Re: [secdir] secdir review of draft-ietf-teas-gmpls-lsp-fastreroute-09
"Rakesh Gandhi (rgandhi)" <rgandhi@cisco.com> Tue, 11 July 2017 15:37 UTC
Return-Path: <rgandhi@cisco.com>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B17A813145A; Tue, 11 Jul 2017 08:37:40 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.511
X-Spam-Level:
X-Spam-Status: No, score=-14.511 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_HTML_ATTACH=0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iih7i0cCijCG; Tue, 11 Jul 2017 08:37:32 -0700 (PDT)
Received: from alln-iport-3.cisco.com (alln-iport-3.cisco.com [173.37.142.90]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 44DDC128B8F; Tue, 11 Jul 2017 08:37:32 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=221713; q=dns/txt; s=iport; t=1499787452; x=1500997052; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=NzpqATzgd8M+85L2B8Wd5d/LwQt+iRrc1nNtJBcB4gI=; b=SyzEvDnYcWjac2TQw1RFlsIXNDiQwyLVtGdzO3qnadzLKRnQSlHmFAUA c/yDMo6DDWm2SLcSNGnvVwuTsldxA5KG3bmhRz+n0xzD4xwzY5aYRGSpn JxVEZRdleKZXKOCpYjHDA+5YEmF9tWGEjPJooQmdk0HbLVPpkUhve35SO 0=;
X-Files: Diff_ draft-ietf-teas-gmpls-lsp-fastreroute-09.txt - draft-ietf-teas-gmpls-lsp-fastreroute-10.txt.html, draft-ietf-teas-gmpls-lsp-fastreroute-10.txt : 78932, 49558
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0CcAAAC8GRZ/5NdJa1TChkBAQEBAQEBAQEBAQcBAQEBAYJvPi1kgRQHhW+IE5FuiC6NVYIRLoNpgV8CGoMiPxgBAgEBAQEBAQFrKIUYAQEBAQMaAQgEBhogEhACAQgRAwEBASEBBgMCAgIfERQJCAIEAQ0FCQUNiXwDFRCrf4FsOieDFFcBgxwNg3gBAQEBAQEBAQEBAQEBAQEBAQEBAQEOD4Mog02BYAErgnmCV0+BCgsHCwEjBwkJBgYMglswgjEFiVyMBIEqMYJbhFM7AoQogx6BC4I6g0ZLgVKDHIIMGT6EdIkKgUSJO4JCiUkBHzh/C3UVSRIBhEc2AxyBLAE6dgGFbgcIF4EMAYEMAQEB
X-IronPort-AV: E=Sophos;i="5.40,347,1496102400"; d="txt'?html'217?scan'217,208,217";a="453133608"
Received: from rcdn-core-11.cisco.com ([173.37.93.147]) by alln-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 11 Jul 2017 15:37:29 +0000
Received: from XCH-ALN-018.cisco.com (xch-aln-018.cisco.com [173.36.7.28]) by rcdn-core-11.cisco.com (8.14.5/8.14.5) with ESMTP id v6BFbSjs002494 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 11 Jul 2017 15:37:28 GMT
Received: from xch-aln-018.cisco.com (173.36.7.28) by XCH-ALN-018.cisco.com (173.36.7.28) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 11 Jul 2017 10:37:27 -0500
Received: from xch-aln-018.cisco.com ([173.36.7.28]) by XCH-ALN-018.cisco.com ([173.36.7.28]) with mapi id 15.00.1210.000; Tue, 11 Jul 2017 10:37:27 -0500
From: "Rakesh Gandhi (rgandhi)" <rgandhi@cisco.com>
To: "BRUNGARD, DEBORAH A" <db3546@att.com>, Vishnu Pavan Beeram <vbeeram@juniper.net>, Rifaat Shekh-Yusef <rifaat.ietf@gmail.com>, "draft-ietf-teas-gmpls-lsp-fastreroute.all@ietf.org" <draft-ietf-teas-gmpls-lsp-fastreroute.all@ietf.org>, "secdir@ietf.org" <secdir@ietf.org>, The IESG <iesg@ietf.org>
CC: Lou Berger <lberger@labn.net>, "EXT-vishnupavan@gmail.com" <vishnupavan@gmail.com>
Thread-Topic: [secdir] secdir review of draft-ietf-teas-gmpls-lsp-fastreroute-09
Thread-Index: AQHS9MsUKApW2nmrDkSMbsBbOiyZvqJD0ouAgABO84CAAt+CAIAH2euA///raYCAABguAA==
Date: Tue, 11 Jul 2017 15:37:27 +0000
Message-ID: <8FCEBCD6-6CFE-4961-A7E8-A39801486434@cisco.com>
