Subject: [RTG-DIR] RtgDir review: draft-ietf-opsec-bgp-security

From: Geoff Huston <[email-masked]>
Date: Thu, 9 Oct 2014 12:58:14 +1100

Hello,

I have been selected as the Routing Directorate reviewer for this draft. The Routing Directorate seeks to review all routing or routing-related drafts as they pass through IETF last call and IESG review, and sometimes on special request. The purpose of the review is to provide assistance to the Routing ADs. For more information about the Routing Directorate, please see ​http://trac.tools.ietf.org/area/rtg/trac/wiki/RtgDir

Although these comments are primarily for the use of the Routing ADs, it would be helpful if you could consider them along with any other IETF Last Call comments that you receive, and strive to resolve them through discussion or by updating the draft.

Document: draft-name-version.txt 
Reviewer: Geoff Huston
Review Date: 9 October
IETF LC End Date: date-if-known 
Intended Status: BCP

Summary: 
	I have significant concerns about this document and recommend that the Routing ADs discuss these issues further with the authors.

Comments:
	The document asserts that this document is entirely about BGP operational security. The problem is that this is not the case. The document is unsure whether its about “operational security” or whether it's the "Miss Manners Guide to Proper BGP Etiquette and Style", and the result is a poor pastiche that fails to fulfil either objective. The detail is poorly handled and the selection of topics appears to be somewhat haphazard.
 
	The larger overall issue here is that BGP is used in many contexts and what is appropriate in some contexts is disastrous in others. The document has the highly ambitious objective of attempting to address all security topics related to BGP in all contexts, and it appears that this is just too broad a scope to be able to be addressed is a high quality manner that is focussed on security, that informs the reader of risks and consequences. 

Major Issues:
	There are many issues which this document and the best way to convey them is to use a markup style that clearly associates the comments with the original text. I trust that this pdf attachment conveys these review comments adequately.

---

From: "Adrian Farrel" <[email-masked]>
Date: Thu, 9 Oct 2014 10:16:57 +0100

Geoff,

Many thanks for your thoughtful review.

Authors, although the IETF last call period is over I would really appreciate your opinion on Geoff's review and comments before I do my review as part of the IESG evaluation.

Thanks,
Adrian

> -----Original Message-----
> From: Geoff Huston [mailto:[email-masked]]
> Sent: 09 October 2014 02:58
> To: [email-masked]
> Cc: [email-masked]; [email-masked];
> [email-masked]; [email-masked]; [email-masked]
> Subject: RtgDir review: draft-ietf-opsec-bgp-security
> 
> Hello,
> 
> I have been selected as the Routing Directorate reviewer for this draft. The
> Routing Directorate seeks to review all routing or routing-related drafts as they
> pass through IETF last call and IESG review, and sometimes on special request.
> The purpose of the review is to provide assistance to the Routing ADs. For more
> information about the Routing Directorate, please see 
> http://trac.tools.ietf.org/area/rtg/trac/wiki/RtgDir
> 
> Although these comments are primarily for the use of the Routing ADs, it would
> be helpful if you could consider them along with any other IETF Last Call
> comments that you receive, and strive to resolve them through discussion or by
> updating the draft.
> 
> 	I have significant concerns about this document and recommend that the
> Routing ADs discuss these issues further with the authors.
> 
> Comments:
> 	The document asserts that this document is entirely about BGP
> operational security. The problem is that this is not the case. The document is
> unsure whether its about “operational security” or whether it's the "Miss
> Manners Guide to Proper BGP Etiquette and Style", and the result is a poor
> pastiche that fails to fulfil either objective. The detail is poorly handled and the
> selection of topics appears to be somewhat haphazard.
> 
> 	The larger overall issue here is that BGP is used in many contexts and
> what is appropriate in some contexts is disastrous in others. The document has
> the highly ambitious objective of attempting to address all security topics related
> to BGP in all contexts, and it appears that this is just too broad a scope to be able
> to be addressed is a high quality manner that is focussed on security, that informs
> the reader of risks and consequences.
> 
> Major Issues:
> 	There are many issues which this document and the best way to convey
> them is to use a markup style that clearly associates the comments with the
> original text. I trust that this pdf attachment conveys these review comments
> adequately.
> 
>

