Subject: [secdir] secdir review of draft-ietf-mpls-special-purpose-labels-05 (resend)

From: Tom Yu <[email-masked]>
Date: Mon, 10 Mar 2014 17:34:31 -0400

[Sorry for the resend; I got the tools address for the draft wrong at
first.]

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

Summary: ready with nits

I believe the Security Considerations section of this document is
reasonable.

Query: I'm not very familiar with MPLS; is the handling of the Entropy
Label Indicator the only situation where a Label Switching Router
would need to inspect (as opposed to hash for load balancing) labels
below the top of the label stack?

I was confused by the explanation of why Label 7 (ELI) has meaning as
both an ordinary Special Label and an Extended Special Purpose Label
until I read RFC 6790.  Perhaps explain that looking for the ELI is
typically the only reason why a LSR would inspect the middle of the
label stack?

Re answer 6 of Section 3:

If an ingress LSR pushes ESPLs onto the label stack, any downstream
LSRs that do not understand ESPLs could erroneously use the ESPLs as
load balancing inputs.  Would it be a good idea to recommend that
ingress LSRs avoid pushing ESPLs onto the label stack if their policy
cannot tolerate variations in downstream load balancing caused by
inappropriate use of the ESPLs as load balancing inputs by downstream
LSRs that don't understand ESPLs?

---

From: "Adrian Farrel" <[email-masked]>
Date: Tue, 18 Mar 2014 11:15:52 -0000

Hi Tom,

> below the top of the label stack?

Welcome to the wonderful world of MPLS, and thanks for your review.

RFC 6790 Section 4.3 says 
   In any case, reserved labels MUST NOT be used as
   keys for the load-balancing function.
but it is recognised that some implementations might currently be hashing the
label stack without inspection.

So, the technically correct answer is that every reserved label (aka special
purpose label) is such a case, and (since no-one knows what labels will show up
in the stack) it means that all labels used for hashing must be inspected.

> typically the only reason why a LSR would inspect the middle of the

Well, this is being changed (somewhat in the face of mutterings from two of the
authors) so that 7 is reserved in the extended range. Hence, no need to explain
or discuss :-)

> LSRs that don't understand ESPLs?

You are right about that.
The LSR would spot the XL and know that it was a special purpose label and so
would not use it.
But it would not know that the XL meant that the next label was also a special
purpose label and so would include that label in the hash.

And, indeed, this is what the answer to Question 6 observes. And the answer also
notes that reordering may occur in these situations (perhaps we thought it
obvious that if you don't want reordering to occur you had better avoid this
situation?). I think that also in our minds is that this whole piece of work is
considerably future-sighted. we don't anticipate the first extended special
purpose label being assigned for a number of years, so this document enables
hardware to be built and deployed that will be proof against the introduction of
ESPLs when they roll up.

Thanks,
Adrian