Last Call Review of draft-ietf-bess-bgp-sdwan-usage-19
review-ietf-bess-bgp-sdwan-usage-19-secdir-lc-farrell-2024-02-02-00

Request Review of draft-ietf-bess-bgp-sdwan-usage
Requested revision No specific revision (document currently at 23)
Type Last Call Review
Team Security Area Directorate (secdir)
Deadline 2024-02-15
Requested 2024-02-01
Authors Linda Dunbar , Ali Sajassi , John Drake , Basil Najem , Susan Hares
I-D last updated 2024-02-02
Completed reviews Secdir Last Call review of -19 by Stephen Farrell (diff)
Secdir Telechat review of -20 by Stephen Farrell (diff)
Intdir Telechat review of -16 by Juan-Carlos Zúñiga (diff)
Secdir Telechat review of -15 by Stephen Farrell (diff)
Secdir Last Call review of -14 by Stephen Farrell (diff)
Genart Last Call review of -14 by Dan Romascanu (diff)
Rtgdir Early review of -06 by Shuping Peng (diff)
Assignment Reviewer Stephen Farrell
State Completed
Request Last Call review on draft-ietf-bess-bgp-sdwan-usage by Security Area Directorate Assigned
Posted at https://mailarchive.ietf.org/arch/msg/secdir/mJ_u1bPyYyFzCZqxz3X2rY_tkps
Reviewed revision 19 (document currently at 23)
Result Has issues
Completed 2024-02-02
review-ietf-bess-bgp-sdwan-usage-19-secdir-lc-farrell-2024-02-02-00
I looked at the diff from -15 to -19.

I think the main security issue of depending on BGP over TLS remains - that
seems almost fictional (is it?), whereas the shepherd write-up says: "...this
draft is simply describing the usage of existing technologies standardised
within bess to SD-WAN." I see Roman's existing discuss already covers this.

I note that https://datatracker.ietf.org/doc/draft-wirtgen-bgp-tls/ was posted
since I did the review of -15 of this draft, but that seems to be a fairly
brief -00 individual submission. Presumably that work would have to have
progressed significantly before this draft could reflect reality.

As this draft is aiming to become an informational RFC, I guess one could
rewrite the sections mentioning TLS to say that BGP/TLS is needed for this to
be secure, is not available today, but is something that is being developed
(e.g. referring to draft-wirtgen-bgp-tls). However, doing that before adoption
of a work item for BGP/TLS by some routing WG might well be considered
premature and overly optimistic?