Re: [Idr] New draft submitted: draft-loibl-bacher-idr-flowspec-clarification

Hey Jim,

Indeed I alluded to your and others contributions to generalize flowspec
when I mentioned the intra-domain case. Even putting aside SDN use cases
there still can be valid DDoS filters injected centrally - hence my
comment.

For your point however I (*still*) think it would be much easier and
simpler to put all SDN and related work into Flowspec_v2 and run in in
different SAFI. Yourself, Sue and bunch of other people are actively
helping with. That v2 spec may have completely different validation rules
or not have them at all assuming validation happens on controller only.

IMHO mixing both quite separate use cases will not help each other at all
deployment wise - even if both deployment models are very valid. The reason
being that what knobs work for one flowspec NLRIs for the other could turn
to be harmful. So if we do not separate them and someone would like to use
both it will get pretty ugly soon.

Cheers,
R.

On Tue, Aug 23, 2016 at 4:13 PM, UTTARO, JAMES <ju1738@att.com> wrote:

> Christoph,
>
>         One could also us flow-spec as a mechanism to disseminate
> flow-spec "filters" via an SDN controller. I am my co-authors specified
> changes to the validation procedure such that the unicast route is not
> required for a router to accept and program the slow-spec path/filter.
> When reading through the draft it seems to assume that flow-spec is only
> used as originally intended this is not the case. IMO this is a good piece
> of work and it should broaden the scope to include how flow-spec can be
> used from an SDN Controller.. There are other challenges with the draft as
> originally written
>
> - Order of Traffic Filtering Rules
> - More specific unicast routes
> - AS value position in the AS-Path
>
> Here is the draft..
>
> https://tools.ietf.org/html/draft-ietf-idr-bgp-flowspec-oid-03
>
> Jim Uttaro
>
> -----Original Message-----
> From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of Christoph Loibl
> Sent: Tuesday, August 23, 2016 8:09 AM
> To: idr@ietf.org
> Subject: [Idr] New draft submitted: draft-loibl-bacher-idr-
> flowspec-clarification
>
> Hi,
>
> We submitted a new draft and are happy to receive feedback:
>
> Since interoperability is key to an flowspec Internet deployment we tried
> to clarify the ambiguous parts of the flowspec RFC 5575 in order to allow a
> consistent implementation by equipment vendors.
>
> Title: draft-loibl-bacher-idr-flowspec-clarification
>
> https://datatracker.ietf.org/doc/draft-loibl-bacher-idr-
> flowspec-clarification/
>
> The reason for this draft submission is, that we recently performed a
> rather large flowspec interop test (the main goal was to evaluate possible
> inter-AS flowspec scenarios in a multi vendor environment) and discovered
> many bugs and vendor interop problems that we want to solve.
>
> Unfortunately we currently cannot share all our findings in a test report,
> because we hit some serious bugs that have (under circumstances) potential
> to remotely melt down entire networks and are working with the vendors to
> get bugs fixed.
>
> Christoph
>
> --
> Christoph Loibl
> c@tix.at | CL8-RIPE | PGP-Key-ID: 0x4B2C0055 | http://www.nextlayer.at
>
> _______________________________________________
> Idr mailing list
> Idr@ietf.org
> https://www.ietf.org/mailman/listinfo/idr
>