Subject: [bess] Alvaro Retana's Discuss on draft-ietf-bess-srv6-services-10: (with DISCUSS and COMMENT)

From: Alvaro Retana via Datatracker <[email-masked]>
Date: Tue, 15 Feb 2022 09:59:24 -0800

Alvaro Retana has entered the following ballot position for
draft-ietf-bess-srv6-services-10: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/blog/handling-iesg-ballot-positions/
for more information about how to handle DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-bess-srv6-services/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

I am balloting DISCUSS because the document underspecifies the use of Endpoint
Behaviors. As a result, it is unclear when they should be checked, enforced,
or needed. Details follow.

The descriptions of the TLVs in §2 say (twice) that the "SRv6 Endpoint
behaviors which MAY be encoded, but not limited to, are...etc."

   The text above ends with "etc." which means there are other possible
   behaviors. That's not a great use of normative language, even if optional.
   My initial instinct was to ask you to be specific, BUT...

   The description of the SRv6 SID Information Sub-TLV (§3.1) says that "an
   unrecognized endpoint behavior MUST NOT be considered invalid", which seems
   to mean that any behavior is ok, AND...

   There's no validation specified, except for the description of the SRv6 SID
   Structure Sub-Sub-TLV (§3.2.1), where it says that the "Argument length
   MUST be set to 0 for SIDs where the Argument is not applicable". AND...

   Several of the service descriptions in §5/§6 say that "The SRv6 Endpoint
   behavior of the SRv6 SID is entirely up to the originator of the
   advertisement. In practice, the SRv6 Endpoint behavior is..."

The result is that any endpoint behavior (even unrecognized) can be used,
while also requiring a specific setting for the argument length in some cases.

How can the argument length be validated if the endpoint behavior is unknown?

Clearly (from looking at rfc8986), not all endpoint behaviors apply to the
services defined in this document. Should a receiver accept any endpoint
behavior? What should a receiver do if a known but unrelated behavior (End,
for example) is received?

What should the receiver do if the endpoint behavior is known and applicable,
but the attribute length is not set correctly?

For any specific service (IPv4 VPN Over SRv6 Core, for example, to pick one),
should the behaviors used "in practice" be enforced? What if different behavior
is advertised? Can it safely be ignored?

Why is the Endpoint Behavior included in the Sub-TLV if (from the above) it
looks like it doesn't matter?

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

(1) To make sure, the new "BGP SRv6 Service SID Flags" registry is
intended to document the allocations for the "SRv6 SID Flags" field in the
SRv6 SID Information Sub-TLV (§3.1), right?

Please say so somewhere.  It would also be nice if the name of the field (SRv6
SID Flags) and the registry (SRv6 Service SID Flags) matched.  I realize that
fitting the full name in the figure won't work, but you can either use multiple
lines (as you have already) or call the field simply "Flags," then extend
to the full name in the description of the field...or many other ways to avoid
confusion.

(2) §3.1:

      SRv6 SID Flags (1 octet): Encodes SRv6 SID Flags - none are
      currently defined.  SHOULD be set to 0 by the sender and MUST be
      ignored by the receiver.

If/when the flags are defined, the behavior specified here won't be compatible.
Instead, a behavior that assumes that some of the flags will be known in the
future would be better.  For example: any unknown flags MUST be ignored by the
receiver.

(3) §3.1: "SRv6 Endpoint Behavior...The opaque endpoint behavior (i.e., value
0xFFFF)...MUST NOT be considered invalid by the receiver."

Ok, but the opaque behavior is not defined as invalid in rfc8986 or anywhere
else (AFAIK).  rfc8986 includes a note specifically for the cases in
this document in §8.3. So this requirement is not needed.

(4) §3.2.1: "Transposition Length of 0 ... In this case, the Transposition
Offset MUST be set to 0."

What should the receiver do if the offset is not set to 0?

(5) §3.2.1: According to rfc8986, the sum of the Loc + Func + Agr <= 128.  The
inclusion of the transposition fields changes the formula to add the new
length.  Please indicate the new constraints.  What should the receiver do if
the sum of the lengths is not <= 128?

(6) §3.2.1: "Arguments MAY be generally applicable for SIDs of only specific
SRv6 Endpoint behaviors"  In this case, "MAY" is just stating a fact (specified
in rfc8986): s/MAY/may

(7) §5: s/MUST choose to perform IPv6 encapsulation/MUST perform IPv6
encapsulation

To choose is not normatively enforceable; encapsulating is.

(8) §5:

   The SRv6 Service SID SHOULD be routable within the AS of the egress
   PE and serves the dual purpose of providing reachability between
   ingress PE and egress PE while also encoding the SRv6 Endpoint
   behavior.

