[trill] Alvaro Retana's Discuss on draft-ietf-trill-directory-assisted-encap-10: (with DISCUSS)

[Alvaro Retana <[e-mail]>]

Alvaro Retana has entered the following ballot position for
draft-ietf-trill-directory-assisted-encap-10: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-trill-directory-assisted-encap/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

I have significant concerns about this document; as currently written, I
believe the technology is underspecified and can cause significant damage to a
DC network where it might be deployed.  I am then balloting a DISCUSS.

The document (including the security considerations) is written assuming that
the TRILL-ENs can be trusted (and are not compromised), and that the directory
information is accurate.  However, I believe there are several cases that have
been overlooked.

(1) There aren't any basic safeguards specified to at least make sure that a
TRILL-EN is doing the right thing (or something sensible).  For example, what
if the Ingress RBridge Nickname field in the TRILL header doesn't correspond to
the first rBridge at the domain boundary?  Should that frame be accepted?

(2) rfc8171 talks about issues with incorrect directory mappings.  Consider the
case where a TRILL-EN uses (on purpose!) an incorrect mapping.  That "can
result in data being delivered to the wrong end stations, or set of end
stations in the case of multi-destination packets, violating security policy."
[rfc8171]  How can this risk be mitigated?

I don't think that there are easy mitigations for these issues, but at least
mentioning them so that operators are aware of the risk would be enough to
clear this DISCUSS.