RFC 7674

Clarification of the Flowspec Redirect Extended Community

📅 published October 2015, from ietf

Clarification of the Flowspec Redirect Extended Community 🎀

RFC: 7674 📜
Stream: Internet Engineering Task Force (IETF) 🌸
Editor: J. Haas, Ed., Juniper Networks 💖
Date: October 2015 ✨
Category: Standards Track 👑
ISSN: 2070-1721
Updates: RFC 5575 ("Dissemination of Flow Specification Rules") 🦋

Abstract

okay so this doc is basically updating RFC 5575 ("Dissemination of Flow Specification Rules") 💅 to clarify how the BGP Flowspec Redirect Extended Community is formatted. it's a small but important fix, bestie 🫶

Status of This Memo

This is an Internet Standards Track document 👑

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741 📚

Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc7674 🔗

Copyright Notice

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. 🧚

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   3
  2.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   5
    2.1.  BGP Transitive Extended Community Types . . . . . . . . .   5
    2.2.  Update to BGP Generic Transitive Experimental Use
          Extended Community Sub-Types  . . . . . . . . . . . . . .   5
    2.3.  Generic Transitive Experimental Use Extended Community
          Part 2 Sub-Types  . . . . . . . . . . . . . . . . . . . .   5
    2.4.  Generic Transitive Experimental Use Extended Community
          Part 3 Sub-Types  . . . . . . . . . . . . . . . . . . . .   6
  3.  Security Considerations . . . . . . . . . . . . . . . . . . .   6
  4.  Normative References  . . . . . . . . . . . . . . . . . . . .   7
  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . . . .   7
  Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .   7

1. Introduction ✨

okay so BGP Flowspec, which is "Dissemination of Flow Specification Rules" [RFC5575], had this BGP Extended Community [RFC4360] that let you redirect traffic to a Virtual Routing and Forwarding (VRF) instance matching the flow specification's Network Layer Reachability Information (NLRI). the way RFC 5575 wrote up the Redirect Extended Community was like this 💅

: +--------+--------------------+--------------------------+
: | type   | extended community | encoding                 |
: +--------+--------------------+--------------------------+
: | 0x8008 | redirect           | 6-byte Route Target      |
: +--------+--------------------+--------------------------+
:
: [...]
:
: Redirect:  The redirect extended community allows the traffic to be
: redirected to a VRF routing instance that lists the specified
: route-target in its import policy.  If several local instances
: match this criteria, the choice between them is a local matter
: (for example, the instance with the lowest Route Distinguisher
: value can be elected).  This extended community uses the same
: encoding as the Route Target extended community [RFC4360].
: [...]
:
: 11. IANA Considerations
: [...]
:
: The following traffic filtering flow specification rules have been
: allocated by IANA from the "BGP Extended Communities Type -
: Experimental Use" registry as follows:
: [...]
:
: 0x8008 - Flow spec redirect

The IANA registry of BGP Extended Communities clearly labels communities of specific formats 🏷️ For example, there's "Two-octet AS Specific Extended Community" [RFC4360], "Four-octet AS Specific Extended Community" [RFC5668], and "IPv4 Address Specific Extended Community" [RFC4360]. Route Targets [RFC4360] show their format in the high-order (Type) octet of the Extended Community and set the low-order (Sub-Type) octet to 0x02. The Value field of a Route Target Extended Community is meant to be read in the context of its format 🧠

here's the drama 😭 The Redirect Extended Community only registered one codepoint in IANA's BGP Extended Community registry. So a common reading of its "6-byte Route Target" was: a receiving router looks for a Route Target value that matches the one in the received Redirect Extended Community, then imports the advertised route into the matching VRF instance, subject to the rules in [RFC5575]. But since the Route Target format in the Redirect Extended Community isn't clearly defined, the wrong match can happen 💀

This "value wildcard" matching behavior ignores the format of the Route Target defined for a local VRF, and it can produce the wrong matching decision. It also doesn't match deployed BGP Flowspec implementations 🙈 Those implementations fixed the problem by defining different Redirect Extended Communities that are specific to the format of the Route Target value. This document defines the following Redirect Extended Communities 🌈

+--------+--------------------+-------------------------------------+
| type   | extended community | encoding                            |
+--------+--------------------+-------------------------------------+
| 0x8008 | redirect AS-2byte  | 2-octet AS, 4-octet Value           |
| 0x8108 | redirect IPv4      | 4-octet IPv4 Address, 2-octet Value |
| 0x8208 | redirect AS-4byte  | 4-octet AS, 2-octet Value           |
+--------+--------------------+-------------------------------------+

Worth noting: the low-order nibble of the Redirect's Type field matches the Route Target Extended Community format field (Type). (See Sections 3.1, 3.2, and 4 of [RFC4360] plus Section 2 of [RFC5668].) The low-order octet (Sub-Type) of the Redirect Extended Community stays at 0x08, unlike the 0x02 used for Route Targets 🦋

