[Idr] draft-djsmith-bgp-flowspec-oid-01.txt

[Randy Bush <[e-mail]>]

first, we are now discussing the draft, not whether it should be a wg
item.  so i have changed $subject

> Do we need to do a complete aspath check instead? Otherwise, a
> neighboring AS can inject a bogus flowspec route?

this draft has wonderful text in the security section

   No new security issues are introduced by relaxing the validation
   procedure for IBGP learned flow specifications. With this proposal,
   the security characteristics of BGP flow specifications remain
   equivalent to the existing security properties of BGP unicast
   routing.  Traffic flow specifications learned from IBGP peers are
   trusted, hence, its not required to validate that the originator of
   an intra-domain traffic flow specification matches the originator of
   the best-match unicast route for the flow destination prefix.
   Conversely, this proposal continues to enforce the validation
   procedure for EBGP learned traffic flow specifications. In this way,
   the security properties of RFC 5575 are maintained such that an EBGP
   peer cannot cause a denial-of-service attack by advertising an
   inter-domain flow specification for a destination prefix that it does
   not provide reachability information for.

you gotta love the ref to 5575 which essentially says you have no
protection, abandon all hope ye who enter

randy