Re: [Last-Call] Secdir last call review of draft-ietf-bier-oam-requirements-12

[Barry Leiba <barryleiba@xxxxxxxxxxxx>]

Thanks, Greg, for considering my comments; the text you propose is useful.  I can’t attest to its completeness, as routing and OAM aren’t my expertise.  But it makes it clear that thought was put into this.

Barry

On Wed, Aug 9, 2023 at 6:50 PM Greg Mirsky <gregimirsky@xxxxxxxxx> wrote:

Hi Barry,

thank you for your comments and suggestions. I agree that even though this document lists requirements for BIER OAM, the Security Consideration section should be more useful to a reader. Below is the proposed update:

OLD TEXT:

   This document lists the OAM requirement for a BIER-enabled domain and

   does not raise any security concerns or issues in addition to ones

   common to networking.

NEW TEXT:

   This document lists the OAM requirement for a BIER-enabled domain and

   thus inherits security considerations discussed in [RFC8279] and

   [RFC8296].  Another general security aspect results from using active

   OAM protocols, according to the [RFC7799], in a multicast network.

   Active OAM protocols inject specially constructed test packets, and

   some active OAM protocols are based on the echo request/reply

   principle.  In the multicast network, test packets are replicated as

   data packets, thus creating a possible amplification effect of

   multiple echo responses being transmitted to the sender of the echo

   request.  Thus, an implementation of BIER OAM MUST protect the

   control plane from spoofed replies.  Also, an implementation of BIER

   OAM MUST provide control of the number of BIER OAM messages sent to

   the control plane.

What are your thoughts about the new text? I greatly appreciate your comments, suggestions, and questions.

Regards,

Greg

On Wed, Aug 9, 2023 at 12:09 PM Barry Leiba via Datatracker <noreply@xxxxxxxx> wrote:

Reviewer: Barry Leiba
Review result: Has Issues

The only comment I have from a security standpoint is that the Security
Considerations seem basically absent, saying no more than "Nothing to see
here."  That's common and easy to say, but I expected some explanation of how
the requirements specified in the document are needed to ensure a robust and
secure BIER system.  I wouldn't expect pages of text, but I'm surprised to see
nothing at all.  Is it really the case that an OAM system for BIER would do
nothing to enhance security, nothing to alert us to BIER-specific attacks?

-- 
last-call mailing list
last-call@xxxxxxxx
https://www.ietf.org/mailman/listinfo/last-call