Subject: Re: [Isis-wg] WG Last Call for for draft-ietf-isis-pcr

From: Eric Gray <[email-masked]>
Date: Wed, 2 Sep 2015 19:39:20 +0000

Authors,

                I have the following comments on the draft…

                We start section 4 with the statement: “An explicit tree is determined by a Path Computation
Element (PCE) …”

                I believe that explicit trees may be determined without using a PCE, even if we might prefer
to use a PCE.  One could, for example, construct one on paper.

I suspect we could say:

-          “Explicit trees may be determined in some fashion.  For example, an explicit tree may be

determined by a Path Computation Element (PCE) [RFC4655].  A PCE is an entity that is

capable of computing a topology for forwarding based on a network topology, its

corresponding attributes, and potential constraints.  If a PCE is used, it MUST explicitly

describe a forwarding tree as described in Section 6.1.  Either a single PCE or multiple

PCEs determine explicit trees for a domain.  Even if there are multiple PCEs in a domain,

each explicit tree MUST be determined only by one PCE, which is referred to as the owner

PCE of that tree.  PCEs and IS-IS PCR can  be used in combination with IS-IS shortest path

bridging.

“The remainder of this section, and subsequent sections, are written assuming PCE use.”

A few minor points (reflected in the above re-wording):

-          “MUST be only determined by one PCE” is awkward (implies everything else has to be done by

another PCE).

-          “SPB shortest path routing” is either redundant or incorrect.

-          It would  be very difficult to re-write the section to avoid dependence on PCE, but I suspect a

statement to the effect that PCE is assumed will allow it to be read without loss of generality.

-          I left out the bit about not being required to follow shortest path as this seems obvious.

I am not sure how the second paragraph in the security considerations section is related to security, as
it is currently worded.

As I understand it, the issue that the paragraph aims to address has to do with a vulnerability that may
exist when multiple PCEs are used and may be independently managed.  In particular, the importance
parameter could be used maliciously by one PCE to ensure that it gets reservations.

This is simply one variation of a general PCE issue; an independently managed, non-cooperating PCE is
indistinguishable from a PCE impersonation (in the sense used in the Security Considerations section of
RFC 4655).

We may want to consider replacing the current second paragraph with the following two paragraphs.

Any mechanism that chooses forwarding paths, and allocates resources to those paths, is potentially
vulnerable to attack.  The security considerations section of RFC 4655 describes the risks associated
with the use of PCE for this purpose and should be referred to.  Use of any other means to determine
paths should only be used after considering similar concerns.

Because the mechanism assumed for distributing tree information relies on IS-IS routing, IS-IS routing
security considerations (Section 6, RFC 1195) and mechanisms (e.g. – RFC 5310)  used to authenticate
peer advertisements apply.

--
Eric

Subject:

[Isis-wg] WG Last Call for for draft-ietf-isis-pcr

Date:

Mon, 24 Aug 2015 09:54:27 -0400

From:

Christian Hopps <[email-masked]><mailto:[email-masked]>

To:

ISIS-WG <[email-masked]><mailto:[email-masked]>

CC:

Hannes Gredler <[email-masked]><mailto:[email-masked]>

Hi Folks,

We are starting a WG Last Call on the following draft.

“IS-IS Path Computation and Reservation”

https://datatracker.ietf.org/doc/draft-ietf-isis-pcr/

The LC is set to expire 3 weeks from now (allowing for common vacation

time) on Monday, September 14, 2015.

Thanks,

Chris & Hannes.

_______________________________________________

Isis-wg mailing list

[email-masked]<mailto:[email-masked]>

https://www.ietf.org/mailman/listinfo/isis-wg

---

From: János Farkas <[email-masked]>
Date: Fri, 4 Sep 2015 17:22:54 +0200

Hi Eric,

Thank you very much for your review and comments!

> to use a PCE.  One could, for example, construct one on paper.
I agree.

>
> I suspect we could say:
>
> -“Explicit trees may be determined in some fashion.  For example, an 
> explicit tree may be
>
> determined by a Path Computation Element (PCE) [_RFC4655_].  A PCE is 
> an entity that is
>
> describe a forwarding tree as described in _Section 6.1_.  Either a 
> single PCE or multiple
>
> -“MUST be only determined by one PCE” is awkward (implies everything 
> else has to be done by
>
> another PCE).
>
> -“SPB shortest path routing” is either redundant or incorrect.
>
> -It would  be very difficult to re-write the section to avoid 
> dependence on PCE, but I suspect a
>
> -I left out the bit about not being required to follow shortest path 
> as this seems obvious.
>
I agree with the wording you propose.
I will update the text according to your proposal if there are no 
further comments on it.

> exist when multiple PCEs are used and may be independently managed.  
> In particular, the */importance/*
>
> indistinguishable from a */PCE impersonation/* (in the sense used in 
> the Security Considerations section of
>
> RFC 4655).
>
I agree with your points.
I agree that referring to PCE security considerations of RFC 4655 is 
missing; and adding it makes the security considerations more generic 
and thus covering the particular case pointed on in the current version.

> peer advertisements apply.
I will replace the second paragraph with these ones you suggested if 
there are no further comments.

Thank you and regards,
Janos

> *Subject: *
> *Date: *
> *From: *
> Christian Hopps <[email-masked]> <mailto:[email-masked]>
>
> *To: *
>
> 	
>
> ISIS-WG <[email-masked]> <mailto:[email-masked]>
>
> *CC: *
>
> 	
>
> Hannes Gredler <[email-masked]> <mailto:[email-masked]>
>
> Hi Folks,
>   
> [email-masked]  <mailto:[email-masked]>

---

From: János Farkas <[email-masked]>
Date: Fri, 18 Sep 2015 12:34:04 +0200

Hi,

The draft has been updated according to the comments received during WG 
Last Call. The new revision is available at: 
https://tools.ietf.org/html/draft-ietf-isis-pcr-02.

Thanks and regards,
Janos

On 9/4/2015 5:22 PM, János Farkas wrote:
> [email-masked]