Re: [Idr] WG adoption call for draft-abraitis-bgp-version-capability-08, to end September 25

["Jakob Heitz (jheitz)" <[e-mail]>]

I think if we can settle on a way to avoid collisions, it should be fine.
So, in my case, for example: “cisco.com/XR.7.9.1/optionalstringtoencodefeatures”.
I promise not to send my customers’ peers to malicious websites.

Regards,
Jakob.

From: Robert Raszuk <[e-mail]>
Sent: Tuesday, January 10, 2023 3:20 PM
To: Jeffrey Haas <[e-mail]>
Cc: Donatas Abraitis <[e-mail]>; Alvaro Retana <[e-mail]>; Jakob Heitz (jheitz) <[e-mail]>; Bruno Decraene <[e-mail]>; IDR List <[e-mail]>; John Scudder <[e-mail]>
Subject: Re: [Idr] WG adoption call for draft-abraitis-bgp-version-capability-08, to end September 25

Hi Jeff,

Very good points.

But I am not sure if they are really applicable here ?

Keep in mind that we are talking about p2p BGP OPEN Msg between PE & CEs (computes with lot's of machines - bare metal or virtual). Moreover what is proposed is really informational with little to no bearing into operational aspects of the subject BGP session.

So while I am all for making right, robust and secure protocol encoding decisions it seems that especially in BGP we have lot's of other security holes which if exploited could have a much bigger negative impact.

Regards,
R.

On Wed, Jan 11, 2023 at 12:11 AM Jeffrey Haas <[e-mail]<mailto:[e-mail]>> wrote:
Robert,

Please note that the points I'm about to make is intended to more broadly discuss the URL issue and isn't saying you're making these recommendations.


On Jan 10, 2023, at 5:47 PM, Robert Raszuk <[e-mail]<mailto:[e-mail]>> wrote:

I would like to just highlight one IMHO very cool property hidden in yr note ... If we would use URL to carry a pointer to the information the URL can be shortened to be a fixed length of a few characters which could be really easy to process and presented  to users in a pretty uniformed way across any receiver.

Before we move forward with any specific shortened-URL proposal, it's likely we'll want to get comment from those with expertise in the security implications of shortened URLs.

Certainly, many vendors maintain a domain name for shorter URLs for various contexts.  That's likely not the main concern.

URL shortening services are probably a Very Bad Idea since they're in an entire vector of attacks on their own.

(We also introduce all of the interesting headaches about interaction with the PKIX certificate infrastructure.  See my prior comments in the BGP autoconfiguration discussions if you're interested.)

One possible mitigation for some of the attacks given the problem to be addressed is to permit an IANA registered prefix for the URI/URL.  This means rather than carrying a potentially long URL to a specific resource, you carry something like the Private Enterprise Number's[1] instance of your registered prefix and a suffix portion of the URL.  The rest of the data is contained in the structured data at the other side of the expanded URL.

I'd encourage Donatas to continue the discussion on such structured data before we worry over-much about how to point to it in BGP. :-)

-- Jeff

[1] https://www.iana.org/assignments/enterprise-numbers/