Subject: Re: [pim] Comments on draft-gulrajani-pim-hello-intid-00.txt

From: Stig Venaas <[email-masked]>
Date: Wed, 06 Apr 2011 13:10:28 -0700

On 3/29/2011 5:35 AM, G. Fairhurst wrote:
>
> i promised to read this and comment on the list.

Thanks, I've made some changes now. I'll submit it
shortly as 01 unless you have any further comments.
>
> This looks like a useful thing to publish as a PS.
>
> I have a few comments:
>
> S 2.2
> " it needs to be
> unique depends on the protocol utilizing it."
> - wording, is this better:
> "The requirements for the scope in which it needs to be unique depend o
> the protocol that utilises this."
> - Actually this is the one point that I do not yet see. It seems that
> without a default level of scope, there is no clear way that different
> protocols can reliably use the same mechanism. Is it possible just to
> say that the router should use an IPv4 unicast address assigned to the
> router by default (preferably a public address if one is defined). There
> is no problem allowing an operator to reassign the value, and it then
> becomes a matter of correct implementation.

I did some changes, but kept most of the old text. It now says:

    The 32 bit Router Identifier may be used to uniquely identify
    the router.  It may be selected to be unique within some
    administrative domain, or possibly globally unique.  The
    requirements for the scope in which it needs to be unique
    depend on the protocol that utilizes this.  A router
    implementation MAY choose an IPv4 unicast address assigned
    to the router as the Router Identifer, but MUST allow the
    identifier to be configured manually. Protocols like BGP
    [RFC4271] and OSPFv2 [RFC2328] are other protocols making
    use of 32 bit identifiers for routers.  One may use the same
    identifier to construct the Interface Identifier option,
    provided it meets the stability and uniqueness requirements
    of protocols making use of this option.

> S 2.2
> "Routers often have such
> an identifier derived from an IPv4 address or manual configuration."
> - but if you want it to be useful to multiple protocols then it may need
> more care.
>
> Security Considerations
>
> - The vulnerabilities discussed appear to be the same as for other PIM
> usage. These relate to on-link attacks that spoof a Hello message. An
> attacker able to do could also be able to manipulate other params to
> disrupt operation of a PIM router.

Are you suggesting removing most of it and just have kind of the
standard PIM blanket statement?

>
> References:
> "[I-D.ietf-pim-port]"
>
> - This doesn't need to be a normative reference to this draft to me,
> although PORT needs to normatively cite this.

Yes, not sure how it ended up as a reference, removed.

Thanks,

Stig

> Gorry

---

From: Gorry Fairhurst <[email-masked]>
Date: Thu, 07 Apr 2011 08:29:45 +0100

A few comments in line.

> of protocols making use of this option.
Works for me.

> standard PIM blanket statement?
I'm suggesting that you start by stating the vulnerability is the same 
as for other PIM protocol. These protocols are vulnerable to an on-link 
attack,  etc.

- you can then be as specific as you like.
- my hope was this this effectively declares the group has thought and 
there are no important issues that need to be discussed.

> Yes, not sure how it ended up as a reference, removed.
It may be OK as an INFORMATIVE reference to an example of use.

---

From: Stig Venaas <[email-masked]>
Date: Thu, 07 Apr 2011 10:25:31 -0700

Thanks, see below.

> as for other PIM protocol. These protocols are vulnerable to an on-link

The old text did this to some extent. I now changed to:

    The Interface Identifier is included in PIM Hello Messages.
    See [RFC4601] for security considerations regarding PIM Hello
    Messages.  In particular, PIM Hello messages may be forged, and
    may include an arbitrary Interface Identifier, or it may be
    intentionally omitted.  The effects of this depend on how the
    Interface Identifier is used by other protocols.

> It may be OK as an INFORMATIVE reference to an example of use.

You're right of course. I still had the example. Made it informative :)

Stig

>> Stig
>>
>>> Gorry
>>
>>
>
> _______________________________________________
> pim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pim

---

From: Stig Venaas <[email-masked]>
Date: Thu, 07 Apr 2011 12:05:39 -0700

On 4/7/2011 11:45 AM, Gorry Fairhurst wrote:
> Looks good Stig!

Thanks, I've now submitted version 01 based on your comments,
and the comments from the pim wg meeting. I hope this version
can be considered for adoption by the wg then.

Stig

---

From: Gorry Fairhurst <[email-masked]>
Date: Thu, 07 Apr 2011 19:45:32 +0100

Looks good Stig!

Gorry