[secdir] Secdir review of draft-ietf-dime-ovli

["Paul Hoffman" <[e-mail]>]

Greetings again. This document, "Diameter Overload Indication 
Conveyance", is a way for a Diameter server in a cluster to tell other 
servers in the cluster "don't send so many requests to me". It is pretty 
complex and fiddly, but seems sensible. The security considerations are 
numerous, but fairly well covered in the extensive Security 
Considerations section.

Note that there is not much that can really be done here to address the 
biggest concern of spoofing. As the document says:

    Diameter does not include features to provide end-to-end
    authentication, integrity protection, or confidentiality.  This may
    cause complications when sending overload reports between non-
    adjacent nodes.

(Nice use of "may" there...) So, there isn't much that can be demanded 
of this document without some obvious controls. Still, the Security 
Considerations section covers the likely attacks and problems.

--Paul Hoffman