Re: AD Review of draft-ietf-idr-rfc5575bis-17 -> Updated Version -18 and Flowspec v6
Christoph Loibl <[email protected]> Wed, 18 Dec 2019 08:11:37 +0100
| Newsgroups | gmane.ietf.idr |
|---|---|
| Message-ID | <[email protected]> |
--===============3272736478521900701== Content-Type: multipart/alternative; boundary="Apple-Mail=_A2EA93AC-87D6-4B57-AC27-0730DB07AE91" --Apple-Mail=_A2EA93AC-87D6-4B57-AC27-0730DB07AE91 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Jeffrey, Alvaro! I only pick out this single issue from the complete list, because I do = not 100% agree with this statement: > On 17.12.2019, at 23:09, Jeffrey Haas <[email protected]> wrote: >=20 >> If an unknown Flow Specification component exists, then the entire >> NLRI cannot be "successfully parsed"...which results in not being = able >> to use treat-as-withdraw. The text above leaves us with AFI/SAFI >> disable, which is not extension-friendly. >=20 > This is exactly my largest concern about flowspec right now. There is = no > safe way to extend the spec at this point. >=20 > There are two options available to us, IMO: > 1. Flowspec v2, which we stalled out until 5575bis was done. > 2. We decide that for 5575-bis that all future extensions MUST be = encoded > with a TLV format (length being mandatory). And perhaps even protect = a > compliant extension with a capability. This is a major change, but = perhaps > provides an upgrade path without waiting on v2. >>=20 >> NEW (suggestion)> >> An advertisement containing an unknown Flow Specification = component >> should be discarded as specified in Section 5.4 of [RFC7606]. >=20 > You can't parse it, therefore it's malformed. In case of an unknown flowspec component the parser can run until = decoding the component type (always the first byte of the component). = When it reads a unknown type-value it can easily jump over the remaining = bytes of the entire NLRI (the length of the the complete NLRI is encoded = in the first bytes of the NLRI) without needing to understand what is in = there, because it should treat it as withdraw. I do not see the problem. = It is supposed to =E2=80=9Cignore=E2=80=9D the entire NLRI not only a = single component of it.=20 Cheers Christoph --=20 Christoph Loibl [email protected] | CL8-RIPE | PGP-Key-ID: 0x4B2C0055 | http://www.nextlayer.at --Apple-Mail=_A2EA93AC-87D6-4B57-AC27-0730DB07AE91 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;" class=3D"">Hi = Jeffrey, Alvaro!<div class=3D""><br class=3D""></div><div class=3D"">I = only pick out this single issue from the complete list, because I do not = 100% agree with this statement:<br class=3D""><div class=3D""> <div style=3D"color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; orphans: auto; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; widows: = auto; word-spacing: 0px; -webkit-text-size-adjust: auto; = -webkit-text-stroke-width: 0px;"><br class=3D""></div></div><div><br = class=3D""><blockquote type=3D"cite" class=3D""><div class=3D"">On = 17.12.2019, at 23:09, Jeffrey Haas <<a href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:</div><br = class=3D"Apple-interchange-newline"><div class=3D""><div = class=3D""><blockquote type=3D"cite" style=3D"font-family: = Menlo-Regular; font-size: 11px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; orphans: auto; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; = -webkit-text-stroke-width: 0px; text-decoration: none;" class=3D"">If an = unknown Flow Specification component exists, then the entire<br = class=3D"">NLRI cannot be "successfully parsed"...which results in not = being able<br class=3D"">to use treat-as-withdraw. The text above = leaves us with AFI/SAFI<br class=3D"">disable, which is not = extension-friendly.<br class=3D""></blockquote><br style=3D"caret-color: = rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 11px; font-style: = normal; font-variant-caps: normal; font-weight: normal; letter-spacing: = normal; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><span style=3D"caret-color: rgb(0, 0, = 0); font-family: Menlo-Regular; font-size: 11px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; float: none; display: inline !important;" = class=3D"">This is exactly my largest concern about flowspec right now. = There is no</span><br style=3D"caret-color: rgb(0, 0, 0); = font-family: Menlo-Regular; font-size: 11px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><span style=3D"caret-color: rgb(0, 0, = 0); font-family: Menlo-Regular; font-size: 11px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; float: none; display: inline !important;" = class=3D"">safe way to extend the spec at this point.