[Idr] Fwd: I-D Action: draft-braet-idr-bgp-source-selective-attr-00.txt

[Robert Raszuk <[e-mail]>]

Hi Kamiel,

Based on what I understand as expressed in the Abstract and Introduction
sections your intention is to explicitly list blocks of sources which
may send traffic towards you (as in BGP advertisement).

*"These objects are created by prefix holders to define sources authorized
to originate traffic toward their prefixes or subprefixes."*

+

*"1. Introduction*

*BGP provides reachability information for IP prefixes, but does not
express which sources are authorized to send traffic to those prefixes.
Destination networks must rely on out-of-band mechanisms to express
source-based intent, particularly for denial-of-service mitigation,
infrastructure protection, and restricted-access services."*

With that I have a few questions:

#1 - Today everyone is allowed to send traffic towards any reachable
destination. How are you going to change that ? Do you expect that any BGP
network node upon receiving the BGP SOURCE_SELECTIVE Attribute to now
install in the data plane an ACL blocking any other traffic to advertised
destination except if originated by listed src address ?

#2 - How safe with current BGP security in place would be such an action in
practice ?

#3 - Have you considered instead defining a new object in FlowSpecv2 to
accomplish such a data plane permit type of filtering ?

#4 - What protocols would you expect to get filtered ? All ? Even ICMP
replies ? If so, how would you know which src addresses would be sending
you ICMP replies ?

#5 - How would it work if your customers ( PA or private with src nat) are
tunneling to any arbitrary VPN destination in the world and you have no way
to know those destinations ? Is this purposely intended to spoil the fun
for those guys ?

Thx,
Robert


---------- Forwarded message ---------
From: <[e-mail]>
Date: Thu, Jun 18, 2026 at 11:29 AM
Subject: I-D Action: draft-braet-idr-bgp-source-selective-attr-00.txt
To: <[e-mail]>


Internet-Draft draft-braet-idr-bgp-source-selective-attr-00.txt is now
available.

   Title:   BGP Source-Selective Attribute
   Author:  Kamiel Braet
   Name:    draft-braet-idr-bgp-source-selective-attr-00.txt
   Pages:   14
   Dates:   2026-06-18

Abstract:

   This document specifies a new Border Gateway Protocol (BGP) Path
   Attribute, the BGP SOURCE_SELECTIVE Attribute.  This attribute allows
   BGP speakers to reference Resource Public Key Infrastructure (RPKI)
   Source Authorization (SA) objects, including Source Prefix
   Authorization (SPA), within BGP UPDATE messages.  These objects are
   created by prefix holders to define sources authorized to originate
   traffic toward their prefixes or subprefixes.  Receiving BGP speakers
   can use this information to enforce security policies.

   The SOURCE_SELECTIVE Path Attribute supports multiple Source
   Authorization Identifier (SA-ID) fields to preserve authorization
   semantics during BGP route aggregation and summarization.

   This mechanism applies to BGP AFI 1 / SAFI 1 (IPv4 Unicast) and AFI 2
   / SAFI 1 (IPv6 Unicast).

The IETF datatracker status page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-braet-idr-bgp-source-selective-attr/

There is also an HTMLized version available at:
https://datatracker.ietf.org/doc/html/draft-braet-idr-bgp-source-selective-attr-00

Internet-Drafts are also available by rsync at:
rsync.ietf.org::internet-drafts


_______________________________________________
I-D-Announce mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]