Is it ever ok for the SID to not be routable?  If so, when?  The "purpose of
providing reachability" requires the SID to be routable.  IOW, why is this
behavior recommended and not required?

(9) Both §5/§6 say that the "ingress PE SHOULD perform resolvability check for
the SRv6 Service SID before considering the received prefix for the BGP best
path computation."

By "resolvability check", do you mean the "Route Resolvability Condition" from
§9.1.2.1/rfc4271??  If so, please be explicit.

Given that we're talking about services, which table should be used to resolve
the SID?  This question is something that rfc4271 doesn't cover [1]. Please add
something similar to this text from rfc9012 (where the resolvability condition
is mentioned):

   The reachability condition is evaluated as per [RFC4271].  If the IP
   address is reachable via more than one forwarding table, local policy is
   used to determine which table to use.

[1] https://datatracker.ietf.org/doc/html/draft-ietf-idr-bgp-bestpath-selection-criteria

(10) [nits]

s/multiple instances...is encountered/multiple instances...are encountered/g

Please add figure numbers to all the packet formats, etc.

---

From: Ketan Talaulikar <[email-masked]>
Date: Wed, 16 Feb 2022 23:58:31 +0530

Hi Alvaro,

Thanks for your detailed review and comments. Please check inline below for
responses.

We have also posted an update for the draft to address comments from you
and other reviewers:
https://datatracker.ietf.org/doc/html/draft-ietf-bess-srv6-services-11

> https://datatracker.ietf.org/doc/draft-ietf-bess-srv6-services/

KT> Agree. We have removed the "etc".

> How can the argument length be validated if the endpoint behavior is

KT> The argument length cannot be validated unless the endpoint behavior is
known. The ingress PE needs to actually write the ARG part of the SID into
the SRv6 SID advertised by the egress PE when sending packets for that
service to the egress PE. Therefore, knowing that the behavior involves
argument and validating the argument length is important. We have clarified
this in the text.

> but the attribute length is not set correctly?

KT> Could you clarify which attribute length you are referring to?

> looks like it doesn't matter?

KT> The endpoint behavior is something that is associated with the SID
instantiated on the Egress PE. In most cases for VPN services, the ingress
PE simply needs to use the SID to send the packet to the egress PE. This is
much like how a context/instruction is associated with the VPN label for
MPLS - it could be per-vrf or per-ce or per-prefix - normally the ingress
PE does not care. However, with SRv6, we have behaviors that have arguments
that do require the ingress PE to be aware since it needs to set up the ARG
part of the SID in the packet encapsulation. In certain other cases, the
knowledge of the behavior on the ingress PE could enable local optimization
which we do want to preclude. Having the ability to signal the SRv6
Endpoint behavior also helps in troubleshooting and monitoring.

KT> Correct.

> to the full name in the description of the field...or many other ways to

KT> We have fixed the figure and description to match the registry name.

> future would be better.  For example: any unknown flags MUST be ignored by

KT> Ack. Fixed.

> this document in §8.3. So this requirement is not needed.

KT> Ack. It is covered by RFC8986. We have rephrased the sentence.

> What should the receiver do if the offset is not set to 0?

KT> If the checks in sec 3.2.1 fail, then the error handling is done as per
sec 8. Please also see the next response.

> the sum of the lengths is not <= 128?

KT> Ack. We have added the constraints for the fields of this sub-sub-tlv
as also the clarification for handling in sec 8.

> SRv6 Endpoint behaviors"  In this case, "MAY" is just stating a fact

KT> Ack. Fixed.

> To choose is not normatively enforceable; encapsulating is.

KT> Ack. Fixed.

> behavior recommended and not required?

KT> An SRv6 SID may not be routable across multiple IGP domains within a
provider network when routes are not leaked. There can be other mechanisms
like SR Policies (or other forms of tunneling) that provide reachability.
In other scenarios, due to local policy, the resolution may be desired over
an SR Policy instead of the best-effort reachability provided by IGPs.

>    used to determine which table to use.

KT> Ack. Updated the text.

>
> [1]
> https://datatracker.ietf.org/doc/html/draft-ietf-idr-bgp-bestpath-selection-criteria
>
>
> (10) [nits]
>

KT> Ack. Fixed.

> Please add figure numbers to all the packet formats, etc.

KT> Ack. Fixed.

Thanks,
Ketan

---

From: Alvaro Retana <[email-masked]>
Date: Thu, 17 Feb 2022 11:00:48 -0800

On February 16, 2022 at 1:28:43 PM, Ketan Talaulikar wrote:

Ketan:

Hi!

