Subject: [ippm] Eric Rescorla's No Objection on draft-ietf-ippm-twamp-yang-11: (with COMMENT)

From: Eric Rescorla <[email-masked]>
Date: Tue, 19 Jun 2018 15:10:26 -0700

Eric Rescorla has entered the following ballot position for
draft-ietf-ippm-twamp-yang-11: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ippm-twamp-yang/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Rich version of this review at:
https://mozphab-ietf.devsvcdev.mozaws.net/D3912

COMMENTS
S 6.1.
>      Figure 8 shows a configuration example for a Control-Client with
>      client/admin-state enabled.  In a real implementation following
>      Figure 2 this would permit the initiation of TWAMP-Control
>      connections and TWAMP-Test sessions.
>   
>      [note: '\' line wrapping is for formatting only]

Most of these examples do not contain any line wrapping.

S 7.
>        </twamp>
>      </data>
>   
>   7.  Security Considerations
>   
>      The YANG module specified in Section 5 this document defines a schema

Some words about the threat model would be appreciated here. Is the
assumption that the two sender and the reflector are owned by whoever
runs the network and therefore they are not mounting an attack? If
not, what is the model?

---

From: Mahesh Jethanandani <[email-masked]>
Date: Tue, 19 Jun 2018 22:59:35 -0700

Hi Eric,

> On Jun 19, 2018, at 3:10 PM, Eric Rescorla <[email-masked]> wrote:
> 

Will fix it.

> runs the network and therefore they are not mounting an attack? If

My co-authors will correct me if I am wrong, but generally, the Control-Client, Session-Sender, the Server and the Session-Reflector are owned by the same operator. The attack if any would be launched by a third party trying to access the test infrastructure in order to disrupt its operation. They could do that by overwriting the configuration of any of the four logical entities within the model.

Does that help? If so, I can try to phrase something around it in the Security Considerations section.

Thanks.

Mahesh Jethanandani
[email-masked]

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 19 Jun 2018 23:02:22 -0700

On Tue, Jun 19, 2018 at 10:59 PM, Mahesh Jethanandani <
[email-masked]> wrote:

> My co-authors will correct me if I am wrong, but generally, the
> Control-Client, Session-Sender, the Server and the Session-Reflector are
> owned by the same operator. The attack if any would be launched by a third
> party trying to access the test infrastructure in order to disrupt its
> operation. They could do that by overwriting the configuration of any of
> the four logical entities within the model.
>

It does. Do you think you could add something

-Ekr

---

From: "MORTON, ALFRED C (AL)" <[email-masked]>
Date: Wed, 20 Jun 2018 12:24:34 +0000

Hi Eric and Mahesh,

From: Eric Rescorla [mailto:[email-masked]]
Sent: Wednesday, June 20, 2018 2:02 AM
To: Mahesh Jethanandani <[email-masked]>
Cc: The IESG <[email-masked]>; Nalini Elkins <[email-masked]>; [email-masked]; [email-masked]; [email-masked]
Subject: Re: Eric Rescorla's No Objection on draft-ietf-ippm-twamp-yang-11: (with COMMENT)

On Tue, Jun 19, 2018 at 10:59 PM, Mahesh Jethanandani <[email-masked]<mailto:[email-masked]>> wrote:
Hi Eric,
[acm] …snip…

-Ekr
[acm]
Of course. FYI – there was a suggestion to use TWAMP across
peering links but ICMP was used instead (the KISS principle won).

Something like:

Virtually all existing measurement systems using TWAMP are
administrated by the same network operator. Attacks on the
measurement infrastructure could be launched by third-parties
to commandeer the packet generation capability, corrupt the
measurements, or other examples of nefarious acts.

Thanks.

Mahesh Jethanandani
[email-masked]<mailto:[email-masked]>

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 20 Jun 2018 09:30:04 -0700

Sure

On Wed, Jun 20, 2018 at 5:24 AM, MORTON, ALFRED C (AL) <[email-masked]
> wrote:

> Hi Eric and Mahesh,
>
>
>
> *From:* Eric Rescorla [mailto:[email-masked]]
> *Sent:* Wednesday, June 20, 2018 2:02 AM
> *To:* Mahesh Jethanandani <[email-masked]>
> *Cc:* The IESG <[email-masked]>; Nalini Elkins <
> [email-masked]>; [email-masked];
> [email-masked]; [email-masked]
> *Subject:* Re: Eric Rescorla's No Objection on
> draft-ietf-ippm-twamp-yang-11: (with COMMENT)
>
>
>
>
>
>
>
> *[acm] *…snip…
> *[acm] *
> *Of course. FYI – there was a suggestion to use TWAMP across*
>
> *peering links but ICMP was used instead (the KISS principle won).*
>
>
>
> *Something like:*
>
>
>
> *Virtually all existing measurement systems using TWAMP are *
>
> *administrated by the same network operator. Attacks on the *
>
> *measurement infrastructure could be launched by third-parties*
>
> *to commandeer the packet generation capability, corrupt the*
>
> *measurements, or other examples of nefarious acts.*
>
>
>
>
> Thanks.
>
> >
> >
>
> Mahesh Jethanandani
> [email-masked]
>
>
>