Subject: [secdir] SecDir review of draft-ietf-pim-hello-intid-01

From: Chris Lonvick <[email-masked]>
Date: Mon, 8 Aug 2011 13:52:39 -0700 (PDT)

Hi,

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

Overall I find the document to be of good quality and I agree that the 
security considerations section is adequate.

While PIM is certainly not my strong suit the document is understandable 
except for the following paragraph from Section 2.1:

    The Local Interface Identifier MUST be non-zero.  The reason for
    this, is that some protocols may want to only optionally refer to an
    Interface using the Interface Identifier Hello option, and use the
    value of 0 to show that it is not referred to.  Note that the value
    of 0 is not a valid ifIndex as defined in [RFC1213].

This seems to be saying that the Local Interface Identifier must not be 0, 
except when some protocol wants to use the Interface Identifier Hello to 
not refer to any actual interface.  Which leaves me confused.

Regards,
Chris

---

From: Chris Lonvick <[email-masked]>
Date: Mon, 8 Aug 2011 13:59:23 -0700 (PDT)

Hi,

Resending because I keep forgetting to remove the "-xx" from the document 
title to make the mailer happy.

Thanks,
Chris

On Mon, 8 Aug 2011, Chris Lonvick wrote:

> except when some protocol wants to use the Interface Identifier Hello to not 
> refer to any actual interface.  Which leaves me confused.
>
> Regards,
> Chris
> _______________________________________________
> secdir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/secdir
> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview
>

---

From: Stig Venaas <[email-masked]>
Date: Tue, 09 Aug 2011 14:32:39 -0700

Thanks for the review, please see below.

On 8/8/2011 1:59 PM, Chris Lonvick wrote:
> Hi,
>
> Resending because I keep forgetting to remove the "-xx" from the
> document title to make the mailer happy.
>
> Thanks,
> Chris
>
>> While PIM is certainly not my strong suit the document is
>> understandable except for the following paragraph from Section 2.1:
>>
>> This seems to be saying that the Local Interface Identifier must not
>> be 0, except when some protocol wants to use the Interface Identifier
>> Hello to not refer to any actual interface. Which leaves me confused.

Perhaps there is a better way to explain it. To see what I'm talking
about, please have a look at section 3.6.2 of
http://tools.ietf.org/html/draft-hou-pim-ecmp-01

The message format includes both Neighbor address and Interface ID,
but use of the Interface ID is optional. If the Neighbor address is
sufficient for uniqueness, then Interface ID 0 is sent. Basically,
the idea is that instead of using some TLV format, it is easier to
always have an Interface ID field, and use the value 0 as saying
not in use, or unspecified.

I'm happy if you can think of a better way of phrasing it.

Stig

---

From: Chris Lonvick <[email-masked]>
Date: Mon, 15 Aug 2011 12:28:56 -0700 (PDT)

Hi Stig,

On Tue, 9 Aug 2011, Stig Venaas wrote:
<some elided>
> I'm happy if you can think of a better way of phrasing it.

How about:

    The Local Interface Identifier is normally non-zero.  Since the value
    of 0 is not a valid ifIndex as defined in [RFC1213], it's use in
    this field has special meaning.  A Local Interface Identifier of 0 will
    indicate that the Router Identifier is sufficiently unique for
    identification for the protocol using it.  For example, this field is
    non-zero when used in IPv4 when one or more RPF neighbors in the ECMP
    bundle are unnumbered.  For other IPv4 usage, this field is zero'ed
    when sent, and ignored when received.  If the "Router ID" part of the
    "Interface ID" is zero, the field MUST be ignored, regardless of its
    value.

Does that work?

Thanks,
Chris

---

From: Chris Lonvick <[email-masked]>
Date: Tue, 16 Aug 2011 05:58:57 -0700 (PDT)

Hi Stig,

On Mon, 15 Aug 2011, Stig Venaas wrote:

> On 8/15/2011 12:28 PM, Chris Lonvick wrote:
>>  Hi Stig,
>>
> No. Maybe I should just remove the rationale and just write:
>
> The Local Interface Identifier MUST be non-zero. Note that the value
> Basically, this document specifies what is sent in this Hello option,
> and the Local Interface Identifier MUST be non-zero. Always. The
> point is that other protocols may have messages containing a value referring 
> to a Local Interface Identifier, and in those messages,
> they may choose to use the invalid Local Interface Identifier value
> 0 to have a special meaning. But it might be better not explaining
> that here?

Ahhh... (Light bulb goes on, etc.)  I'll leave it up to you to include or 
exclude.  Like I said, I'm not well versed in multicast.  If you feel that 
someone who understands the basics will easily catch on to this, then 
leave it in.

>
> For e.g. the ECMP draft, the protocol always include a field that
> may contain an Interface ID. In cases where they don't want to
> reference an ID, they set this field to 0, which is known to be an
> invalid ID.
>
> Note that I don't want to talk about ECMP in this draft, if necessary
> I would like to just modify the current statement:
>
>    The reason for this, is that some protocols may want to only
>    optionally refer to an Interface using the Interface Identifier
>    Hello option, and use the value of 0 to show that it is not
>    referred to.
>
> into some other generic statement saying the same. Would this be
> better?:
>
>    The reason for this, is that some protocols may have messages
>    that optionally reference an Interface Identifier, and they
>    may use the value of 0 to show that no Interface Identifier is
>    being referenced.

I like that wording a bit more.

Thanks,
Chris

---

From: Stig Venaas <[email-masked]>
Date: Mon, 15 Aug 2011 13:08:01 -0700

Basically, this document specifies what is sent in this Hello option,
and the Local Interface Identifier MUST be non-zero. Always. The
point is that other protocols may have messages containing a value 
referring to a Local Interface Identifier, and in those messages,
they may choose to use the invalid Local Interface Identifier value
0 to have a special meaning. But it might be better not explaining
that here?

Stig