> > I am balloting DISCUSS because the document underspecifies the use of
> > Endpoint Behaviors. As a result, it is unclear when they should be checked,
> > enforced, or needed. Details follow.
> >
> >

Ok.  Given the rest of the text, I think that "MAY" is just expressing
a fact, not a normative action: s/MAY/may

> argument and validating the argument length is important. We have clarified

I see that the text in -11 now says this:

   Arguments may be generally applicable for SIDs of only specific SRv6
   Endpoint behaviors (e.g., End.DT2M) and therefore the Argument length
   MUST be set to 0 for SIDs where the Argument is not applicable.  A
   receiver is unable to validate the applicability of arguments for
   SRv6 Endpoint behaviors that are unknown to it and hence MUST ignore
   SRv6 SIDs with arguments (indicated by non-zero argument length) with
   unknown endpoint behaviors.

That works for me.  It addresses the cases when the Behavior is
unknown -- the questions below are about known and expected Behaviors.

> > What should the receiver do if the endpoint behavior is known and
> > applicable, but the attribute length is not set correctly?
>

Sorry, I meant the argument... :-(

> > For any specific service (IPv4 VPN Over SRv6 Core, for example, to pick
> > one), should the behaviors used "in practice" be enforced? What if
> > different behavior is advertised? Can it safely be ignored?

...
...

Just one comment:

...
> like SR Policies (or other forms of tunneling) that provide reachability. In
> other scenarios, due to local policy, the resolution may be desired over an
> SR Policy instead of the best-effort reachability provided by IGPs.

If there's a route over a tunnel/SR Policy/whatever, I consider that
routable. I am not just thinking about IGP-learned routes.  The case
that concerns me is when the ingress PE doesn't have a route at all
(which is possible with the SHOULD).  If a route should always exist
(from any source) then it looks like the text should indicate a
requirement and not a recommendation.

Thanks for addressing my other comments.

Alvaro.

---

From: Ketan Talaulikar <[email-masked]>
Date: Fri, 18 Feb 2022 10:52:50 +0530

Hi Alvaro,

Thanks for your quick response and please see further inline below.

We will include these changes in the next update of the draft.

> a fact, not a normative action: s/MAY/may

KT> Ack

> unknown -- the questions below are about known and expected Behaviors.

KT> Thanks

> Sorry, I meant the argument... :-(

KT> The behavior definition may or may not specify requirements of argument
lengths - the currently defined ones do not pose any limitation and so the
draft talks about zero or non-zero. We can clarify by saying something on
the lines that for behaviors where arguments apply, the argument length's
consistency must be verified against the behavior definition. Would that
address your comment?

> requirement and not a recommendation.

KT> The should is to allow for use-cases such as the one specified in
https://datatracker.ietf.org/doc/html/draft-ietf-spring-segment-routing-policy-18#section-8.5
- in this case, there may not be any reachability but the local policy
indicates triggering a request to a controller to compute SR Policy path to
the BGP NH on demand and then the resolution can happen once such an SR
Policy is successfully instantiated on the node.

>
>
> Thanks for addressing my other comments

Thanks,
Ketan

---

From: Alvaro Retana <[email-masked]>
Date: Fri, 18 Feb 2022 04:22:30 -0800

On February 18, 2022 at 12:23:03 AM, Ketan Talaulikar wrote:

Hi!

...
> > > > Clearly (from looking at rfc8986), not all endpoint behaviors apply to
> > > > the services defined in this document. Should a receiver accept any
> > > > endpoint behavior? What should a receiver do if a known but unrelated
> > > > behavior (End, for example) is received?
...
> > > > different behavior is advertised? Can it safely be ignored?

These two are related: Should only specific behaviors (per service) be
accepted?

If yes, I need you to specify which are those behaviors and what
happens if a different (known) one is received.

If no, what does it mean for the service if an unrelated behavior is advertised?

> draft talks about zero or non-zero. We can clarify by saying something on the
> lines that for behaviors where arguments apply, the argument length's

Yes, it would.

Also, if the verification fails then what?

> > > > Is it ever ok for the SID to not be routable? If so, when? The
> > > > "purpose of providing reachability" requires the SID to be routable.
> > > > IOW, why is this behavior recommended and not required?
> > >
> > > provider network when routes are not leaked. There can be other
> > > mechanisms like SR Policies (or other forms of tunneling) that provide
> > > reachability. In other scenarios, due to local policy, the resolution may
> > > be desired over an SR Policy instead of the best-effort reachability
> > > provided by IGPs.
> >
> https://datatracker.ietf.org/doc/html/draft-ietf-spring-segment-routing-
> policy-18#section-8.5 - in this case, there may not be any reachability but
> the local policy indicates triggering a request to a controller to compute SR
> Policy path to the BGP NH on demand and then the resolution can happen once
> such an SR Policy is successfully instantiated on the node.

