Re: [Idr] Adoption of draft-djsmith-bgp-flowspec-oid-01 as IDR WG document

[Keyur Patel <[e-mail]>]

Yep. In that case, the enforce-first-as text [RFC5575] could be relaxed and
modified as well (We would need a uniform enforce-first-as policy between
the flowspec and unicast afi/safis and that would work when comparing
aspaths).

Regards,
Keyur


On 5/16/12 2:24 PM, "Robert Raszuk" <[e-mail]> wrote:

> Hi Keyur,
> 
> Actually you bring a good point. Going by section 6 would preclude
> reception of flow-spec routes across IX route servers as in those cases
> enforcing-first-as must be disabled on the IX client.
> 
> Perhaps as you suggest we should replace section 6 of current 5575 with
> the full AS_PATH check regardless if enforce-first-as is in effect there
> or not.
> 
> Comments ?
> 
> Thx,
> R.
> 
>> One comment and one question on the draft.
>> 
>> 1) I believe the rule should cover checks for AS4_PATH as well.
>> 
>> 2) Section 6 from RFC5575
>> 
>> <snip>
>> BGP implementations MUST also enforce that the AS_PATH attribute of a
>>     route received via the External Border Gateway Protocol (eBGP)
>>     contains the neighboring AS in the left-most position of the AS_PATH
>>     attribute.  While this rule is optional in the BGP specification, it
>>     becomes necessary to enforce it for security reasons.
>> <snip>
>> 
>> Do we need to do a complete aspath check instead? Otherwise, a neighboring
>> AS can inject a bogus flowspec route?
>> 
>> Regards,
>> Keyur
>> 
>> 
>> On 5/16/12 1:19 PM, "Robert Raszuk"<[e-mail]>  wrote:
>> 
>>> Hi,
>>> 
>>> I support the adoption of this draft as WG document.
>>> 
>>> However the new text authors added between -00 and -01 seems too
>>> restrictive to the original theme/direction.
>>> 
>>> It says:
>>> 
>>> ".. or the AS_PATH attribute of the flow specification is empty."
>>> 
>>> That precludes injecting and honoring the flow routes even within the
>>> same administrative domain in the presence of confederations.
>>> 
>>> I recommend that this limitation should be removed in next version.
>>> 
>>> Regards,
>>> R.
> 
> 
>