IESG Benjamin Kaduk: Section 6

[stoffi92]

Section 6

By default a Flow Specification NLRI MUST be validated such that it
   is considered feasible if and only if all of the below is true:

Perhaps "in the absence of explicit configuration otherwise," to more closely parallel the other case?

   BGP implementations MUST also enforce that the AS_PATH attribute of a
   route received via the External Border Gateway Protocol (eBGP)
   contains the neighboring AS in the left-most position of the AS_PATH
   attribute.  While this rule is optional in the BGP specification, it
   becomes necessary to enforce it for security reasons.

nit: missing word (e.g., "necessary to enforce it here" or "necessary to enforce it in processing flow specifications").

   The best-match unicast route may change over the time independently
   of the Flow Specification NLRI.  Therefore, a revalidation of the
   Flow Specification NLRI MUST be performed whenever unicast routes
   change.  Revalidation is defined as retesting that clause a and
   clause b above are true.

IMPORTANT: Why does clause c not need to be retested?

   The neighboring AS is the immediate destination of the traffic
   described by the Flow Specification.  If it requests these flows to
   be dropped, that request can be honored without concern that it
   represents a denial of service in itself.  Supposedly, the traffic is
   being dropped by the downstream autonomous system, and there is no
   added value in carrying the traffic to it.

(This presumes that there is some integrity protection applied to the received data, which might be worth making more explicit.) Also, nit: I'd suggest s/Supposedly,/The reasoning is that this is as if/

[suehares]

Christoph - the commas in C are problematic. If the text is normative but confusing. Here's an alternative - but I need Robert to review it.

 c) There are no more specific unicast routes, when compared with
  the flow destination prefix that have been received from a
  different neighboring AS than the best-match unicast route.
  The best-match unicast rule has been determined in rule b.   

As to the configuration - everything in BGP is configuration. Leave it out.

[suehares]

Ben is also catching the fact we are allowing Rule A to be negated by configuration. I continue to wonder if we should have included the OID.

However, rule a) MAY be relaxed by explicit configuration, permitting Flow Specifications that include no destination prefix component. If such is the case, rules b) and c) are moot and MUST be disregarded.

[stoffi92]

//doc Solved as suggested. Clause C also needs to be tested (a third clause was introduced, while this paragraph was not changed). The integrity of the BGP messages themselves are not the scope of this document.