Re: [Idr] New draft submitted: draft-loibl-bacher-idr-flowspec-clarification

Dear Christoph and Martin,

Thank you very much for coming up with this document. Indeed it may help
avoid some misinterpretation the intention of RFC5575 by implementors.

I agree with all comments provided perhaps excluding those proposed in
section 5.

The overall intention of validation was to make sure that originator of
given unicast prefix (and here it means at any point of time) is authorized
to inject a filter for it.

There are few cases of course to consider ... and really it also depends
how strong an ISP implements say origin validation or other forms of BGP
Sec.

If I can trust that all paths for a given prefix are valid it should be
sufficient to only validate flow spec NLRI against any path present in the
BGP table for it matching say the left most value of AS_PATH attribute or
originator are the same in unicast and flow spec routes.

While I realize that 5575 says "best-match" while we are at clarifying it
maybe we should discuss this more.

Similarly many operators use flow-spec only within their own ASes and by
default first thing they do is disable validation all together. If we want
to promote use of flow spec inter-as maybe we should also account that
local use case and by spec relax the validation all together for it.

Another debate is if this should be enforced only at the EBGP boundary or
also at IBGP ...

Bottom line we want to prevent ACL churn on the router in the events of
best path changes.

To summarize if you ever will ask for WG acceptance I am in full support of
this work.

Cheers,
Robert.

On Tue, Aug 23, 2016 at 2:08 PM, Christoph Loibl <c@tix.at> wrote:

> Hi,
>
> We submitted a new draft and are happy to receive feedback:
>
> Since interoperability is key to an flowspec Internet deployment we tried
> to clarify the ambiguous parts of the flowspec RFC 5575 in order to allow a
> consistent implementation by equipment vendors.
>
> Title: draft-loibl-bacher-idr-flowspec-clarification
>
> https://datatracker.ietf.org/doc/draft-loibl-bacher-idr-
> flowspec-clarification/
>
> The reason for this draft submission is, that we recently performed a
> rather large flowspec interop test (the main goal was to evaluate possible
> inter-AS flowspec scenarios in a multi vendor environment) and discovered
> many bugs and vendor interop problems that we want to solve.
>
> Unfortunately we currently cannot share all our findings in a test report,
> because we hit some serious bugs that have (under circumstances) potential
> to remotely melt down entire networks and are working with the vendors to
> get bugs fixed.
>
> Christoph
>
> --
> Christoph Loibl
> c@tix.at | CL8-RIPE | PGP-Key-ID: 0x4B2C0055 | http://www.nextlayer.at
>
>
> _______________________________________________
> Idr mailing list
> Idr@ietf.org
> https://www.ietf.org/mailman/listinfo/idr
>
>