[secdir] secdir review of draft-ietf-6man-spring-srv6-oam
Dan Harkins <dharkins@lounge.org> Thu, 08 April 2021 21:53 UTC
Return-Path: <dharkins@lounge.org>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A564D3A1E44; Thu, 8 Apr 2021 14:53:21 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level:
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hVNrqwwMR1LT; Thu, 8 Apr 2021 14:53:20 -0700 (PDT)
Received: from www.goatley.com (www.goatley.com [198.137.202.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 164123A1E45; Thu, 8 Apr 2021 14:53:19 -0700 (PDT)
Received: from trixy.bergandi.net (cpe-76-176-14-122.san.res.rr.com [76.176.14.122]) by wwwlocal.goatley.com (PMDF V6.8 #2433) with ESMTP id <0QR915J24M4TOA@wwwlocal.goatley.com>; Thu, 08 Apr 2021 16:53:17 -0500 (CDT)
Received: from blockhead.local ([69.12.173.8]) by trixy.bergandi.net (PMDF V6.7-x01 #2433) with ESMTPSA id <0QR900D7SM4R5A@trixy.bergandi.net>; Thu, 08 Apr 2021 14:53:16 -0700 (PDT)
Received: from 69-12-173-8.static.dsltransport.net ([69.12.173.8] EXTERNAL) (EHLO blockhead.local) with TLS/SSL by trixy.bergandi.net ([10.0.42.18]) (PreciseMail V3.3); Thu, 08 Apr 2021 14:53:16 -0700
Date: Thu, 08 Apr 2021 14:53:16 -0700
From: Dan Harkins <dharkins@lounge.org>
To: last-call@ietf.org
Cc: "secdir@ietf.org" <secdir@ietf.org>, draft-ietf-6man-spring-srv6-oam.all@ietf.org
Message-id: <e99f57d9-af94-3e49-c982-4a8956a01392@lounge.org>
MIME-version: 1.0
Content-type: text/plain; charset="utf-8"; format="flowed"
Content-language: en-US
Content-transfer-encoding: 8bit
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Thunderbird/78.7.1
X-PMAS-SPF: SPF check skipped for authenticated session (recv=trixy.bergandi.net, send-ip=69.12.173.8)
X-PMAS-External-Auth: 69-12-173-8.static.dsltransport.net [69.12.173.8] (EHLO blockhead.local)
X-PMAS-Software: PreciseMail V3.3 [210407b] (trixy.bergandi.net)
X-PMAS-Allowed: system rule (rule allow header:X-PMAS-External noexists)
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/FeTu7x7-okw7w7-T6dZRFhJHpAo>
Subject: [secdir] secdir review of draft-ietf-6man-spring-srv6-oam
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 08 Apr 2021 21:53:22 -0000
Hello, First of all, my apologies for the tardiness of this review.... I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. The summary of the review is (almost) Ready With Issues. This draft defines a flag in the Segment Routing Header that when set will result a copy of the packet being made and forwarded for "telemetry data collection and export." That has tremendous security and privacy implications that are not mentioned at all in the Security Considerations. The Security Considerations just say that there's nothing here beyond those described in <list of other RFCs>. I don't think that's the case. Maybe I'm completely missing something but this sounds to me like it enables what we used to call "service spy mode" on a router-- take a flow and fork a copy off to someone else. I think there needs to be a lot more discussion of the implications of this. Again, sorry for the tardiness of this review. regards, Dan. -- "The object of life is not to be on the side of the majority, but to escape finding oneself in the ranks of the insane." -- Marcus Aurelius
- [secdir] secdir review of draft-ietf-6man-spring-… Dan Harkins
- Re: [secdir] secdir review of draft-ietf-6man-spr… Zafar Ali (zali)