The IANA registries for the BGP Extended Communities document [RFC7153] were written to update the previously mentioned IANA registries so BGP Extended Community formats are better documented. The IANA Considerations section below amends those registry updates again so the Flowspec redirect communities are documented properly 💜

2. IANA Considerations 🌸

2.1. BGP Transitive Extended Community Types

IANA has updated the "BGP Transitive Extended Community Types" registry as follows 📝

0x81 -  Generic Transitive Experimental Use Extended Community Part 2
        (Sub-Types are defined in the "Generic Transitive
        Experimental Extended Community Part 2 Sub-Types" Registry)

0x82 -  Generic Transitive Experimental Use Extended Community Part 3
        (Sub-Types are defined in the "Generic Transitive
        Experimental Use Extended Community Part 3 Sub-Types"
        Registry)

2.2. Update to BGP Generic Transitive Experimental Use Extended Community Sub-Types

IANA has updated the "BGP Generic Transitive Experimental Use Extended Community Sub-Types" registry as follows 🎀

  0x08 - Flow spec redirect AS-2byte format   [RFC5575] [RFC7674]

2.3. Generic Transitive Experimental Use Extended Community Part 2 Sub-Types

IANA has created the "Generic Transitive Experimental Use Extended Community Part 2 Sub-Types" registry. It lives under the "Border Gateway Protocol (BGP) Extended Communities" registry and has the following note 🧚

   This registry contains values of the second octet (the "Sub-Type"
   field) of an extended community when the value of the first octet
   (the "Type" field) is 0x81.

Registry Name: Generic Transitive Experimental Use Extended Community
Part 2 Sub-Types

  RANGE              REGISTRATION PROCEDURE
  0x00-0xbf          First Come First Served
  0xc0-0xff          IETF Review

  SUB-TYPE VALUE     NAME                             REFERENCE
  0x00-0x07          Unassigned
  0x08               Flow spec redirect IPv4 format   [RFC7674]
  0x09-0xff          Unassigned

2.4. Generic Transitive Experimental Use Extended Community Part 3 Sub-Types

IANA has created the "Generic Transitive Experimental Use Extended Community Part 3 Sub-Types" registry. It's been created under the "Border Gateway Protocol (BGP) Extended Communities" registry and has the following note 🌟

   This registry contains values of the second octet (the "Sub-Type"
   field) of an extended community when the value of the first octet
   (the "Type" field) is 0x82.

Registry Name: Generic Transitive Experimental Use Extended Community
Part 2 Sub-Types

  RANGE              REGISTRATION PROCEDURE
  0x00-0xbf          First Come First Served
  0xc0-0xff          IETF Review

  SUB-TYPE VALUE     NAME                                 REFERENCE
  0x00-0x07          Unassigned
  0x08               Flow spec redirect AS-4byte format   [RFC7674]
  0x09-0xff          Unassigned

3. Security Considerations 💀

This document doesn't add any security considerations beyond the ones already covered in [RFC5575]. But it's worth noting that if the wildcard behavior were actually implemented, this ambiguity could lead to Flowspec rules getting installed in the wrong VRF, and traffic could end up incorrectly delivered 😱 This one's serious, bestie, so take it seriously 🫶

4. Normative References 📚

[RFC4360]  Sangli, S., Tappan, D., and Y. Rekhter, "BGP Extended
           Communities Attribute", RFC 4360, DOI 10.17487/RFC4360,
           February 2006, <http://www.rfc-editor.org/info/rfc4360>.

[RFC5575]  Marques, P., Sheth, N., Raszuk, R., Greene, B., Mauch, J.,
           and D. McPherson, "Dissemination of Flow Specification
           Rules", RFC 5575, DOI 10.17487/RFC5575, August 2009,
           <http://www.rfc-editor.org/info/rfc5575>.

[RFC5668]  Rekhter, Y., Sangli, S., and D. Tappan, "4-Octet AS
           Specific BGP Extended Community", RFC 5668,
           DOI 10.17487/RFC5668, October 2009,
           <http://www.rfc-editor.org/info/rfc5668>.

[RFC7153]  Rosen, E. and Y. Rekhter, "IANA Registries for BGP
           Extended Communities", RFC 7153, DOI 10.17487/RFC7153,
           March 2014, <http://www.rfc-editor.org/info/rfc7153>.

Acknowledgements 🫶

The content of this document came out of implementation discussions of BGP Flowspec with these lovely people 💖

   Andrew Karch (Cisco)

   Robert Raszuk

   Adam Simpson (Alcatel-Lucent)

   Matthieu Texier (Arbor Networks)

   Kaliraj Vairavakkalai (Juniper)

Author's Address 🦋

Jeffrey Haas (editor) Juniper Networks

Email: jhaas@juniper.net

📦 where this page comes from

ietf: rfc7674 2015-10
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms