Re: [GROW] review of draft-ietf-grow-bmp-local-rib-07 (preparing for sheperd write-up)

[Jeffrey Haas <[e-mail]>]

Tim,

On Wed, Nov 04, 2020 at 06:01:14PM +0000, Tim Evens (tievens) wrote:
> I've updated this to UTF-8. From a receiver point of view, we handle utf-8 generically without any special need to deserialize it.  I suggest we do not attempt to define structure and/or constraints around the VRF names as that would severely impact system implementations that are out-of-scope of this draft. 
> 
> How about if we add:
> 
> "The structure, syntax, and constraints for a VRF name are router specific."

I see that you did the change to UTF-8.  My comment wasn't that we should
insist the VRF name has any specific semantics.  The issue is largely that
which is discussed here in RFC 8203:

https://tools.ietf.org/html/rfc8203#section-6

:   This document uses UTF-8 encoding for the Shutdown Communication.
:   There are a number of security issues with Unicode.  Implementers and
:   operators are advised to review Unicode Technical Report #36 [UTR36]
:   to learn about these issues.  UTF-8 "Shortest Form" encoding is
:   REQUIRED to guard against the technical issues outlined in [UTR36].
:
:   As BGP Shutdown Communications are likely to appear in syslog output,
:   there is a risk that carefully constructed Shutdown Communication
:   might be formatted by receiving systems in a way to make them appear
:   as additional syslog messages.  To limit the ability to mount such an
:   attack, the BGP Shutdown Communication is limited to 128 octets in
:   length.

You'll need similar boilerplate comments your security considerations.  In
the absence of such comments, you'll be facing a rather stiff bit of IESG
commentary. :-)

For shorter context for this list, the issue is roughly two things:
- You're sending along a byte string that has implicit lengths for each of
  the encoded characters.  You need to deal with issues when the implicit
  character length is not properly contained in the TLV you get on the wire.
  (This topic is in need of an IETF tutorial.)
- Some of the stuff in UTF-8 is "bad".  You'll want to filter that.

Since we have an RFC that cleared such review comments, including some
flavor of the 8203 security considerations will make your life happier.

-- Jeff