---

From: "Jerome Durand (jerduran)" <[email-masked]>
Date: Fri, 10 Oct 2014 05:22:25 +0000

Adrian,

First, thanks a lot for the review. Here are our comments:
  - We note that a large majority of comments are about wording. Text can be modified quickly to take into consideration Geoff Huston’s comments. Many native english speakers have already reviewed and edited the entire doc and made significant changes, but it can never hurt to have another editor.
  - We feel disappointed such comments come that late in the game knowing the draft has been presented in RIPE / NANOG / IETF WGs several times during the last 3 years. Individual contribution to make a great document is more appreciated than such negative comments during an IESG review which do not motivate anyone push this document forward. 
  - We would like to recall the intention is to publish a BCP: Best Current Practices. We don’t want to publish a 200 pages manual explaining theoritical impacts of all guidelines but we want to target real network administrators wondering what to do. We want a document readable and useful. This is the reason why the approach chosen and widely accepted by the community as of now is to give clear recommendations and give many references whenever possible. Also, in most cases where Geoff Huston disagrees with the recommendation, the recommendation is a SHOULD not a MUST one, and these SHOULDs have been extensively reviewed by RIPE and IETF community.
  — The document targets the common Internet BGP peering scenarios as used in today’s Internet. It’s primarily intended as a guide for those network operators that don’t have enough knowledge to make their own fully qualified decisions regarding their BGP-related filtering and security policies. It is therefore not addressing all the non-Internet uses of BGP (MPLS/VPN, L2VPN, EVPN, NVO3 etc.) or corner cases (multihop EBGP), and some recommendations that Geoff Huston opposes are actually based on what network operators do nowadays to make their networks stable, not on what could be done with BGP.
  - We also want to recall that in the last 3 years many improvements have been made regarding BGP security: new registries for special use prefixes, new documents publishes… Draft has been constantly updated. The document will need to be updated again at some point of time in order to adjust to constantly to real best practices. 
  - We now want to hear from the area directors now and see how they want us to move on with this document and if they consider the doc is usable by the community. Authors’ intention is not to write an exhaustive BGP book - there are plenty of texts on the market serving that need - but to write a document that is useful to the operational community without extensive BGP knowledge.

Thank you,

Ivan, Gert and Jerome

--
Jerome Durand
Consulting Systems Engineer - Routing & Switching
[email-masked]  -  +33 6 35 11 60 50
blogs: http://reseauxblog.cisco.fr - http://ipv6blog.cisco.fr
twitter: @JeromeDurand
linkedin: http://fr.linkedin.com/in/jeromedurand

CISCO France
11, rue Camille Desmoulins
92782 Issy les Moulineaux
CEDEX 9
FRANCE

---

From: "Adrian Farrel" <[email-masked]>
Date: Fri, 10 Oct 2014 11:28:47 +0100

Hi Jerome,

Thanks for this response.

I will use it to help me work through Geoff's review and enter my IESG
evaluation ballot.

