Skip to main content

Last Call Review of draft-ietf-pce-pcep-extension-for-pce-controller-10
review-ietf-pce-pcep-extension-for-pce-controller-10-secdir-lc-sheffer-2021-02-06-00

Request Review of draft-ietf-pce-pcep-extension-for-pce-controller
Requested revision No specific revision (document currently at 14)
Type Last Call Review
Team Security Area Directorate (secdir)
Deadline 2021-02-08
Requested 2021-01-25
Authors Zhenbin Li , Shuping Peng , Mahendra Singh Negi , Quintin Zhao , Chao Zhou
Draft last updated 2021-02-06
Completed reviews Rtgdir Last Call review of -09 by Victoria Pritchard (diff)
Genart Last Call review of -11 by Gyan Mishra (diff)
Secdir Last Call review of -10 by Yaron Sheffer (diff)
Secdir Telechat review of -12 by Yaron Sheffer (diff)
Assignment Reviewer Yaron Sheffer
State Completed
Review review-ietf-pce-pcep-extension-for-pce-controller-10-secdir-lc-sheffer-2021-02-06
Posted at https://mailarchive.ietf.org/arch/msg/secdir/HwOlHVfUaxXV-by1zubTTxLl_Fw
Reviewed revision 10 (document currently at 14)
Result Not Ready
Completed 2021-02-06
review-ietf-pce-pcep-extension-for-pce-controller-10-secdir-lc-sheffer-2021-02-06-00
This document defines PCEP extensions for the RFC 8283 architecture, where the
PCE acts as a central controller in an SDN. The document is focused on specific
use cases, referred to as "basic PCECC mode".

Let me state up front that I am not familiar with the PCE architecture other
than what I read up in order to review this document. Having said that, I
suspect that there would be significant value in a security analysis of the
architecture defined here. Having each connection "authenticated and encrypted"
is table stakes nowadays, but is it really enough for very large SDN
deployments that require this level of protocol sophistication?

Details

9.1: "authenticated and encrypted" TLS sessions are typically only
authenticated by the server. Please point out explicitly that mutual
authentication is required. Also, is there no authorization? I would assume a
peer PCE Controller is allowed to do different things than a PCC. Are all PCCs
allowed to issue the same commands/queries, targeted at the same resources?

- RFC 8283 which defines the architecture that is implemented by this draft
says:

[The] security implications of SDN have not been fully discussed or described. 
Therefore, protocol and applicability work-around solutions for this
architecture must take proper account of these concerns.

It is expected that each new document that is produced for a specific use case
will also include considerations of the security impacts of the use of a
PCE-based central controller on the network type and services being managed.

I don't think that the current document addresses this challenge.

In general, this looks like a very monolithic architecture, where everybody
trusts everybody else once they've been authenticated. Although Sec. 9.1
discusses the case of a malicious PCE (which would be rather catastrophic), I
would encourage the authors to consider whether a malicious PCC can also
disrupt the PCE's operations and cause "major impact to the network".