Re: [pim] Updates to draft-ietf-pim-igmp-mld-extension, WG input wanted

[Stig Venaas <[e-mail]>]

Hi Aijun

Thanks for your suggestion. We did think about this previously. The
problem though is that you cannot trust this. By accident, or
intentionally if an attack, one could send a message that has the
Total TLV Length set to a value matching the size of the IGMP packet,
but still have a TLV with a length far exceeding the size of the
packet.

Thanks,
Stig

On Thu, May 12, 2022 at 5:04 AM Aijun Wang <[e-mail]> wrote:
>
> Hi, Stig:
>
> Is it useful to define the total length of “Extension TLV” at the beginning of the “Extension Format”?
> As indicated in the https://datatracker.ietf.org/doc/html/draft-ietf-pim-igmp-mld-extension-07.txt#section-5
>
>
> “The total length of the Extension MUST NOT exceed the remainder of
>       the IP payload length.  For this validation, one only examines the
>       content of the Extension Length fields.”
>
>
> In the current format, to accomplish the validation, the implementation must walk through all the TLVs.
>
>
> And, if such field exist, the former validation can also be easier, or just ignore it.
>
>
> “There MUST NOT be any data in the IP payload after the last TLV.
>       To check this, the parser needs to walk through each of the TLVs
>       until there are less than four octets left in the IP payload.  If
>       there are any octets left, validation fails.”
>
>
>
> Aijun Wang
> China Telecom
>
> On May 12, 2022, at 08:26, Stig Venaas <[e-mail]> wrote:
>
> Dear pim WG
>
> Based on the IESG evaluation of draft-ietf-pim-igmp-mld-extension I
> have made some larger changes, please see
> https://datatracker.ietf.org/doc/html/draft-ietf-pim-igmp-mld-extension-07.txt
>
> There was a request to add experimental code-points. I've added 2, I
> think that should be sufficient. Different experiments can use the
> same code-points.
>
> I was also asked to add a no-op TLV. This doesn't do much, but it
> might perhaps allow testing of implementations to see whether they are
> parsing TLVs correctly.
>
> Finally, there were questions whether IETF Review is too strict for
> assignment of code-points. In my opinion we should be cautious with
> new extensions and IETF Review allows us to carefully review any
> extensions in the IETF. Alternatively we could for instance have
> relaxed it to just require a specification (this could be any
> document, not requiring review). Please let me know if you believe we
> should relax this.
>
> Hoping to get input within two weeks (May 25th), so that we can move
> ahead with the publication, or revise as needed. Mike, let me know if
> we need to do anything else to get sufficient review.
>
> Thanks,
> Stig
>
> _______________________________________________
> pim mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/pim