Subject: mboned: MSDP and admin scoped addresses

From: Niels den Otter <[email-masked]>
Date: Mon, 28 Nov 2005 10:53:22 +0100

All,

Since the IETF MSDP WG is closed I think MBoned is the best place for
the following question. Please let me know if it should be asked
somewhere else...

My question is what a router should do when it receives an MSDP SA
announcement for a group address within 239.0.0.0/8 (admin scoped address).

Section 16.2.5 (Notification TLV) of spec-13 seems to imply that the
MSDP session must be closed on reception of such SA message:

- ------------------------------------------------------------
   SA-Message/SA-Response Error subcodes
 [...]
            8 - Administrative Scope Boundary Violated  (MC)
- ------------------------------------------------------------
MC = must close

However Section 17 (MSDP Error Handling) is more relaxed on this:

- ------------------------------------------------------------
   When any of the conditions described here are detected, a
   Notification message with the indicated Error Code, Error Subcode,
   and Data fields is sent.  In addition, the MSDP connection MAY be
   closed.  If no Error Subcode is specified, then a zero (Unspecific)
   must be used.
[...]
7.3.8. Administrative Scope Boundary Violated

   This notification is used when an SA message is received for a group
   G from a peer which is across an administrative scope boundary for G.
- ------------------------------------------------------------

Should "Administrative Scope Boundary Violated" be read as a group
within 239.0.0.0/8 or is this the admin scope boundary a configurable
address range? Must a router really close (reset) an MSDP peering
session on receipt of such a message?

Thanks in advance,

Niels den Otter
SURFnet - Network Services
_______________________________________________________________
user interface: http://darkwing.uoregon.edu/~llynch/mboned.html
web archive:  http://darkwing.uoregon.edu/~llynch/mboned/

---

From: Jeremy Hall <[email-masked]>
Date: Mon, 28 Nov 2005 08:10:22 -0500 (EST)

Hello,

I'd suggest a configurable response--some "hard" rules and some "relaxed" 
rules.

For example:

Somebody might want 224.2.0.1 to operate in dense mode so that mtrace 
works.  Somebody else might want to actually use that group.

Somebody might have 239/8 in use and operate with a cooperative across 
organizations.  Ideally the sourcer of the msdp message could specify what 
happens to his sa if it is traversing an illegal path, but that gives 
somebody control over your MSDP session.

_J

---

From: Stig Venaas <[email-masked]>
Date: Wed, 30 Nov 2005 11:39:16 +0100

Hi Niels

On Mon, Nov 28, 2005 at 10:53:22AM +0100, Niels den Otter wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> All,
> 

I don't like the idea of closing it...

This approach sounds better.

> session on receipt of such a message?

IMO it should be configurable. Inside say some organisation, you might
want to break up 239/8 into different ranges for different levels of
scoping. E.g. say 239.192/16 for the entire organisation and say
239.255/16 for each of the sites. On an MSDP peering from say a site
to the organisations backbone you may then want to allow 239.192/16
while blocking everything else from 239/8 (or maybe block only
239.255/16). I believe it's common that implementations allow ACLs for
specifying which groups to allow.

Note that there are a number of non-scoped (globally scoped) groups
that should be filtered out as well.

Stig

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.1 (MingW32)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
> 
> iD8DBQFDitOSDxUhWEap0R4RAgKIAJ49k0Vw7TTv16OhVXeIpos5BAd7/wCfZlM3
> ghxIEMUEVxvyny6K+Qccy+o=
> =ltZw
> -----END PGP SIGNATURE-----

---

From: Niels den Otter <[email-masked]>
Date: Wed, 30 Nov 2005 13:27:10 +0100

Hi Stig, Jeremy,

> >I don't like the idea of closing it...

Me neither. I fully agree with your comments that MSDP filtering should
be configurable and I also think that dropping these SAs is much better
than closing/resetting the MSDP session. I am however in contact with
people that implemented MSDP and who have interpreted...

------------------------------------------------------------
   SA-Message/SA-Response Error subcodes
 [...]
            8 - Administrative Scope Boundary Violated  (MC)
------------------------------------------------------------
MC = must close

... very strictly and close an MSDP session on receipt of an SA within
239.0.0.0/8 to comply to the MSDP draft. I was curious if they read this
correctly and how other implementations behave.

-- Niels

---

From: Stig Venaas <[email-masked]>
Date: Wed, 30 Nov 2005 14:18:38 +0100

> people that implemented MSDP and who have interpreted...

You and them, should look at RFC 3618. That is what they should
implement, not the draft. The RFC doesn't say this. The only thing
I can find in the RFC is:

13.  MSDP Error Handling

   If an MSDP message is received with a TLV format error, the session
   SHOULD be reset with that peer.  MSDP messages with other errors,
   such as unrecognized type code, received from MSDP peers, SHOULD be
   silently discarded and the session SHOULD not be reset.

Since this is obviously not a TLV format error, the session SHOULD
not be reset.

Stig