Subject: Comments on draft-lindem-ospfv3-dest-filter-01.txt

From: [email-masked]
Date: Tue, 11 May 2004 02:29:42 -0500

Hi Anand/Acee,

I finally got the chance to review the second version of 
the draft draft-lindem-ospfv3-dest-filter-01.txt.

I don't have any objections about the draft but I am still
not convinced about the usefulness of the solution.  Why
couldn't someone just install some ACL rules to do the
same.  Moreover, the solution does not work with the virtual
links (I agree that they are not widely used but..).  I 
think, it is really an implementation detail about where 
to drop these packets.  Ofcourse, I have no objection in 
publishing this as an informational or BCP.

Editorial comments:
- Every sentense should start with 2 spaces after the "."
  (general rule about the IETF documents)

- In the references section, the names should be listed
  as "Gill, V., J. Heasley, and D. Meyer" (first author
  is last-name first-initial and other authors are first-
  initial last-name.)

- "This document is an Internet-Draft and is in full 
   conformance with all provisions of Section 10 of 
   RFC2026." is now "By submitting this Internet-Draft, I 
   certify that any applicable patent or other IPR claims 
   of which I am aware have been disclosed, and any of 
   which I become aware will be disclosed, in accordance 
   with RFC 3668."

- s/the propsed destination/the proposed destination 
  in section 2.1

Regards
Mukesh

---

From: Acee Lindem <[email-masked]>
Date: Tue, 11 May 2004 22:28:17 -0400

Hi Mukesh,

Thanks much for reviewing the document.

----- Original Message -----
> From: <[email-masked]>
> To: <[email-masked]>
> Sent: Tuesday, May 11, 2004 3:29 AM
> Subject: Comments on draft-lindem-ospfv3-dest-filter-01.txt
>

>to drop these packets.

It's true the same could be accomplished with one or more
ACL(s). However, if the same approach is taken for every
protocol/service one could end up having to configure and maintain
quite an extensive administrative ACL (i.e., an ACL applied to packets
to be delivered locally as opposed to all packets received on an interface).
One thing that started us thinking about the problem and the elegance of
simply rejecting all packets without a link-local destination was the OSPF
vulnerabilities work going on in the RPSEC group. With that work in mind, it
seemed natural to have a single mechanism built into OSPFv3. One could use
a knob (so you'd know whether or not virtual link could be configured) or simply
always have the check in force when no virtual links are configured at the
level of application. Finally, dependent on the implemenation and where/how
the ACL(s) is/are applied this solution could be cheaper and simpler (I know I've
opened myself up to all of those who are going to tell me how well they've
implemented their ACLs ;^).

> Ofcourse, I have no objection in

And I always thought this was a spacing mistake.
I'll fix it in this draft.

>  is last-name first-initial and other authors are first-

Will fix this as well.

>   which I become aware will be disclosed, in accordance

Will add. To the best of my knowledge, there are no IPR
claims on this mechanism. We have no intention of making
any.

>- s/the propsed destination/the proposed destination

Got it.

Thanks again,
Acee