Subject: Re: [Idr] WG adoption call - draft-li-idr-flowspec-srv6-05,txt

From: Huaimo Chen <[email-masked]>
Date: Tue, 3 Aug 2021 20:58:33 +0000

Hi Ketan,

    Thank you very much for your review and 6 specific comments.
    My responses are inline below with [HC].

  1.  FlowSpec v1 is supposed to be focussed on the DDOS use-case.
I don't find any text in the draft that clarifies how/why this is
related to DDOS use-case. To me, this seems like something for
FlowSpec v2. Per (what I understood to be) WG consensus, this work
is then perhaps deferred to v2.
[HC]: This draft is for FlowSpec v2.

  2.  The draft proposes a new type "Whole SID". My understanding
from the text is that this rule applies to the IPv6 DA and not the
segments within the SRH. If so, then:
     *   What distinguishes a SID from any other IPv6 address in the
DA field?
[HC]: It is a kind of post processing SRv6 PGM that we are matching
on the DA after the SID has been copied from the SRH header to the
DA and SL decremented SL=SL-1.

     *   Why isn't the existing IPv6 DA type not sufficient?
[HC]: It is sufficient but it is the post SRv6 processing after the
SID is copied from SRH to DA when the next hop steering occurs. The
new type can provide some SID specific operations.

  3.  The draft proposes a new type "Some bits of SID (SBoS)".
Again, I believe this applies to the IPv6 DA again - so the same two Qs
above apply to this type to. What prevents a router (mistakenly)
applying this rule to packets with non-SRv6 SID in their DA.
[HC]: Refer to the answers above to the same questions.
A router MUST determine the IPv6 DA is a SID first and then
applies this rule only when the IPv6 DA is a SID.
This can be achieved by applying the rule as a post processing SRv6 PGM.

  4.  When the SBoS type is used, the SRv6 SID structure MUST be
indicated as part of the rule. Then the parts of the SID of interest
that need to be matched are also given in the space for the SID.
Is my understanding correct? If so, the text was not very clear to me.
[HC]: You are right. We will add some descriptions to make it clear.

  5.  The question of why this SBoS type is required again crops us
since the base FlowSpec rule for DA does allow pattern matching on
the IPv6 DA as well? Perhaps I am mistaken, and if so the document
does not provide any text or justification for why these new types
are required.
[HC]: A SRv6 SID has a specific structure with different fields.
Some fields in a SID may have some specific values. For example,
VPN service labels are embedded into some fields such as Func/Arg
of the SRv6 SIDs in some cases. This SBoS type can provide some
specific operations on some fields in a SID. For example, the service
labels in Func/Arg of SRv6 SIDs are within a given range. We may
check the ranges of the values in the fields using SBoS type.
We will add some text for justification.

  6.  Finally, there is no text related to the specific applicability
scenarios for these extensions. Exactly why it is difficult to
determine whether this falls under v1 or v2 scope.
[HC]: We will add some examples using these extensions.

Best Regards,
Huaimo
on behalf of co-authors

________________________________
From: Ketan Talaulikar (ketant) <[email-masked]>
Sent: Friday, July 30, 2021 8:18 AM
To: Susan Hares <[email-masked]>; [email-masked] <[email-masked]>; [email-masked] <[email-masked]>
Subject: RE: [Idr] WG adoption call - draft-li-idr-flowspec-srv6-05,txt

Hello,

I have reviewed https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-li-idr-flowspec-srv6-05&amp;data=04%7C01%7Chuaimo.chen%40futurewei.com%7C0b12565f359d468e7d8308d9535439c6%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637632443513317218%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&amp;sdata=dFhw6e%2F%2BR0%2BkDcGsjOlf2A4MmbuB080PIoBqTi99%2Bt0%3D&amp;reserved=0 and have the following questions for the authors before we consider adoption.

  1.  FlowSpec v1 is supposed to be focussed on the DDOS use-case. I don't find any text in the draft that clarifies how/why this is related to DDOS use-case. To me, this seems like something for FlowSpec v2. Per (what I understood to be) WG consensus, this work is then perhaps deferred to v2.
  2.  The draft proposes a new type "Whole SID". My understanding from the text is that this rule applies to the IPv6 DA and not the segments within the SRH. If so, then:
     *   What distinguishes a SID from any other IPv6 address in the DA field?
     *   Why isn't the existing IPv6 DA type not sufficient?
  3.  The draft proposes a new type "Some bits of SID (SBoS)". Again, I believe this applies to the IPv6 DA again - so the same two Qs above apply to this type to. What prevents a router (mistakenly) applying this rule to packets with non-SRv6 SID in their DA.
  4.  When the SBoS type is used, the SRv6 SID structure MUST be indicated as part of the rule. Then the parts of the SID of interest that need to be matched are also given in the space for the SID. Is my understanding correct? If so, the text was not very clear to me.
  5.  The question of why this SBoS type is required again crops us since the base FlowSpec rule for DA does allow pattern matching on the IPv6 DA as well? Perhaps I am mistaken, and if so the document does not provide any text or justification for why these new types are required.
  6.  Finally, there is no text related to the specific applicability scenarios for these extensions. Exactly why it is difficult to determine whether this falls under v1 or v2 scope.

