Re: [sidr] [Idr] No BGPSEC intradomain ?

[Paul Jakma <[e-mail]>]

On Wed, 11 Apr 2012, Christopher Morrow wrote:

> "if you don't ask for the 'bgpsec capability' then ... you get what
> you get today."

> so, everything you do today, ought to just keep right on working, or
> that's the plan.

Capability negotiation does not mean everything keeps on working. It means 
the session between the BGP speakers keeps working, sure. However, that's 
_not_ everything.

The BGP UPDATE message is no longer context-complete (wrt to the 
well-known attributes at least). If a 3rd-party wishes to be able to 
validate the message as cortrect (in the case of missing attributes) or 
even decode it correctly (in the case where well-known attributes are 
incompatibly redefined in syntax, like AS_PATH has been), it has to have 
seen the opening negotiation - which may have happened days or weeks or 
more before - or it has to be manually configured or make intelligent 
guesses.

It should be quite possible to keep BGP as completely parse-able at the 
message granularity - it just needs a modicum of care. It's a shame that 
ever more proposals are coming along that are overloading message formats, 
dependent on context that may only be exchanged very infrequently...

regards,
-- 
Paul Jakma	[e-mail]	@pjakma	Key ID: 64A2FF6A
Fortune:
static from plastic slide rules