Subject: [Idr] Shepherd Write-up for draft-ietf-idr-ext-opt-param-09.txt

From: "Susan Hares" <[email-masked]>
Date: Thu, 12 Nov 2020 16:17:58 -0500

Enke, John and Jeff Hass. 

The extended optional parameter provides a useful addition to BGP Opens with
RFC4271.  Thank you for a well written document and Jeff Haas for an
excellent implementation report from Juniper.  I agree this extension to the
optional parameter length is backward compatible and clearly defined.

I am concerned that your brief security statement will not be sufficient for
the IESG.  This does not mean I believe that a well-written BGP
implementation will have a security issue with this feature.   My suggestion
is to unpack the security section to explain why this feature does not
additional burdens on overflow buffers for the BGP open or the space for
processing the optional parameters.   I have provided you with some sample
text below.  

I am forwarding this to IESG for publication and asking for early security
directorate review by 12/7/2020.  

I suspect due to IETF 109 and the length of Alvaro's queue, that you may
receive the security directorates early review before Alvaro gets to this
text.  

Thank you for hard work on this technology over years!

Sue 

-------------

Potential comment: 

Old:

/This extension does not change the  underlying security issues

Inherent in the existing BGP [RFC4271]. 

/

New: 

/This extension does not change the underlying security issues 

Inherent in the existing BGP [RFC4271].  

To expand on why the security issue are not changed, 

Consider that the implementations for RFC4271 

must handle BGP open packets with length exceeds the packet length. 

Inclusion of a longer optional parameters section does not 

change the RFC4271 check for the size of the BGP Open 

message.  Overruns of the space for optional parameters should not  

occur old BGP speakers since any RFC 4271 receiving an 

optional parameter length of 255 will not have a valid 

packet and discard the packet.  Implementations 

of this specification require BGP speakers which 

use the new optional to check the Extended 

optional parameter length.  Implementations 

of this specification should allocate sufficient 

space to handle longer optional parameters.    

/