Subject: Re: [mpls] Stephen Farrell's Discuss on draft-ietf-mpls-mldp-node-protection-05: (with DISCUSS and COMMENT)
From: IJsbrand Wijnands <[email-masked]>
To: Stephen Farrell <[email-masked]>
Cc: [email-masked], [email-masked], The IESG <[email-masked]>, [email-masked], [email-masked], [email-masked]
Date: Wed, 16 Sep 2015 11:15:29 +0200
List-Id: Multi-Protocol Label Switching WG <mpls.ietf.org>

Hi Stephen,

>>  The procedures in this document add two new TLVs to existing LDP
>>  messages.  Those TLVs can be protected by the mechanisms that are
>>  used to protect LDP messages as described in [RFC6388] and [RFC5920].
>>  If it were possible to attack the mechanisms described in this 
>>  document an LSR (a PLR or a MPT) could be induced to support a large
> 
> Can't "N" also cause the potential DoS, if N is the compromised LSR?
> But the main thing is that once this mechanism is supported, any LSR
> (that is compromised) could try use this as a DoS vector/accelerator.

Yes, I guess it does.

> 
>>  number of tLDP sessions and set up an even larger number of LSPs.
>>  The security mechanisms in [RFC6388] and [RFC5920] are believed to be
>>  adequate, but an implementation could provide additional protection
>>  by counting such protection sessions and LSPs and producing a log
>>  message to the operator if a threshold is crossed.
>> —
> 
> Yes, that text seems about right and good enough to clear
> when you post a revision with that in it.

Cool, will do.

> 
> I could maybe quibble about the current security mechanisms being
> adequate bit (are they really? say in a network with a small but
> persistent percentage of compromised routers?) but I'll not quibble
> in this case, as I guess that is a more general problem and it'd
> not be right to try force a solution via this document.

Thx!,

Ice.