Subject: AD-review comments on draft-ietf-isis-restart-05.txt

From: Alex Zinin <[email-masked]>
Date: Fri, 19 Dec 2003 22:06:32 -0800

I reviewed the 05v4 rev of the spec. Great document! Very good job!
Some things that should be fixed before I can take this to the IESG:

 - IANA section needs to be included

 - Security Considerations

   This one needs to describe new attacks and threats possible with
   the new TLV and behavior, and then point to the existing security
   mechanisms.

and a small editorial suggestion while you're working on it:

 - In sections 4.1--4.3 would be great to see some text introducing
   the meaning of the columns (e.g. circuit state for the neighbor,
   etc.)

Please let me know when the new rev shows up.
Thanks.

-- 
Alex
http://www.psg.com/~zinin/

---

From: Les Ginsberg <[email-masked]>
Date: Mon, 05 Jan 2004 10:02:33 -0800

Alex -

Attached please find a revised version (dated Jan/2004) which addresses the 
items you have identified below. I also have included a diffs file for your 
convenience.

Please let us know if you have any remaining concerns.

Thanx.

    Les

---

From: Alex Zinin <[email-masked]>
Date: Fri, 9 Jan 2004 14:55:33 -0800

Les,

  Thanks for the update!

  Looking at the security section, I got a question: wouldn't it be
  possible for an adversary to also spoof RR and RA bits and thus
  falsely start or ack graceful restart?

---

From: Les Ginsberg <[email-masked]>
Date: Fri, 09 Jan 2004 15:35:22 -0800

Alex -

Probably a good thing if we discuss this... :-)

The answer to your question is obviously "yes" - but what is the 
significance of this?

First, the introduction of the restart TLV into IIHs does not make IIHs 
easier/harder to spoof.

Now, if someone is able to spoof an IIH, what happens if we receive an 
IIH-RR? If we currently have an adjacency in UP state, it remains in UP 
state. No problem there. And, we may also trigger the sending of a set of 
CSNPs. This would be a waste of cycles, but should cause no harm.

Now, what happens if we receive a spoofed IIH-RA? This is only significant 
to a (re)starting router of course. It might cause T1 to be cancelled on a 
circuit (if we also had received a complete set of CSNPs on that circuit). 
That should not be a problem. In the case that none of our neighbors 
actually support restart, it would prevent T1 from being cancelled on that 
circuit immediately. Which just means it might take a bit longer for 
restart to complete because we would have to wait for "N" expirations of T1 
on that circuit.

None of this seemed worthy of mention, but if you disagree we can add 
something.

We did discuss SA because spoofing in that case could have consequences 
which are not possible without the SA bit.

If others feel that something is lacking, please say so.

    Les

---

From: Alex Zinin <[email-masked]>
Date: Fri, 9 Jan 2004 19:33:01 -0800

Les,

> First, the introduction of the restart TLV into IIHs does not make IIHs 

Agreed. The adversary's work function hasn't changed, though the list of
attacks did.

> None of this seemed worthy of mention, but if you disagree we can add 

The above is essentially a security analysis for those bits :)
Something along these lines would be useful in the security section,
as otherwise it will read as if the RR and RA bits haven't been
analyzed. It should also make the draft easier to pass the review
by the SEC ADs in the IESG.

Regards

Alex

---

From: Les Ginsberg <[email-masked]>
Date: Mon, 12 Jan 2004 07:45:00 -0800

Alex -

Attached is a new version which addresses the security issues discussed 
below. Only the Security section has changed from the previous version.

Please let us know if that adequately addresses your concerns.

Thanx.

    Les

---

From: Alex Zinin <[email-masked]>
Date: Mon, 12 Jan 2004 12:33:54 -0800

Thanks, Les!

Looks great. We're ready to move on.
I just requested that the IETF LC is started for it.

-- 
Alex

---

From: Alex Zinin <[email-masked]>
Date: Mon, 12 Jan 2004 13:14:25 -0800

Les,

  I just realized that you have to submit the new rev before
  the LC is started :) Please do so asap.