Re: [Idr] Adoption of draft-djsmith-bgp-flowspec-oid-01 as IDR WG document

[Robert Raszuk <[e-mail]>]

Hi Keyur,

Actually you bring a good point. Going by section 6 would preclude 
reception of flow-spec routes across IX route servers as in those cases 
enforcing-first-as must be disabled on the IX client.

Perhaps as you suggest we should replace section 6 of current 5575 with 
the full AS_PATH check regardless if enforce-first-as is in effect there 
or not.

Comments ?

Thx,
R.

> One comment and one question on the draft.
>
> 1) I believe the rule should cover checks for AS4_PATH as well.
>
> 2) Section 6 from RFC5575
>
> <snip>
> BGP implementations MUST also enforce that the AS_PATH attribute of a
>     route received via the External Border Gateway Protocol (eBGP)
>     contains the neighboring AS in the left-most position of the AS_PATH
>     attribute.  While this rule is optional in the BGP specification, it
>     becomes necessary to enforce it for security reasons.
> <snip>
>
> Do we need to do a complete aspath check instead? Otherwise, a neighboring
> AS can inject a bogus flowspec route?
>
> Regards,
> Keyur
>
>
> On 5/16/12 1:19 PM, "Robert Raszuk"<[e-mail]>  wrote:
>
>> Hi,
>>
>> I support the adoption of this draft as WG document.
>>
>> However the new text authors added between -00 and -01 seems too
>> restrictive to the original theme/direction.
>>
>> It says:
>>
>> ".. or the AS_PATH attribute of the flow specification is empty."
>>
>> That precludes injecting and honoring the flow routes even within the
>> same administrative domain in the presence of confederations.
>>
>> I recommend that this limitation should be removed in next version.
>>
>> Regards,
>> R.