Re: [secdir] [aqm] Review of draft-ietf-aqm-codel-07

Thanks Yoav, Emma. I can try to move Sec 5 before Sec 3, if that helps.
Yoav: What do you suggest we add for security considerations?

Thanks for the reviews!
- jana

On Tue, Mar 21, 2017 at 7:04 PM, Gengxuesong (Geng Xuesong) <
gengxuesong@huawei.com> wrote:

> Hi,
>
> I can not agree more on this.
> It is well written, but I really think I can get the point of the draft
> faster if I can read the section 5 before section 3.
>
>
> Best Regards,
> Emma (Xuesong)
>
> -----Original Message-----
> From: aqm [mailto:aqm-bounces@ietf.org] On Behalf Of Yoav Nir
> Sent: Tuesday, March 21, 2017 4:03 PM
> To: secdir@ietf.org
> Cc: draft-ietf-aqm-codel.all@ietf.org; ietf@ietf.org; aqm@ietf.org
> Subject: [aqm] Review of draft-ietf-aqm-codel-07
>
> Reviewer: Yoav Nir
> Review result: Has Nits
>
> Hi,
>
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the IESG.
> These comments were written primarily for the benefit of the security area
> directors.  Document editors and WG chairs should treat these comments just
> like any other last call comments.
>
> The document describes the CoDel (controlled delay) framework for reducing
> bufferbloat. It does a good job of describing the problem, outlining the
> solution and providing both a description of the algorithm (including
> pseudo-code) and linking to real world implementations.
>
> Two nits:
>
> 1. A lot of terms are used long before they are explained, such as
> Estimator, Sojourn time, Interval (BTW: if this is a moving interval the
> spec should probably say so). When reading sections 3 I concluded that the
> document was aimed at peopel who already knew all these terms and didn't
> need definitions, but then reading section 5 gave me a lot of a-ha moments
> about what I had read previously.
>
> 2. The security considerations section says "There are no specific
> security exposures associated with CoDel."  CoDel is about dropping
> packets, so immediately I have to think how I could subvert a router
> running CoDel to drop other people's packets. Perhaps it is fine to say
> that there are no known attacks on CoDel and no steps necessary to mitigate
> such, but I think it's tempting fate and hackers to say that CoDel has no
> security exposures.
>
> _______________________________________________
> aqm mailing list
> aqm@ietf.org
> https://www.ietf.org/mailman/listinfo/aqm
>