Adrian

> From: Jerome Durand (jerduran) [mailto:[email-masked]]
> Sent: 10 October 2014 06:22
> To: [email-masked]
> Cc: Geoff Huston; [email-masked]; [email-masked];
<draft-ietf-opsec-bgp-
> [email-masked]> [email-masked];
> [email-masked]; [email-masked]
> Subject: Re: RtgDir review: draft-ietf-opsec-bgp-security
> 
> Adrian,
> 
>   - We note that a large majority of comments are about wording. Text can be
> modified quickly to take into consideration Geoff Huston’s comments. Many
> native english speakers have already reviewed and edited the entire doc and
> made significant changes, but it can never hurt to have another editor.
>   - We feel disappointed such comments come that late in the game knowing the
> draft has been presented in RIPE / NANOG / IETF WGs several times during the
> last 3 years. Individual contribution to make a great document is more
> appreciated than such negative comments during an IESG review which do not
> motivate anyone push this document forward.
>   - We would like to recall the intention is to publish a BCP: Best Current
Practices.
> We don’t want to publish a 200 pages manual explaining theoritical impacts of
all
> guidelines but we want to target real network administrators wondering what to
> do. We want a document readable and useful. This is the reason why the
> approach chosen and widely accepted by the community as of now is to give
clear
> recommendations and give many references whenever possible. Also, in most
> cases where Geoff Huston disagrees with the recommendation, the
> recommendation is a SHOULD not a MUST one, and these SHOULDs have been
> extensively reviewed by RIPE and IETF community.
>   — The document targets the common Internet BGP peering scenarios as used in
> today’s Internet. It’s primarily intended as a guide for those network
operators
> that don’t have enough knowledge to make their own fully qualified decisions
> regarding their BGP-related filtering and security policies. It is therefore
not
> addressing all the non-Internet uses of BGP (MPLS/VPN, L2VPN, EVPN, NVO3
> etc.) or corner cases (multihop EBGP), and some recommendations that Geoff
> Huston opposes are actually based on what network operators do nowadays to
> make their networks stable, not on what could be done with BGP.
>   - We also want to recall that in the last 3 years many improvements have
been
> made regarding BGP security: new registries for special use prefixes, new
> documents publishes… Draft has been constantly updated. The document will
> need to be updated again at some point of time in order to adjust to
constantly
> to real best practices.
>   - We now want to hear from the area directors now and see how they want us
> to move on with this document and if they consider the doc is usable by the
> community. Authors’ intention is not to write an exhaustive BGP book - there
are
> plenty of texts on the market serving that need - but to write a document that
is
> useful to the operational community without extensive BGP knowledge.
> 
> Thank you,
> 
> Ivan, Gert and Jerome
> 
> 
> 
> > Authors, although the IETF last call period is over I would really
appreciate your
> opinion on Geoff's review and comments before I do my review as part of the
> IESG evaluation.
> >
> > Thanks,
> > Adrian
> >
> >> Routing Directorate seeks to review all routing or routing-related drafts
as
> they
> >> to BGP in all contexts, and it appears that this is just too broad a scope
to be
> able

---

From: Geoff Huston <[email-masked]>
Date: Fri, 10 Oct 2014 21:44:42 +1100

Jerome,

I am happy to work with the authors to help with the english expressions, but, more importantly to add crispness and focus to the document. If the intent is "best operational practices for eBGP" then that is a clear, albeit exceptionally broad topic. If its "best operational security practices for eBGP" then that too is a clear topic space that can be used to guide the direction and content of the document. 

Looking at security a bit more, then it may be worth considering documenting practices in terms of intent. i.e. in routing one can categorise many of the practices as either "say no evil" or "hear no evil". i.e. care and attention in what a BGP speaker passes to its BGP peers ensuring accuracy and aligning policy intent to the content of the advertisement stream, and care and attention in examining what a BGP peer passes to the BGP speaker. That form of taxonomy of aligning intent with practices could add some necessary structure to enhance the readability of the document, motivating the considerations of what to do in terms of configuration and operational practice with why it should be done in terms of the security issues such measures are intended to addresses or mitigate.

I have some sympathy with your evident frustration over the publication process and responding constructively to critical comments that appear to be at the last second. We've all been there at one time or another with one document or another. But I think we all share a common interest in ensuring that the advice we provide in these documents is the best possible advice we can give, and my review comments are provided from that motivation. As the ADs are aware there are many documents in the process at any time, and focussing concentrated attention on any single document is often a challenging exercise, even when the document has had a long and widespread gestation. The aim of the RtgDir review is to offer considered advice to the ADs on the quality of the document from the position of someone who is familiar with the subject matter, and I am of the view that this document falls short of what is intended to be a rigorous high quality threshold for an RFC let alone a BCP.

kind regards,

   Geoff