Last Call Review of draft-ietf-manet-dlep-lid-extension-05
review-ietf-manet-dlep-lid-extension-05-secdir-lc-cam-winget-2019-08-12-00

Request Review of draft-ietf-manet-dlep-lid-extension
Requested rev. no specific revision (document currently at 06)
Type Last Call Review
Team Security Area Directorate (secdir)
Deadline 2019-08-15
Requested 2019-08-01
Authors Rick Taylor, Stan Ratliff
Draft last updated 2019-08-12
Completed reviews Genart Last Call review of -05 by Stewart Bryant (diff)
Secdir Last Call review of -05 by Nancy Cam-Winget (diff)
Assignment Reviewer Nancy Cam-Winget
State Completed
Review review-ietf-manet-dlep-lid-extension-05-secdir-lc-cam-winget-2019-08-12
Posted at https://mailarchive.ietf.org/arch/msg/secdir/odCdZEtCJj9iE8LyAK3pubaRu6I
Reviewed rev. 05 (document currently at 06)
Review result Has Issues
Review completed: 2019-08-12

Review
review-ietf-manet-dlep-lid-extension-05-secdir-lc-cam-winget-2019-08-12

SECDIR review of draft-ietf-manet-dlep-lid-extension-05

Reviewer: Nancy Cam-Winget
Review result: Ready with questions (issues?)

I have reviewed this document as part of the security directorate'sÊ
ongoing effort to review all IETF documents being processed by theÊ
IESG.ÊÊThese comments were written primarily for the benefit of theÊ
security area directors.ÊÊDocument editors and WG chairs should treatÊ
these comments just like any other last call comments.


This document defines extensions to the Data Link Exchange Protocol (DLEP) to enable modems to advertise the status of wireless links that are not reachable beyond a device on the Layer 2 domain. The extension focuses on the inclusion of IPv4 or IPv6 address(es) to DLEP when the modems provide Layer 3 connectivity.

As this is not my area of domain expertise, I have the following questions:
* It seems that WANs could include NATs but I see no consideration for how to treat the IP addresses in the presence of NAT.  Is this not an issue?   I think some mention of this should be included.

* Section 2.1: What happens if Link Identifiers span multiple MAC Addresses or if they are reused?  What does it mean for a link identifier to be reused (per session? or ever?)  There is a reference to the destination MUST NOT be recycled, but I am not sure what recycled means in this context?  What happens if they are reused?  A note either here, or in the security considerations should describe these conditions.

* Section 2.2: what happens if "link identifiers" is negotiated but no link identifiers are provided?

* Security (no privacy considerations?): given that this draft is now including IP addresses, it seems that there is potential to determine a network topology and perhaps identification of a network used to mount attacks.  I do see that RFC 8175 doesn't have privacy considerations, but given that this is now at the IP layer it may be good to provide one?