Thanks,
Ketan

From: Idr <[email-masked]> On Behalf Of Susan Hares
Sent: 23 July 2021 22:28
To: [email-masked]; [email-masked]
Subject: [Idr] WG adoption call - draft-li-idr-flowspec-srv6-05,txt

This begins a 2 week WG adoption call for draft-li-idr-flowspec-srv6-05.txt

---

From: "Lilei (Lily)" <[email-masked]>
Date: Thu, 5 Aug 2021 07:27:34 +0000

Support adoption and I'm not aware of any IPR that applies to the draft

Best Regards,
Lei Li

发件人: Idr [mailto:[email-masked]] 代表 Susan Hares
发送时间: 2021年7月24日 0:58
收件人: [email-masked]; [email-masked]
主题: [Idr] WG adoption call - draft-li-idr-flowspec-srv6-05,txt

This begins a 2 week WG adoption call for draft-li-idr-flowspec-srv6-05.txt.

I am missing 3 IPR statements (Zhenbin Li , Lei Li , and Lei Liu).
These authors should send in their IPR statements in response to this call.

This draft is targeted for the V2 version of flow specification.
Flow specification v2 draft will be discussed at an interim on 9/13/2021.

If it is adopted, it will be developed as part of the v2 set of drafts.

Please consider if:

1) if this draft is useful for networks,
2) if you wish to adopt this draft prior to adopting flow specification v2.

Cheerily, Susan Hares

---

From: "Chengli (Cheng Li)" <[email-masked]>
Date: Tue, 10 Aug 2021 07:20:09 +0000

Yes, I support the document to be adopted.

Thanks,
Cheng

From: Idr [mailto:[email-masked]] On Behalf Of Gyan Mishra
Sent: Monday, July 26, 2021 12:31 AM
To: Susan Hares <[email-masked]>
Cc: [email-masked]; [email-masked]
Subject: Re: [Idr] WG adoption call - draft-li-idr-flowspec-srv6-05,txt

I support WG adoption.

This document provides a valuable tool to operators for BGP FS matching and filtering of SRv6 packets using two newly introduced FS match component types from a SID copy from SRH, FS match type for 1>128 bit SID match 2>field <locator,Func,Arg> sub portion of the SID.

Regards

Gyan

On Fri, Jul 23, 2021 at 12:58 PM Susan Hares <[email-masked]<mailto:[email-masked]>> wrote:
This begins a 2 week WG adoption call for draft-li-idr-flowspec-srv6-05.txt.

Please consider if:

Cheerily, Susan Hares

_______________________________________________
Idr mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/idr
--

[http://ss7.vzw.com/is/image/VerizonWireless/vz-logo-email]<http://www.verizon.com/>

Gyan Mishra

Network Solutions Architect

Email [email-masked]<mailto:[email-masked]>

M 301 502-1347

---

From: Donald Eastlake <[email-masked]>
Date: Tue, 10 Aug 2021 10:34:19 -0400

I support WG adoption of this draft. I believe that flowspec for srv6
will be useful for networks -- the adoption of this draft indicates a
starting point for work, details can be adjusted later. I think the
draft can be adopted before a flowspec V2 draft is adopted .

Thanks,
Donald
===============================
 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 2386 Panoramic Circle, Apopka, FL 32703 USA
 [email-masked]

On Fri, Jul 23, 2021 at 12:58 PM Susan Hares <[email-masked]> wrote:
> [email-masked]

---

From: Tianran Zhou <[email-masked]>
Date: Mon, 23 Aug 2021 07:15:04 +0000

Hi Sue and WG,

I've read this draft. And feel it's useful.
I think it's good for the wg to adopt this work.
I think there is no need to defer this progress by flow spec v2.
It could be the warm up before a more integrated work.

Tianran

From: Idr [mailto:[email-masked]] On Behalf Of Susan Hares
Sent: Saturday, July 24, 2021 12:58 AM
To: [email-masked]; [email-masked]
Subject: [Idr] WG adoption call - draft-li-idr-flowspec-srv6-05,txt

Please consider if:

Cheerily, Susan Hares

---

From: "Yangfan (IP Standard)" <[email-masked]>
Date: Mon, 23 Aug 2021 11:02:11 +0000

Hi IDR,

This draft is useful and important to develop BGP Flow Spec V2, so I support the adoption of this draft. Thanks.

Best,
Fan

Please consider if:

Cheerily, Susan Hares

---

From: "Wangyali(Yali,Data Communication Standards and Patents Dept)" <[email-masked]>
Date: Tue, 24 Aug 2021 10:23:33 +0000

Hi WG,

I support the adoption of this draft.

Thanks,
Yali

Please consider if:

Cheerily, Susan Hares