Re: [pcp] WGLC: draft-ietf-pcp-anycast-02 comments due by NOV 10

[Markus Stenberg <[e-mail]>]

On 27.10.2014, at 22.23, Dave Thaler <[e-mail]> wrote:
> This email initiates a Working Group Last Call on : draft-ietf-pcp-anycast-02 to conclude on
> Monday, November 10th at the PCP WG meeting in Honolulu.  Please send comments to the list.
>  
> As a reminder, when responding to a WGLC, what we chairs are looking for is a statement about
> document quality (not really about whether the mechanism should move forward).  That is,
> state whether you think the document is ready as is, or if not, what issues you see.

I think the document (and the mechanism) is mostly fine and needed.

What I am wondering about is security considerations section; given implementations not aware of this draft, a host on the inner side can also advertise the anycast address, and potentially get traffic meant for first-hop PCP server. Given the scheme defined in section 2.1 (SHOULD use first-hop first), it is possible, although not probable. But still, I would say the same problem is both on local network(s) _and_ on the other side of the firewall.

(It could also state that finding (platform independently) next-hop gateway programmatically can be hard for pure ‘applications’ sometimes, but I wonder if this is too much detail. But if app just chose anycast address, the above SHOULD would not be followed and the security considerations problems would be more severe.)

Also.. Is there actually defined mechanism to redirect or provide list of PCP servers that is mentioned in the introduction?

Cheers,

-Markus