Re: [Idr] locator length : draft-li-idr-flowspec-srv6

["Joel M. Halpern" <[e-mail]>]

Port ranges are a well-defined concepts.  Even address ranges are a well 
defined concepts.  There is no ordering for FUNC code points.  And the 
only defined meaning ARGs has a bit-oriented meaning where ranges would 
be at best coincidentally meaningfully.

Further, if the FUNC happen to have meaningful ranges, and are defined 
for a specific LOC, then one can define a pair of prefixes reflecting 
the edges of the range within the LOC.  SO a simple range representation 
in the "address" would cover that.  (After all, what is being tested is 
indeed the destiantion address field of a packet.)

If you really want a rule that tests a specific set of bits from the 
destination address, then the TLV for that kind of test needs to include 
the position of the bits, not just the value.  Declaring that the 
meaning of a FUNC test in a flowspec depends upon the configuraiton of 
the device creates interaction, complexity, and difficult to detect errors.

Yours,
Joel

On 3/15/2021 10:26 AM, Huaimo Chen wrote:
> Hi Joel,
> 
>      Thanks much for your further comment.
> 
>      In the existing flow specification defined in RFC 8955 and 8956,
> the operations lt (less than) and gt (greater than) are defined and
> can be used on port.
> 
>      It seems that applying operations lt (less than) and gt (greater than)
> on FUNC is similar to applying them on port.
> 
> Best Regards,
> Huaimo
> 
> ------------------------------------------------------------------------
> *From:* Joel M. Halpern <[e-mail]>
> *Sent:* Friday, March 12, 2021 3:29 PM
> *To:* Huaimo Chen <[e-mail]>
> *Cc:* [e-mail] <[e-mail]>; Lizhenbin <[e-mail]>
> *Subject:* Re: locator length : draft-li-idr-flowspec-srv6
> I have to disagree with your basic premise.  At least for LOC and FUNC
> bits, less than and greater than are NOT meaningful comparisons.
> 
> Even for ARG bits, the only defined usage for the bits is such that
> comparisons other than equal to / not equal to are meaningless.
> 
> Yours,
> Joel
> 
> On 3/12/2021 3:19 PM, Huaimo Chen wrote:
>> Hi Joel,
>> 
>>      Thanks much for your further comment.
>> 
>>      It seems that using loc, func and args in SID is simpler than using
>> address prefix of SID for SRv6 flow specification. For matching/filtering
>> on an IP destination address prefix, it seems that there is just bitwise
>> pattern matching. For matching/filtering on a SID (loc, func and args in 
>> SID),
>> there are a few operators such as eq, lt and gt (and combinations of them).
>> 
>>      For flow specification(s) to match a range of functions such as
>> from function value F1 to F1+1, to F1+n (where n > 1) in SID,
>> using IP address prefix seems need (n+1) flow specifications, each of
>> which is for one function value and would have two (type 1) components:
>> one component for matching the locator and the other for matching the
>> function value. Using loc and func in SID needs just one flow specification
>> having one (type TBD) component with three <op, value> pairs. The first pair
>> is for matching the locator and the other two for the range.
>> 
>> Best Regards,
>> Huaimo
>> 
>> ------------------------------------------------------------------------
>> *From:* Joel Halpern Direct <[e-mail]>
>> *Sent:* Friday, March 12, 2021 11:49 AM
>> *To:* Huaimo Chen <[e-mail]>
>> *Cc:* [e-mail] <[e-mail]>; Lizhenbin <[e-mail]>
>> *Subject:* Re: locator length : draft-li-idr-flowspec-srv6
>> Given that you have to check loc before func and check loc and func
>> before arg, it would seem simpler to just use an address prefix.  Gets
>> around all of the knowledge problems.
>> 
>> Note that a UI for creating flowspec filters can allow the user to
>> specify it in all sorts of ways.  that does not mean we need to put all
>> of them in the protocol when they are equivalent.
>> 
>> Yours,
>> Joel
>> 
>> On 3/12/2021 11:44 AM, Huaimo Chen wrote:
>>> Hi Joel,
>>> 
>>>      Thanks much for your further comment.
>>> 
>>>      Just checking the FUNC bits should be limited. We will add some
>>> text to state that in order to check the FUNC bits, the LOC needs to
>>> be examined and matched first.
>>> 
>>> Best Regards,
>>> Huaimo
>>> 
>>> ------------------------------------------------------------------------
>>> *From:* Joel Halpern Direct <[e-mail]>
>>> *Sent:* Friday, March 12, 2021 9:58 AM
>>> *To:* Huaimo Chen <[e-mail]>; Joel M. Halpern 
>>> <[e-mail]>
>>> *Cc:* [e-mail] <[e-mail]>; Lizhenbin <[e-mail]>
>>> *Subject:* Re: locator length : draft-li-idr-flowspec-srv6
>>> An operator can assign B::/48 and C::?46  for Locators.  Sure, it would
>>> usually be a single prefix with a single length.  But that is not required.
>>> 
>>> When one is examining the LOC, sure, you can use the value length to
>>> handle it.
>>> But the way the mechanism is described, one could try to check just the
>>> FUNC bits, without matching the LOC.
>>> First, that has the problem of needing exogenous information about the
>>> LOC length.
>>> 
>>> And it is actually worse than that.  Testing the FUNC bits of the
>>> destination field of an IP packet without checking the LOC bits is
>>> actually meaningless.  You don't even know if the DA is an SRv6 SID.
>>> 
>>> An yet further, there is no requirement that the encoding of the FUNC in
>>> different SIDs uses the same value representation.  The standardized
>>> values are for advertising in routing protocols, not for the packets.
>>> 
>>> Net: I don't think having the field identification works.
>>> 
>>> Yours,
>>> Joel
>>> 
>>> On 3/12/2021 9:51 AM, Huaimo Chen wrote:
>>>> Hi Joel,
>>>> 
>>>>      Thank you very much for your comment during the IETF 110.
>>>> 
>>>>      Regarding to the lengths of locator(LOC)s and function(FUNCT)s in 
>>>> SIDs,
>>>> RFC8986 says that the locator length, is flexible, and an operator is free
>>>> to use the locator length of their choice. This seems indicating that the
>>>> operator can select the length for the locator. After their selection, the
>>>> the locator length is determined/fixed. This is illustrated by examples
>>>> in RFC8986.
>>>> 
>>>>      One example in the beginning of section 3.2 is as follows:
>>>>         For example, a network operator may:
>>>>            Assign block B::/48 to the SR domain
>>>>            Assign a unique B:N::/64 block to each SRv6-enabled node in 
>>>> the domain.
>>>> After this assignment, the length of the locators of the SIDs in the domain
>>>> is 64 bits.
>>>> 
>>>>      In the end of section 3.2, the text shows the Function fields of SIDs.
>>>> The length of function(FUNCT)s is 16 bits.
>>>> 
>>>>      When a SID is used in the domain, its locator length and function 
>>>> length
>>>> should have been determined.
>>>> 
>>>>      When an operator configures a SRv6 flow specification, involving
>>>> a SID or a group of SIDs, s/he should have known the locator length and
>>>> function length in the SID(s).
>>>> 
>>>> Best Regards,
>>>> Huaimo