Re: [Idr] AD Review of draft-ietf-idr-bgp-flowspec-oid-12

["Juan Alcaide (jalcaide)" <[e-mail]>]

Inline



The "normal" iBGP case is different than the confederation case where we do find an eBGP relationship.


[JUAN]:

Consider 
R1(AS-65001)--R2(AS-65001)--- R3(AS-65002)--R4(AS65002) ==== R5 (AS 701)
R1, R2, R3, R4 belong to the same confederation (AS 100)
R2-R3 have an ebgp-confed peering session

R5 advertises the FS route and the unicast route
R4 does the AS_PATH check (i.e. making sure the AS_PATH of the unicast route and the FS route received from R5 are both AS_PATH ='701 XXX')
R3 does not do the AS_PATH check (from the route received from R4)
Why R2 should do the AS_PATH check from a router received from R3? (i.e. making sure the AS_PATH of the unicast route and the FS route are both AS_PATH = '(XXX) 701 XXX')




In short, yes.  rfc6793 formally Updated rfc4271, so any interpretation of the AS_PATH has to consider what rfc6793 says.
[JUAN]: I'll be happy to remove it. It adds too much detail. But it seems to me that all new rfcs are assuming rfc6793 is already implemented. Trying to implement rfc8955 without rfc6793 would be undefined.



As you mention, rfc8955 considers eBGP.  The fact that it doesn't say anything about iBGP shouldn't be interpreted as trusting those peers.
Even if that was the intent in rfc8955, this document deals directly with iBGP so it makes it the best place to call the risk out.

[JUAN]: I think that's a bit open for interpretation. Quoting rfc8955:

<snip>
The Flow Specification received from an internal BGP
   peer within the same autonomous system [RFC4271] is assumed to have
   been validated prior to transmission within the internal BGP (iBGP)
   mesh of an autonomous system.
</snip>

You can read that iBGP validation is not needed because eBGP validation was successful, what implies iBGP is trusted.
Rfc8955 should have mentioned if that assumption was not true 100% of the time. There are different 'levels' of what it means to be 'trusted'.

Regardless, it doesn't hurt to mention it here. 


-J