Re: [mpls] draft-ietf-mpls-lspping-norao-03 - Review

[Greg Mirsky <[e-mail]>]

Hi Gyan,
thank you for the review and your helpful suggestions. Please find my notes
below under the GIM>> tag.

Regards,
Greg

On Tue, Oct 3, 2023 at 7:15 AM Gyan Mishra <[e-mail]> wrote:

>
> Dear authors
>
> Below is a review of this draft.
>
> I think it would be good to explain what a controlled versus not
> controlled environment is and could be a simple sentence of single
> administrative domain versus inter domain over public Internet.
>
GIM>> Would the following update in the Introduction make the text
sufficiently clear:
OLD TEXT:
   Furthermore, [RFC6398] identifies security vulnerabilities associated
   with the RAO in non-controlled environments, e.g., the case of using
   the MPLS echo request/reply as inter-area OAM, and recommends against
   its use outside of controlled environments.
NEW TEXT:
   Furthermore, [RFC6398] identifies security vulnerabilities associated
   with the RAO in non-controlled environments, e.g., the case of using
   the MPLS echo request/reply as inter-domain OAM over the public
   Internet, and recommends against its use outside of controlled
   environments, e.g., outside a single administrative domain.

>
> There are three options available for the LSP ping so as we are
> deprecating the use of LSP ping with ROA both the link local and TTL=1
> should be valid options.
>
GIM>> As I understand the intent of IP/UDP encapsulation of MPLS echo
request/reply messages, using the IP loopback address as the IP destination
address serves as the exception mechanism. The TTL-based exception is used
but for the MPLS underlay network.

>
>
> RFC 5082 GTSM talks about TTL spoofing and that 255 is hard to spoof
> opposed to TTL 1.  It maybe a good idea to mention that link local is the
> recommendation and reasons why TTL 1 is not recommended option due to
> spoofing.
>
GIM>> It is not clear to me how a link-local address can be used in IP/UDP
encapsulation of an MPLS echo request/reply message. Could you kindly give
an example of the encapsulation?

>
> This draft below on deprecating IPv6 RAO option goes into more detail and
> reason why due to issue with HBH EH and RAO bring a HBH option makes it a
> security risk to use HBH.  This draft has some more detail about control
> plane and forwarding plane Figure 1 that could be applicable to LSP ping
> RAO depreciation draft as well.
>
>
> https://datatracker.ietf.org/doc/html/draft-bonica-6man-deprecate-router-alert-00
>
GIM>> It seems like replicating information may not be the most efficient
WoW.  I'll discuss with Ron plans for the work in 6man and if referencing
it in the MPLS draft is useful.

>
>
> Thank you
>
> Gyan
>
>
> _______________________________________________
> mpls mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/mpls
>