Subject: [RTG-DIR] RtgDir review: draft-ietf-idr-bgp-extended-messages-11

From: "Brian Weis (bew)" <[email-masked]>
Date: Thu, 3 Sep 2015 23:02:27 +0000

Hello,

I have been selected as the Routing Directorate reviewer for this draft. The Routing Directorate seeks to review all routing or routing-related drafts as they pass through IETF last call and IESG review, and sometimes on special request. The purpose of the review is to provide assistance to the Routing ADs. For more information about the Routing Directorate, please see ​<http://trac.tools.ietf.org/area/rtg/trac/wiki/RtgDir>

Although these comments are primarily for the use of the Routing ADs, it would be helpful if you could consider them along with any other IETF Last Call comments that you receive, and strive to resolve them through discussion or by updating the draft.

Document: draft-ietf-idr-bgp-extended-messages-11
Reviewer: Brian Weis
Review Date: September 3, 2015
IETF LC End Date: Unknown
Intended Status: Standards Track

Summary:
I have a minor concern about this document that I think should be resolved before publication.

Comments:
The document is clearly written and easy to understand.

Major Issues:
No major issues found.

Minor Issues:
Section 5 (Error Handling) delineates two error cases possible when a BGP speaker has not advertised that it can use extended messages, but does receive one from a peer. Each case has its own paragraph in this section. The first paragraph describes a BGP speaker that can use extended messages (but has not advertised it); the second paragraph describes a BGP speaker that actually cannot use extended messages. In the second paragraph the error response is clearly stated (i.e., follow the error handling procedures of RFC 4221 and reset the session). But as written it does not seem that any such response is required for the first case. It isn’t clear to me why this type of BGP speaker would respond differently, and if the error response was intended for both cases then I suggest the text describing the response be separated into a third paragraph. In any case it would be valuable to explicitly describe the expected response of the BGP speaker in both cases.

---

From: "John G. Scudder" <[email-masked]>
Date: Tue, 8 Sep 2015 11:48:03 -0400

Hi Brian,

Some comments below (to be clear, I'm commenting as a working group contributor and not co-chair).

> On Sep 3, 2015, at 7:02 PM, Brian Weis (bew) <[email-masked]> wrote:
> 
> Minor Issues:

Here is the text of the section in question:

   A BGP speaker that has the ability to use extended messages but has
   not advertised the BGP Extended Messages capability, presumably due
   to configuration, SHOULD NOT accept such a message.

   However, a BGP speaker that does not advertise the BGP Extended
   Messages capability might also genuinely not support extended
   messages.  Such a speaker would be expected to follow the error
   handling procedures of [RFC4221], Section 6.1 <https://tools.ietf.org/html/rfc4221#section-6.1>, and reset the session
   with a Bad Message Length NOTIFICATION if it receives an extended
   message.  A speaker that treats an improper extended message as a
   fatal error should do likewise.

First of all, my own opinion is that the same "keep the session up at (almost) all costs" philosophy (and I use the term loosely) that led the working group to adopt treat-as-withdraw as the preferred way of handling attribute errors (RFC 7606), suggests that the SHOULD in the first paragraph ought to be a SHOULD NOT. That is, the implementation ought to go ahead and accept the message if it's capable of doing so. However, just as with the attribute error-handling spec, I acknowledge this choice would be fairly disgusting, and I understand why the authors didn't make it.

In reading your comment, I'm not actually sure what you're asking for. As I read the text, it says "reset the session if you get an unexpected extended message". The only corner case that isn't covered by the text is the case where an implementation does choose to "be liberal in what it accepts", that is, where it disregards the SHOULD NOT and instead accepts the unexpected but otherwise well-formed message. In such a case, it would be reasonable to expect that the draft might have a MAY clause to explain when the SHOULD NOT can be disregarded, and what should be done instead in that case.

Or, maybe the final sentence is too weak? Perhaps it would be clearer if worded as "A speaker that treats an improper extended message as a fatal error, as described in the preceding paragraph, MUST do likewise."

Thanks,

--John

---

From: "Brian Weis (bew)" <[email-masked]>
Date: Wed, 9 Sep 2015 01:04:32 +0000

Hi John,

On Sep 8, 2015, at 8:48 AM, John G. Scudder <[email-masked]<mailto:[email-masked]>> wrote:

Hi Brian,

On Sep 3, 2015, at 7:02 PM, Brian Weis (bew) <[email-masked]<mailto:[email-masked]>> wrote:

Minor Issues:

   handling procedures of [RFC4221], Section 6.1<https://tools.ietf.org/html/rfc4221#section-6.1>, and reset the session

In reading your comment, I'm not actually sure what you're asking for. As I read the text, it says "reset the session if you get an unexpected extended message”.

Sorry to be confusing. To a first time reader, it is clear that a BGP speaker is expected to discard extended messages in both cases mentioned, but it’s not clear to me that the BGP speaker is always instructed to inform its peer that it is discarding its messages. The instruction to “reset the session” appears to only cover the case where the BGP speaker can’t support extended messages. It isn’t clear that the last sentence in the 2nd paragraph is referring back to the 1st paragraph. My ask was to make the expected response clearer, and what you suggest below does that.

The only corner case that isn't covered by the text is the case where an implementation does choose to "be liberal in what it accepts", that is, where it disregards the SHOULD NOT and instead accepts the unexpected but otherwise well-formed message. In such a case, it would be reasonable to expect that the draft might have a MAY clause to explain when the SHOULD NOT can be disregarded, and what should be done instead in that case.

This also seems like a good idea to me.

Or, maybe the final sentence is too weak? Perhaps it would be clearer if worded as "A speaker that treats an improper extended message as a fatal error, as described in the preceding paragraph, MUST do likewise.”

That was the problem. The new text works for me, thanks.

Brian

Thanks,

--John

--
Brian Weis
Security, CSG, Cisco Systems
Telephone: +1 408 526 4796
Email: [email-masked]<mailto:[email-masked]>