Re: [secdir] Review of draft-ietf-bfd-seamless-base-09

"Carlos Pignataro (cpignata)" <cpignata@cisco.com> Wed, 04 May 2016 17:28 UTC

Return-Path: <cpignata@cisco.com>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0391D12D72A for <secdir@ietfa.amsl.com>; Wed, 4 May 2016 10:28:09 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -15.517
X-Spam-Level:
X-Spam-Status: No, score=-15.517 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.996, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id prss2LUpU9jl for <secdir@ietfa.amsl.com>; Wed, 4 May 2016 10:28:07 -0700 (PDT)
Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3C65412D77B for <secdir@ietf.org>; Wed, 4 May 2016 10:28:07 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3569; q=dns/txt; s=iport; t=1462382887; x=1463592487; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=dI/5Dw2DnFy3a9UplUyhGFMWSuqbXG+xP88HkQalNsA=; b=c1pWC7eA43eMxlxaquLUv80I0DGBwwojIl6xpdvxuf/DiZ20/+EN7W3q pVUtsrTml6gS5BcaIyXCkGs6pZyDt0qJCheCQTybDq6pTrg1GcgKUhbrO IQS+D3YeGcJeFtOf+RXJCm6UZFndYtEIlh2As232S6ed81xrs1IinIMJC M=;
X-Files: signature.asc : 841
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0DmAgAJMCpX/4MNJK1egziBUAa5Yw6BdoYQAoE3OBQBAQEBAQEBZSeEQQEBAQMBeQULAgEIGC4yJQIEDgUOiBQIvUwBAQEBAQEBAQEBAQEBAQEBAQEBAQENCIYggXaCV4dqgi4FmBkBgyeBZ4kJgWiETYMphTWPMwEeAUODa2yHPX8BAQE
X-IronPort-AV: E=Sophos;i="5.24,578,1454976000"; d="asc'?scan'208";a="103693177"
Received: from alln-core-1.cisco.com ([173.36.13.131]) by rcdn-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 04 May 2016 17:28:06 +0000
Received: from XCH-RTP-016.cisco.com (xch-rtp-016.cisco.com [64.101.220.156]) by alln-core-1.cisco.com (8.14.5/8.14.5) with ESMTP id u44HS5YX011619 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Wed, 4 May 2016 17:28:06 GMT
Received: from xch-rtp-020.cisco.com (64.101.220.160) by XCH-RTP-016.cisco.com (64.101.220.156) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Wed, 4 May 2016 13:28:05 -0400
Received: from xch-rtp-020.cisco.com ([64.101.220.160]) by XCH-RTP-020.cisco.com ([64.101.220.160]) with mapi id 15.00.1104.009; Wed, 4 May 2016 13:28:05 -0400
From: "Carlos Pignataro (cpignata)" <cpignata@cisco.com>
To: Shawn M Emery <shawn.emery@oracle.com>
Thread-Topic: Review of draft-ietf-bfd-seamless-base-09
Thread-Index: AQHRpcyaOBkyOQUqSUukdtw7hgg2c5+pTBUA
Date: Wed, 04 May 2016 17:28:05 +0000
Message-ID: <66BCC017-7C31-4B98-AA00-BFA19F72505E@cisco.com>
References: <56908353.5050200@oracle.com> <5729944D.4040403@oracle.com>
In-Reply-To: <5729944D.4040403@oracle.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
x-ms-exchange-messagesentrepresentingtype: 1
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [10.150.49.250]
Content-Type: multipart/signed; boundary="Apple-Mail=_AED0665B-1D64-45B0-AD9D-9F814B47B2CA"; protocol="application/pgp-signature"; micalg="pgp-sha256"
MIME-Version: 1.0
Archived-At: <http://mailarchive.ietf.org/arch/msg/secdir/JIowJs47zx0221HXagAJ4fs1bzg>
Cc: "draft-ietf-bfd-seamless-base.all@tools.ietf.org" <draft-ietf-bfd-seamless-base.all@tools.ietf.org>, "secdir@ietf.org" <secdir@ietf.org>
Subject: Re: [secdir] Review of draft-ietf-bfd-seamless-base-09
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 04 May 2016 17:28:09 -0000

Thanks Shawn for taking the time to read and review, and catching all those Editorials as part of the SecDir Review.

All fixed, — I am sure the RFC Editor will fix all the remaining ones, and the ones you might have missed.

— Carlos.

> On May 4, 2016, at 2:18 AM, Shawn M Emery <shawn.emery@oracle.com> wrote:
> 
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the IESG.
> These comments were written primarily for the benefit of the security
> area directors. Document editors and WG chairs should treat these
> comments just like any other last call comments.
> 
> This draft specifies a version of Bidirectional Forwarding Detection (BFD) that
> allows for better efficiencies in provisioning and path monitoring of network
> node infrastructure.
> 
> The security considerations section does exist and asserts that the security
> considerations that pertains to the base BFD protocol, RFC 5880, also applies
> to this protocol.  The section continues with guidance on authenticating data,
> replay, and DoS avoidance, specific to this protocol.  I agree with most of the
> recommendations outlined and assertions presented in this section.  5880 is
> forthcoming with the various vulnerabilities/limitations of the base protocol.
> However, the draft does not cover the case where an attacker impersonates the
> SBFDInitiator, but does cover the SBFDReflector scenario.
> 
> General comments:
> 
> None.
> 
> Editorial comments:
> 
> s/Once above setup/Once the above setup/
> s/it can quickly/can quickly/
> s/and IS-IS will advertises/and IS-IS advertises/
> s/then response S-BFD/then a response S-BFD/
> s/allocated a same/allocated the same/
> s/Remainder of this/The remainder of this/
> s/for above suggestions/for the suggestions above/
> s/that discriminator/that the discriminator/
> s/for a same/for the same/
> s/is to have following/has the following/
> ... I stopped after this.  Please have someone review the rest of the draft for
> grammar.  It will be hard to read w/o these updates.
> 
> Shawn.
> --
>