Subject: [secdir] Secdir early review of draft-ietf-idr-bgp-optimal-route-reflection-21

From: Linda Dunbar via Datatracker <[email-masked]>
Date: Tue, 15 Dec 2020 13:56:11 -0800

Reviewer: Linda Dunbar
Review result: Has Nits

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area directors.
 Document editors and WG chairs should treat these comments just like any other
 last call comments.

This document alters how  BGP Route Reflector computes the optimal routes on
behalf of clients. Instead using its own IGP cost to the AS Exit points, the
document describes the steps for RR to compute the optimal route by using 
Clients' position to the AS Exit points. The described method is useful when RR
is centralized.  For deployment with distributed RR closer to the clients, the
described method doesn't have any benefits.

Security Concern:
If RR's information of its clients topology is compromised, then the optimal
paths selected by the RR might not be accurate anymore.

Minor nits:
Page 7: Section 3.2.

"If the routing routing optimization requires ..."
Is it a typo? duplicated word "routing"?

Last sentence: "This needed for use cases ..."
Do you mean "This is needed for use cases ..."

Cheers,
Linda Dunbar

---

From: <[email-masked]>
Date: Wed, 16 Dec 2020 10:54:11 +0000

Hi Linda,

Thanks for your review.
Please see comments in line

> From: Linda Dunbar via Datatracker [mailto:[email-masked]]
> 
> Reviewer: Linda Dunbar
> Review result: Has Nits
> 

I agree with the analysis.
But it's not clear to me whether you are asking something to be added in the draft.
I'm seeing two cases:
- If the selected IGP location is configured on the router (RR), the attack requires the ability to change the configuration of the router. If an attacker can do this, it can do virtually anything (within the router capability). I don't feel that "securing access to the router configuration" is a typical point added in the security consideration although it probably applies to many documents.
- If the selected IGP location is implicit by using the IP address of the client IBGP session there is no new thing to compromise.

> Do you mean "This is needed for use cases ..."

Thanks for the nits.
Corrected in my local version.

 Cheers,
--Bruno

> Linda Dunbar

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

---

From: Linda Dunbar <[email-masked]>
Date: Wed, 16 Dec 2020 15:38:08 +0000

Bruno, 

Yes, your explanation makes sense. It would be useful to add your explanation to the Security Consideration. 

Thank you. 

Linda 

-----Original Message-----
From: [email-masked] <[email-masked]> 
Sent: Wednesday, December 16, 2020 4:54 AM
To: Linda Dunbar <[email-masked]>; [email-masked]
Cc: [email-masked]; [email-masked]
Subject: RE: Secdir early review of draft-ietf-idr-bgp-optimal-route-reflection-21

Hi Linda,

Thanks for your review.

> I have reviewed this document as part of the security directorate's 
> ongoing effort to review all IETF documents being processed by the 
> IESG.  These comments were written primarily for the benefit of the 
> security area directors.
>  Document editors and WG chairs should treat these comments just like 
> any other  last call comments.
> 
> This document alters how  BGP Route Reflector computes the optimal 
> routes on behalf of clients. Instead using its own IGP cost to the AS 
> Exit points, the document describes the steps for RR to compute the 
> optimal route by using Clients' position to the AS Exit points. The 
> described method is useful when RR is centralized.  For deployment 
> with distributed RR closer to the clients, the described method 
> doesn't have any benefits.
> 
> Security Concern:
> If RR's information of its clients topology is compromised, then the 
> optimal paths selected by the RR might not be accurate anymore.

Thanks for the nits.

 Cheers,
--Bruno

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.