Re: [Idr] AD Review of draft-ietf-idr-bgp-flowspec-oid-12

["Juan Alcaide (jalcaide)" <[e-mail]>]

Hi Alvaro,

For my dismay, I realized I only had gotten part of your email (till review line 118). I think a weird problem with my email server. It was more in-deep review that I thought.
My changes will reflect more or less your suggestions.

Before, I have some contentious points I’d like to raise:



  *   Any alternative naming to ‘ingress border routers’ ? They are just the routers receiving traffic and far away from FS peering



  *   Around line 311, you mention a new security hole because of the new AS_PATH validation rule. You are referring to the case of a route-server, right? Let’s say AS1—(route-server)—AS2.   AS1, instead of AS_PATH = 1, could send us AS_PATH = 100 for the -rogue - FS route. The best-match unicast route could be actually coming from another route-server client om AS 100 (that is sending -correctly -the unicast route with AS_PATH=100)



  *   Around line 322, you mention we could use the new AS_PATH check for eBGP-confed routes as well. If we did, then we should also extend it for iBGP peers. But I don’t see much of a point to it, as long as we do the right check of the eBGP received routes any further check is redundant. Same concept that checking on AS_PATH loops only for eBGP received routes.



  *   Around line 324, you mention we should suppress ‘Other RFC5575bis Considerations.’. This section had more points that were trimmed when rfc8995 included those points. Only references left are about 2byte AS old speakers. Not sure if those references were ever considered for rfc8995. I guess the meaning of AS_PATH could be inferred w/o these references. rfc8955 already seems to infer them (although it is basically a copy of the old rfc4271 rule). Is it assumed that the meaning of AS_PATH is also inferred for any rfc after rfc6793?



  *   In the security section, you mention ‘ibgp are not trusted’. That’s strictly true, but in the sense of rfc8955 it would seem they are (rfc8955 is only concerned about trust for eBGP peerings). I can add a note, but is anything else is required?



-J










From: Alvaro Retana <[e-mail]>
Sent: Wednesday, March 10, 2021 9:05 PM
To: [e-mail]; Juan Alcaide (jalcaide) <[e-mail]>
Cc: Susan Hares <[e-mail]>; [e-mail]; IDR List <[e-mail]>
Subject: RE: AD Review of draft-ietf-idr-bgp-flowspec-oid-12

Hi!

Not necessary, I can wait for -13 to be posted.

Thanks!!

Alvaro.


On March 10, 2021 at 12:04:06 PM, Juan Alcaide (jalcaide) ([e-mail]<mailto:[e-mail]>) wrote:
I can send you proposed complete document with extra changes if it helps.