References: <CAGL6epL36m-j_UHLZ7zK+rTVNdOOTpnww1Q0i5zowxLp=+V1RA@mail.gmail.com> <E6C94EE4-C51B-47E2-AF0C-50AF1E967F44@cisco.com> <233DDE34-9818-4088-A9CE-84180A34D5A4@juniper.net> <5C02CE7F-DEE3-48D0-898C-347CF4CB6595@cisco.com> <F64C10EAA68C8044B33656FA214632C85DF42E24@MISOUT7MSGUSRDE.ITServices.sbc.com> <B8956E33-5225-4C8C-A2A5-6BEA8055EE03@cisco.com>
In-Reply-To: <B8956E33-5225-4C8C-A2A5-6BEA8055EE03@cisco.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/f.1d.0.161209
x-ms-exchange-messagesentrepresentingtype: 1
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [161.44.213.149]
Content-Type: multipart/mixed; boundary="_005_8FCEBCD66CFE4961A7E8A39801486434ciscocom_"
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/C55TWO5U9vcxeYbdYczlUqdyV2Q>
Subject: Re: [secdir] secdir review of draft-ietf-teas-gmpls-lsp-fastreroute-09
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 11 Jul 2017 15:37:41 -0000
Hi All, Attached please find the suggested changes, which includes Gen-ART review as well. Will upload the revised document once the flood gate opens. Thanks, Rakesh From: "=SMTP:rgandhi@cisco. com" <rgandhi@cisco.com> Date: Tuesday, July 11, 2017 at 10:11 AM To: DEBORAH BRUNGARD <db3546@att.com>, Vishnu Pavan Beeram <vbeeram@juniper.net>, Rifaat Shekh-Yusef <rifaat.ietf@gmail.com>, "draft-ietf-teas-gmpls-lsp-fastreroute.all@ietf.org" <draft-ietf-teas-gmpls-lsp-fastreroute.all@ietf.org>, "secdir@ietf.org" <secdir@ietf.org>, The IESG <iesg@ietf.org> Cc: Lou Berger <lberger@labn.net>, "EXT-vishnupavan@gmail.com" <vishnupavan@gmail.com> Subject: Re: [secdir] secdir review of draft-ietf-teas-gmpls-lsp-fastreroute-09 Hi Deborah, Thank you for your suggestions. Will update the document accordingly. Thanks, Rakesh From: DEBORAH BRUNGARD <db3546@att.com> Date: Tuesday, July 11, 2017 at 7:25 AM To: "=SMTP:rgandhi@cisco. com" <rgandhi@cisco.com>, Vishnu Pavan Beeram <vbeeram@juniper.net>, Rifaat Shekh-Yusef <rifaat.ietf@gmail.com>, "draft-ietf-teas-gmpls-lsp-fastreroute.all@ietf.org" <draft-ietf-teas-gmpls-lsp-fastreroute.all@ietf.org>, "secdir@ietf.org" <secdir@ietf.org>, The IESG <iesg@ietf.org> Cc: Lou Berger <lberger@labn.net>, "EXT-vishnupavan@gmail.com" <vishnupavan@gmail.com> Subject: RE: [secdir] secdir review of draft-ietf-teas-gmpls-lsp-fastreroute-09 Hi Rakesh, all, (I was on vacation last week:-)) I lean towards a somewhat strict interpretation of “update”, otherwise implementers need to browse all the updates to see what is appropriate. On this, it is more than extension, it definitely improves an implementation, so it should be an “update”. Authors – when do the next update - reword “This document extends the mechanism ..” to “This document updates the mechanism ..”. Thanks Rifaat – great comment- Deborah From: Rakesh Gandhi (rgandhi) [mailto:rgandhi@cisco.com] Sent: Thursday, July 06, 2017 11:31 AM To: Vishnu Pavan Beeram <vbeeram@juniper.net>; Rifaat Shekh-Yusef <rifaat.ietf@gmail.com>; draft-ietf-teas-gmpls-lsp-fastreroute.all@ietf.org; secdir@ietf.org; The IESG <iesg@ietf.org> Cc: BRUNGARD, DEBORAH A <db3546@att.com>; Lou Berger <lberger@labn.net>; EXT-vishnupavan@gmail.com <vishnupavan@gmail.com> Subject: Re: [secdir] secdir review of draft-ietf-teas-gmpls-lsp-fastreroute-09 Thanks Pavan. Hi Deborah, Please let us know if you are OK with the suggestion. “Because the document extends RFC4090, it should add "Updates: 4090" at the top