The end result is that the SID MUST be reachable before the ingress
node can do anything with it.  As you say: "the resolution can happen
once such an SR Policy is successfully instantiated on the node".  The
mechanisms to provide that resolution (IGP, manual configuration,
controller, etc.) is independent of the requirement for there to be
reachability.

Alvaro.

---

From: Ketan Talaulikar <[email-masked]>
Date: Fri, 18 Feb 2022 21:23:08 +0530

Hi Alvaro,

Please check inline below for a few responses.

> On February 18, 2022 at 12:23:03 AM, Ketan Talaulikar wrote:

KT> So, this would be a result of a bug (?) on the egress PE that signals a
wrong behavior. Since the receiver is not validating, the service traffic
would still arrive at the egress PE but the handling might be erroneous due
to wrong behavior. The issue still manifests on the egress PE due to its
bug. Somewhat similar to what might happen if the egress PE were to signal
a label associated with a wrong context/service as a VPN label in MPLS VPNs.

> > consistency must be verified against the behavior definition. Would that

KT> Thanks.

> Also, if the verification fails then what?

KT> That is already covered by the existing text in sec 8 - such a route
would be considered ineligible during the selection of the best path by the
receiver.

KT> I believe we were discussing the part of the "SID being routable" as in
via routing protocol (i.e. IGP/BGP transport). The next paragraph is one
that covers the base BGP "resolvability" part and does elaborate on the
various mechanisms like "alternate steering mechanisms" (e.g. any tunnel,
SR Policy, etc.).

Thanks,
Ketan

---

From: Alvaro Retana <[email-masked]>
Date: Fri, 18 Feb 2022 14:28:45 -0800

On February 18, 2022 at 10:53:20 AM, Ketan Talaulikar wrote:

Hi!

We're still not on the same page.

[Cut the indentation to make it more readable.]

> to wrong behavior. The issue still manifests on the egress PE due to its bug.
> Somewhat similar to what might happen if the egress PE were to signal a label
> associated with a wrong context/service as a VPN label in MPLS VPNs.

Verifying that a label is correct is not the same as confirming that
the Behavior is plausible for the service.

I understand how the ingress PE cannot validate an unknown Behavior,
but not validating a known Behavior is not right.  If the Behavior is
unknown, the ingress doesn't have any idea of what the egress may do,
but if the Behavior is known, it does!

§2 lists Behaviors that may correspond to L2/L3 Services.   The
subsections in §5 and §6 list the Endpoint Behaviors used "in
practice" for each of the services.

This is what I would like to see:  For example, §5.1 (IPv4 VPN Over
SRv6 Core) says that "In practice, the SRv6 Endpoint behavior is
End.DX4 or End.DT4."  The ingress PE should then be able to validate
that the Endpoint Behavior is one of these...and take appropriate
actions if it isn't.  Why is that not the case?  Not taking this
simple step opens up (as you mention) the possibility of a bug
creeping in, but also the ability of the egress to signal any behavior
which could result in an unexpected or incorrect action.

This type of checking is the minimum that should be done.

...
> > > > --------------------------------------------------------------------
...
> via routing protocol (i.e. IGP/BGP transport). The next paragraph is one that
> covers the base BGP "resolvability" part and does elaborate on the various
> mechanisms like "alternate steering mechanisms" (e.g. any tunnel, SR Policy,
> etc.).

Yes (let me reset a little) -- this is the current text (from §5):

   When steering for SRv6 services is based on shortest path forwarding
   (e.g., best-effort or IGP Flexible Algorithm
   [I-D.ietf-lsr-flex-algo]) to the egress PE, the ingress PE
   encapsulates the IPv4 or IPv6 customer packet in an outer IPv6 header
   (using H.Encaps or H.Encaps.Red flavors specified in [RFC8986]) where
   the destination address is the SRv6 Service SID associated with the
   related BGP route update.  Therefore, the ingress PE SHOULD perform
   resolvability check for the SRv6 Service SID before considering the
   received prefix for the BGP best path computation.  The resolvability
   is evaluated as per [RFC4271].  If the SRv6 SID is reachable via more
   than one forwarding table, local policy is used to determine which
   table to use.  The result of an SRv6 Service SID resolvability (e.g.,
   when provided via IGP Flexible Algorithm) can be ignored if the
   ingress PE has a local policy that allows an alternate steering
   mechanism to reach the egress PE.  The details of such steering
   mechanisms are outside the scope of this document.

My point is that it is a requirement for the SID to be reachable --
independent of how it is resolved: IGP, BGP, "alternate steering
mechanisms", etc.  Otherwise it can't be used.

If we agree with that then the requirement should be reflected in the
text: s/SHOULD/MUST/g

Thanks!

Alvaro.