Subject: Secdir last call review of draft-ietf-mpls-lsp-ping-lag-multipath-05

From: Linda Dunbar <[email-masked]>
Date: Tue, 11 Dec 2018 12:24:23 -0800

Reviewer: Linda Dunbar
Review result: Ready

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

The summary of the review is Ready with comment

The described mechanism for LSP Multipath Ping is very clear. The Security
Consideration re-uses the description of RFC8029, which is very comprehensive.
It would be better if the draft describes how to prevent intermediate LSRs in
between the Initiating LSR and Responding LSR from mis-using the detailed link
information (e.g. forwarding to somewhere else).

Best Regards,
Linda Dunbar

---

From: Mach Chen <[email-masked]>
Date: Fri, 14 Dec 2018 02:11:21 +0000

Hi Linda,

Thanks for the review!

Some responses inline...

> -----Original Message-----
> From: ietf [mailto:[email-masked]] On Behalf Of Linda Dunbar
> Sent: Wednesday, December 12, 2018 4:24 AM
> To: [email-masked]
> Cc: [email-masked]; [email-masked];
> [email-masked]
> Subject: Secdir last call review of draft-ietf-mpls-lsp-ping-lag-multipath-05
> 
> Reviewer: Linda Dunbar
> Review result: Ready
> 
> I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the IESG.  These
> comments were written primarily for the benefit of the security area
> directors.  Document editors and WG chairs should treat these comments
> just like any other last call comments.
> 
> between the Initiating LSR and Responding LSR from mis-using the detailed
> link information (e.g. forwarding to somewhere else).

The Echo Request and Reply messages are directly exchanged between the Initiating LSR and the Responding LSR, those intermediate LSRs just forward the messages as normal packets, they will not see the detailed link information unless if they inspect and do DPI on every packet forwarded by them. 

The detailed link information is supplied to the Initiating LSR for using, the intermediate LSRs will not try to use it even if they received the information, because there is no corresponding Echo Request to the received Echo Reply.  

Best regards,
Mach