of the document.” Thanks, Rakesh From: Vishnu Pavan Beeram <vbeeram@juniper.net<mailto:vbeeram@juniper.net>> Date: Tuesday, July 4, 2017 at 11:38 AM To: "=SMTP:rgandhi@cisco. com" <rgandhi@cisco.com<mailto:rgandhi@cisco.com>>, Rifaat Shekh-Yusef <rifaat.ietf@gmail.com<mailto:rifaat.ietf@gmail.com>>, "draft-ietf-teas-gmpls-lsp-fastreroute.all@ietf.org<mailto:draft-ietf-teas-gmpls-lsp-fastreroute.all@ietf.org>" <draft-ietf-teas-gmpls-lsp-fastreroute.all@ietf.org<mailto:draft-ietf-teas-gmpls-lsp-fastreroute.all@ietf.org>>, "secdir@ietf.org<mailto:secdir@ietf.org>" <secdir@ietf.org<mailto:secdir@ietf.org>>, The IESG <iesg@ietf.org<mailto:iesg@ietf.org>> Cc: DEBORAH BRUNGARD <db3546@att.com<mailto:db3546@att.com>>, Lou Berger <lberger@labn.net<mailto:lberger@labn.net>>, "EXT-vishnupavan@gmail.com<mailto:EXT-vishnupavan@gmail.com>" <vishnupavan@gmail.com<mailto:vishnupavan@gmail.com>> Subject: Re: [secdir] secdir review of draft-ietf-teas-gmpls-lsp-fastreroute-09 Rakesh, Hi! This is a valid comment. <GMPLS-LSP-FRR> doesn’t modify any of the existing procedures defined in RFC4090, but it does supplement it. As per RFC2223, this is sufficient grounds to set the “Updates” field. Courtesy RFC2223: To be used as a reference from a new item that cannot be used alone (i.e., one that supplements a previous document), to refer to the previous document. The newer publication is a part that will supplement or be added on to the existing document; e.g., an addendum, or separate, extra information that is to be added to the original document. @Deborah — Are you ok with this? Regards, -Pavan From: "Rakesh Gandhi (rgandhi)" <rgandhi@cisco.com<mailto:rgandhi@cisco.com>> Date: Tuesday, July 4, 2017 at 10:55 AM To: Rifaat Shekh-Yusef <rifaat.ietf@gmail.com<mailto:rifaat.ietf@gmail.com>>, "draft-ietf-teas-gmpls-lsp-fastreroute.all@ietf.org<mailto:draft-ietf-teas-gmpls-lsp-fastreroute.all@ietf.org>" <draft-ietf-teas-gmpls-lsp-fastreroute.all@ietf.org<mailto:draft-ietf-teas-gmpls-lsp-fastreroute.all@ietf.org>>, "secdir@ietf.org<mailto:secdir@ietf.org>" <secdir@ietf.org<mailto:secdir@ietf.org>>, The IESG <iesg@ietf.org<mailto:iesg@ietf.org>> Cc: DEBORAH BRUNGARD <db3546@att.com<mailto:db3546@att.com>>, Lou Berger <lberger@labn.net<mailto:lberger@labn.net>>, "EXT-vishnupavan@gmail.com<mailto:EXT-vishnupavan@gmail.com>" <vishnupavan@gmail.com<mailto:vishnupavan@gmail.com>> Subject: Re: [secdir] secdir review of draft-ietf-teas-gmpls-lsp-fastreroute-09 Resent-From: <alias-bounces@ietf.org<mailto:alias-bounces@ietf.org>> Resent-To: <mtaillon@cisco.com<mailto:mtaillon@cisco.com>>, <tsaad@cisco.com<mailto:tsaad@cisco.com>>, <rgandhi@cisco.com<mailto:rgandhi@cisco.com>>, Zafar Ali <zali@cisco.com<mailto:zali@cisco.com>>, <manav.bhatia@nokia.com<mailto:manav.bhatia@nokia.com>>, <mhartley@cisco.com<mailto:mhartley@cisco.com>>, Lou Berger <lberger@labn.net<mailto:lberger@labn.net>>, Vishnu Pavan Beeram <vbeeram@juniper.net<mailto:vbeeram@juniper.net>>, <aretana@cisco.com<mailto:aretana@cisco.com>>, <db3546@att.com<mailto:db3546@att.com>>, <akatlas@gmail.com<mailto:akatlas@gmail.com>> Resent-Date: Tuesday, July 4, 2017 at 10:55 AM Thanks Rifaat for the review of this document. Hi Deborah, Lou, Pavan, Any thoughts on the following suggestion? “Because the document extends RFC4090, it