</span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; = font-size: 11px; font-style: normal; font-variant-caps: normal; = font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;" class=3D""><br style=3D"caret-color: rgb(0, 0, 0); font-family: = Menlo-Regular; font-size: 11px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;" class=3D""><span style=3D"caret-color: rgb(0, 0, 0); font-family: = Menlo-Regular; font-size: 11px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline !important;" class=3D"">There are two = options available to us, IMO:</span><br style=3D"caret-color: rgb(0, 0, = 0); font-family: Menlo-Regular; font-size: 11px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><span style=3D"caret-color: rgb(0, 0, = 0); font-family: Menlo-Regular; font-size: 11px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; float: none; display: inline !important;" = class=3D"">1. Flowspec v2, which we stalled out until 5575bis was = done.</span><br style=3D"caret-color: rgb(0, 0, 0); font-family: = Menlo-Regular; font-size: 11px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;" class=3D""><span style=3D"caret-color: rgb(0, 0, 0); font-family: = Menlo-Regular; font-size: 11px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline !important;" class=3D"">2. We decide = that for 5575-bis that all future extensions MUST be encoded</span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; = font-size: 11px; font-style: normal; font-variant-caps: normal; = font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;" class=3D""><span style=3D"caret-color: rgb(0, 0, 0); font-family: = Menlo-Regular; font-size: 11px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline !important;" class=3D"">with a TLV = format (length being mandatory). And perhaps even protect = a</span><br style=3D"caret-color: rgb(0, 0, 0); font-family: = Menlo-Regular; font-size: 11px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;" class=3D""><span style=3D"caret-color: rgb(0, 0, 0); font-family: = Menlo-Regular; font-size: 11px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline !important;" class=3D"">compliant = extension with a capability. This is a major change, but = perhaps</span><br style=3D"caret-color: rgb(0, 0, 0); font-family: = Menlo-Regular; font-size: 11px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;" class=3D""><span style=3D"caret-color: rgb(0, 0, 0); font-family: = Menlo-Regular; font-size: 11px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline !important;" class=3D"">provides an = upgrade path without waiting on v2.</span><br style=3D"caret-color: = rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 11px; font-style: = normal; font-variant-caps: normal; font-weight: normal; letter-spacing: = normal; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><blockquote type=3D"cite" = style=3D"font-family: Menlo-Regular; font-size: 11px; font-style: = normal; font-variant-caps: normal; font-weight: normal; letter-spacing: = normal; orphans: auto; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; widows: auto; word-spacing: = 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><br class=3D"">NEW = (suggestion)><br class=3D""> An advertisement containing = an unknown Flow Specification component<br class=3D"">should be = discarded as specified in Section 5.4 of [RFC7606].<br = class=3D""></blockquote><br style=3D"caret-color: rgb(0, 0, 0); = font-family: Menlo-Regular; font-size: 11px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><span style=3D"caret-color: rgb(0, 0, = 0); font-family: Menlo-Regular; font-size: 11px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; float: none; display: inline !important;" = class=3D"">You can't parse it, therefore it's malformed.</span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; = font-size: 11px; font-style: normal; font-variant-caps: normal; = font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;" class=3D""></div></div></blockquote><br class=3D""></div><div>In = case of an unknown flowspec component the parser can run until decoding = the component type (always the first byte of the component). When it = reads a unknown type-value it can easily jump over the remaining bytes = of the entire NLRI (the length of the the complete NLRI is encoded in = the first bytes of the NLRI) without needing to understand what is in = there, because it should treat it as withdraw. I do not see the problem. = It is supposed to =E2=80=9Cignore=E2=80=9D the entire NLRI not only a = single component of it. </div><div><br = class=3D""></div><div>Cheers</div>Christoph</div><div class=3D""><br = class=3D""></div><div class=3D""><div>-- <br class=3D"">Christoph = Loibl<br class=3D""><a href=3D"mailto:[email protected]" = class=3D"">[email protected]</a> | CL8-RIPE | PGP-Key-ID: 0x4B2C0055 = | <a href=3D"http://www.nextlayer.at" = class=3D"">http://www.nextlayer.at</a></div></div><div class=3D""><br = class=3D""></div></body></html>= --Apple-Mail=_A2EA93AC-87D6-4B57-AC27-0730DB07AE91-- --===============3272736478521900701== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Idr mailing list [email protected] https://www.ietf.org/mailman/listinfo/idr --===============3272736478521900701==--