Last Call Review of draft-ietf-dime-ovli-08
review-ietf-dime-ovli-08-secdir-lc-hoffman-2015-07-30-00

Greetings again. This document, "Diameter Overload Indication 


Conveyance", is a way for a Diameter server in a cluster to tell other 


servers in the cluster "don't send so many requests to me". It is pretty 


complex and fiddly, but seems sensible. The security considerations are 


numerous, but fairly well covered in the extensive Security 


Considerations section.






Note that there is not much that can really be done here to address the 


biggest concern of spoofing. As the document says:




   Diameter does not include features to provide end-to-end
   authentication, integrity protection, or confidentiality.  This may
   cause complications when sending overload reports between non-
   adjacent nodes.



(Nice use of "may" there...) So, there isn't much that can be demanded 


of this document without some obvious controls. Still, the Security 


Considerations section covers the likely attacks and problems.




--Paul Hoffman