should add "Updates: 4090" at the top of the document.” Thanks, Rakesh From: Rifaat Shekh-Yusef <rifaat.ietf@gmail.com<mailto:rifaat.ietf@gmail.com>> Date: Tuesday, July 4, 2017 at 9:32 AM To: "draft-ietf-teas-gmpls-lsp-fastreroute.all@ietf.org<mailto:draft-ietf-teas-gmpls-lsp-fastreroute.all@ietf.org>" <draft-ietf-teas-gmpls-lsp-fastreroute.all@ietf.org<mailto:draft-ietf-teas-gmpls-lsp-fastreroute.all@ietf.org>>, "secdir@ietf.org<mailto:secdir@ietf.org>" <secdir@ietf.org<mailto:secdir@ietf.org>>, The IESG <iesg@ietf.org<mailto:iesg@ietf.org>> Subject: [secdir] secdir review of draft-ietf-teas-gmpls-lsp-fastreroute-09 Resent-From: <alias-bounces@ietf.org<mailto:alias-bounces@ietf.org>> Resent-To: "=SMTP:mtaillon@cisco. com" <mtaillon@cisco.com<mailto:mtaillon@cisco.com>>, <tsaad@cisco.com<mailto:tsaad@cisco.com>>, "=SMTP:rgandhi@cisco. com" <rgandhi@cisco.com<mailto:rgandhi@cisco.com>>, Zafar Ali <zali@cisco.com<mailto:zali@cisco.com>>, <manav.bhatia@nokia.com<mailto:manav.bhatia@nokia.com>>, <mhartley@cisco.com<mailto:mhartley@cisco.com>>, Lou Berger <lberger@labn.net<mailto:lberger@labn.net>>, <vbeeram@juniper.net<mailto:vbeeram@juniper.net>>, <aretana@cisco.com<mailto:aretana@cisco.com>>, DEBORAH BRUNGARD <db3546@att.com<mailto:db3546@att.com>>, <akatlas@gmail.com<mailto:akatlas@gmail.com>> Resent-Date: Tuesday, July 4, 2017 at 9:40 AM I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. Summary: Ready with Nits I did not have enough background on MLPS and GMPLS and their related RFCs, so I had to do some reading to get some familiarity with this subject to be able to provide some reasonable review of this document. This document builds on an existing mechanism, "Fast Reroute Extensions to RSVP-TE for LSP Tunnels" defined in RFC4090, which defines a mechanism to establish a backup tunnels for local LSP tunnels. One limitation of the existing mechanism is that in some situations it might assign different uni-directional bypass tunnels for the forward and reverse directions. This document extends the mechanism defined in RFC4090, by adding a new BYPASS_ASSIGNMENT subobject to the existing RECORD_ROUTE Object (RRO) used in PATH and RESV requests, to allow the establishment of a bi-directional bypass tunnel. The security of the existing mechanism still applies with the new mechanism, and the security section discusses the implications of the new subobject and the new error associated with that, which seems reasonable. The document also points to an MPLS/GMPLS Security Framework (RFC5920) document that has an extensive discussion of the security of MPLS/GMPLS network in general that also applies to this document. Nits Because the document extends RFC4090, it should add "Updates: 4090" at the top of the document. Regards, Rifaat
- [secdir] secdir review of draft-ietf-teas-gmpls-l… Rifaat Shekh-Yusef
- Re: [secdir] secdir review of draft-ietf-teas-gmp… Rakesh Gandhi (rgandhi)
- Re: [secdir] secdir review of draft-ietf-teas-gmp… Vishnu Pavan Beeram
- Re: [secdir] secdir review of draft-ietf-teas-gmp… Rakesh Gandhi (rgandhi)
- Re: [secdir] secdir review of draft-ietf-teas-gmp… BRUNGARD, DEBORAH A
- Re: [secdir] secdir review of draft-ietf-teas-gmp… Rakesh Gandhi (rgandhi)
- Re: [secdir] secdir review of draft-ietf-teas-gmp… Rakesh Gandhi (rgandhi)