101; SCL:1; SRVR:BYAPR11MB3525; H:BYAPR11MB3638.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1;
received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: yhkE5cYvwbZpsKtYDcW1Hy+pJ65gyn2UwMR4bzu9c2riX+Dxj6t+OMbiP10qS/lwIAFV+fqfl8WC4iOc/LkhcxH5LXELVP7AJYQ4mTPo7fJ3u7s560w7PHIQpnVA7y+M4JjmlOLGPTiTQtFw2vvLXix+YRHpf1m5z1EsxyMvUwhmVdVtCQbRndWO4JVNt0cLLVor8p2ED+XYaiJKrGWoxmTGGKyK1x7zsdPEGDHc2e4c5WHN0IfeCRhwga/EH6yOZAI5/ccwDM3ePkmX3j1KVDwP2EXVgdmZl3VKSBA6PNCoiZ1e8J8AFpey+c123aVbLRBYopUMg2Nlm7DQNnM/zPiZZOmgnwX3boS+hRbSLZGbCaL64Ra8dPPIaSExcRB0t6JofWFADdVXqcp35SHItYca5ZLUcRKarQYJMFNe/Pw=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 3ba98008-3688-41b4-9588-08d6e7ebc13b
X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Jun 2019 06:21:46.3193 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: ginsberg@cisco.com
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR11MB3525
X-OriginatorOrg: cisco.com
X-Outbound-SMTP-Client: 173.36.7.18, xch-aln-008.cisco.com
X-Outbound-Node: rcdn-core-5.cisco.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/lsr/NhezQqKwIvHK_9dDUmW0iuhyjDA>
Subject: Re: [Lsr] I-D Action: draft-ietf-lsr-pce-discovery-security-support-01.txt
X-BeenThere: lsr@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Link State Routing Working Group <lsr.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lsr>, <mailto:lsr-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/lsr/>
List-Post: <mailto:lsr@ietf.org>
List-Help: <mailto:lsr-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lsr>, <mailto:lsr-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 03 Jun 2019 06:21:53 -0000

A few - somewhat tardy - concerns about this draft.

1)During adoption call it was mentioned that PCE WG had not taken a position on this draft. Since I don't follow PCE WG (apologies) I need to ask - has that status changed??

2)As discussed during the adoption call, the draft removes the restriction specified in RFC 5088/5089 of not allowing further PCE related advertisements in Router Capability TLV/Router Information LSA.
Acee had mentioned that he thought this was no longer a concern because in RFC 7770 multiple OSPF Router Information LSA support was introduced. But this is really not relevant to the reason that the restriction was originally introduced.

The restriction was introduced because of general concern that using IGPs to advertise information not directly relevant to the operation of the IGP as a routing protocol is sub-optimal and negatively impacts the performance of the primary IGP functions.

I am aware that this is a line that has been crossed (in modest ways) more than once - and I am not categorically opposing the extensions proposed - but I do wonder if this is the most appropriate way to advertise the new attributes - particularly since this does not solve the general case - it only applies when the PCE is also an LSR. I think a broader discussion of this issue is warranted.

3)If the draft goes forward in its current form, it updates RFC 5088/5089 in a significant way (the removal of restriction against additional PCE related IGP advertisements) - in which case I wonder if it would be better to write an RFC 5088/89 bis document rather than an extension document.

And, BTW, do you know why the HTML version of the document has no table of contents?

   Les


> -----Original Message-----
> From: Lsr <lsr-bounces@ietf.org>; On Behalf Of internet-drafts@ietf.org
> Sent: Sunday, June 02, 2019 8:45 PM
> To: i-d-announce@ietf.org
> Cc: lsr@ietf.org
> Subject: [Lsr] I-D Action: draft-ietf-lsr-pce-discovery-security-support-01.txt
> 
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Link State Routing WG of the IETF.
> 
>         Title           : IGP extension for PCEP security capability support in the PCE
> discovery
>         Authors         : Diego R. Lopez
>                           Qin Wu
>                           Dhruv Dhody
>                           Michael Wang
>                           Daniel King
> 	Filename        : draft-ietf-lsr-pce-discovery-security-support-01.txt
> 	Pages           : 10
> 	Date            : 2019-06-02
> 
> Abstract:
>    When a Path Computation Element (PCE) is a Label Switching Router
>    (LSR) participating in the Interior Gateway Protocol (IGP), or even a
>    server participating in IGP, its presence and path computation
>    capabilities can be advertised using IGP flooding.  The IGP
>    extensions for PCE discovery (RFC 5088 and RFC 5089) define a method
>    to advertise path computation capabilities using IGP flooding for
>    OSPF and IS-IS respectively.  However these specifications lack a
>    method to advertise PCEP security (e.g., Transport Layer
>    Security(TLS), TCP Authentication Option (TCP-AO)) support
>    capability.
> 
>    This document proposes new capability flag bits for PCE-CAP-FLAGS
>    sub-TLV that can be announced as attribute in the IGP advertisement
>    to distribute PCEP security support information.  In addition, this
>    document updates RFC 5088 and RFC 5089 to allow advertisement of Key
>    ID or Key Chain Name Sub-TLV to support TCP AO security capability.
> 
> 
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-lsr-pce-discovery-security-
> support/
> 
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-ietf-lsr-pce-discovery-security-support-01
> https://datatracker.ietf.org/doc/html/draft-ietf-lsr-pce-discovery-security-
> support-01
> 
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-lsr-pce-discovery-security-
> support-01
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> _______________________________________________
> Lsr mailing list
> Lsr@ietf.org
> https://www.ietf.org/mailman/listinfo/lsr