Re: [secdir] secdir review of draft-ietf-sidr-origin-ops-22

[Randy Bush <[e-mail]>]

thanks for the review

> There should probably be an example of the sort of privilege
> escalation attacks that can result from incautious Local-Preference
> attributes.

how about

   Local-Preference may be used to carry both the validity state of a
   prefix along with its traffic engineering (TE) characteristic(s).  It
   is likely that an operator already using Local-Preference will have
   to change policy so they can encode these two separate
   characteristics in the same BGP attribute without negative impact or
   opening privilege escalation attacks.  E.g. do not encode validation
   state in higher bits than used for TE.

or do we need to spell it out with a hammer?

> In Section 4, "along with it's traffic engineering characteristic(s)",
> change "it's" to "its".

<blush>

> Section 5 mentions a block 10.0.666.0/24, which is somewhat
> distracting because that is not a valid IPv4 address block.

it's meant to be clearly invalid.  the standard docco block could not be
used as it was not big enough for the example (ops will laugh at 666 but
freak out and rathole on a prefix longer than a /24).

again, thanks.

randy