BGP Administrative Shutdown Communication
RFC 8203

Received changes through RFC Editor sync (created alias RFC 8203, changed abstract to 'This document enhances the BGP Cease NOTIFICATION message "Administrative Shutdown" and "Administrative Reset" subcodes for operators to transmit a short freeform message to describe why a BGP session was shutdown or reset.  This document updates RFC 4486.', changed pages to 6, changed standardization level to Proposed Standard, changed state to RFC, added RFC published event at 2017-07-25, changed IESG state to RFC Published, created updates relation between draft-ietf-idr-shutdown and RFC 4486)

[Ballot comment]
Since this notification message is only defined for two of the subcodes, shouldn't the error handling in Section 4 also check for invalid subcodes?

Why is the length limited to 128 (instead of the possible 255)? Could be useful to clarify.

[Ballot comment]
The portion of Section 6 (Security Considerations) that discusses confusable characters is describing a problem that isn't obvious on first reading. As these strings are human-produced and human-consumed, it's not clear what harm would arise through the use of spoofing. If there is a real risk here that the authors are aware of, it should be described in more detail to allow implemetors to more adeptly steer around it. If not, the statement around spoofing should probably be removed so as to avoid implementors scratching their heads regarding what mitigating actions they might take.

[Ballot comment]
Having had to deal with many instances of "Hey, my BGP session with you just went down, whatsup?!", "Yes, it's a maintenance. I sent you mail about it last month, then last week, then this morning, then 5 minutes before pulling the session. You even generated a ticket for me, it's # [1432323] 'kthnxbye..." I think that this is the best thing since sliced bread (of course, I also thought jabber over BGP was cool).

Some nits:
2.  Shutdown Communication
Shutdown Communication:  to support international characters, the
      Shutdown Communication field MUST be encoded using UTF-8.
perhaps:
"MUST be encoded using UTF-8 "Shortest Form" encoding"? (from Security Considerations) - or Alexey Melnikov's suggestion...


Also, *perhaps* it is worth noting that it might be possible for someone to send:
'BGP going down\nMay 22 11:19:12 rtr1 mib2d[42]: SNMP_TRAP_LINK_TYPE: ifIndex 501, ifOperStatus "Interface is a small turnip", ifName ge-1/2/3'
and that logging of these should strip control characters. This may already be covered in syslog...

[Ballot comment]
I wondering why there is this addition cited below to the copyright notice needed given there is no IPR declared. Can you please explain?!
„This document may contain material from IETF Documents or IETF
  Contributions published or made publicly available before November
  10, 2008.  The person(s) controlling the copyright in some of this
  material may not have granted the IETF Trust the right to allow
  modifications of such material outside the IETF Standards Process.
  Without obtaining an adequate license from the person(s) controlling
  the copyright in such materials, this document may not be modified
  outside the IETF Standards Process, and derivative works of it may
  not be created outside the IETF Standards Process, except to format
  it for publication as an RFC or to translate it into languages other
  than English.“

[Ballot comment]
In Section 2:

  Shutdown Communication:  to support international characters, the
      Shutdown Communication field MUST be encoded using UTF-8.  A
      receiving BGP speaker MUST NOT interpret invalid UTF-8 sequences.
      Note that when the Shutdown Communication contains multibyte
      characters, the number of characters will be less than the length
      value.  This field is not NUL terminated.

I think you should stick a reference to RFC 5198, which talks about subset of UTF-8 intended for human consumption.

I was also thinking about language tagging (RFC 5646) for human readable text, but I suspect that nobody will implement it in your extension.

(Via drafts-lastcall@iana.org): IESG/Authors/WG Chairs:

The IANA Services Operator has completed its review of draft-ietf-idr-shutdown-08.txt. If any part of this review is inaccurate, please let us know.

The IANA Services Operator understands that, upon approval of this document, there is a single action which we must complete.

In the BGP Cease NOTIFICATION message subcodes subregistry of the BGP Error Subcodes registry at the Border Gateway Protocol (BGP) Parameters registry page located at:

https://www.iana.org/assignments/bgp-parameters/

the reference for values '2' and '4' will have [ RFC-to-be ] added to the existing reference of [RFC4486].

The IANA Services Operator understands that this is the only action required to be completed upon approval of this document.

Note:  The actions requested in this document will not be completed until the document has been approved for publication as an RFC. This message is only to confirm what actions will be performed.

Thank you,

Sabrina Tanamal
IANA Services Specialist
PTI

The following Last Call announcement was sent out:

From: The IESG
To: IETF-Announce
CC: idr@ietf.org, skh@ndzh.com, Susan Hares , idr-chairs@ietf.org, aretana@cisco.com, draft-ietf-idr-shutdown@ietf.org
Reply-To: ietf@ietf.org
Sender:
Subject: Last Call:  (BGP Administrative Shutdown Communication) to Proposed Standard


The IESG has received a request from the Inter-Domain Routing WG (idr) to
consider the following document:
- 'BGP Administrative Shutdown Communication'
  as Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action. Please send substantive comments to the
ietf@ietf.org mailing lists by 2017-05-19. Exceptionally, comments may be
sent to iesg@ietf.org instead. In either case, please retain the
beginning of the Subject line to allow automated sorting.

Abstract


  This document enhances the BGP Cease NOTIFICATION message
  "Administrative Shutdown" and "Administrative Reset" subcodes for
  operators to transmit a short freeform message to describe why a BGP
  session was shutdown or reset.  This document updates RFC 4486.





The file can be obtained via
https://datatracker.ietf.org/doc/draft-ietf-idr-shutdown/

IESG discussion can be tracked via
https://datatracker.ietf.org/doc/draft-ietf-idr-shutdown/ballot/


No IPR declarations have been submitted directly on this I-D.

== AD Review of draft-ietf-idr-shutdown-07 ==

Dear authors:

This document partially answers the “why did the session go down?” question by adding the ability to send other information as part of a Cease NOTIFICATION.  I say “partially” because it does so for only 2 of the existing subcodes.  Except for the draft’s name, there’s no justification or explanation of why all the current (or even future!) subcodes are not granted the ability to (optionally) send extra information.  Why?  I know that this point was brought up on the list [1], and the resolution seems to have simply been “that’s out of scope”.  Personally (taking my AD hat off!), I think it’s a shame – but I guess it’s also an opportunity to write a 1-line update to this document.  BTW, I don’t want to necessarily resurrect this point, I’m ok being in the rough…  [Putting my AD hat back on…]  It would be very nice if there was some text (a paragraph or two) explaining why just 2 subcodes, or maybe why not the others – I’m sure (or maybe I hope) that others will have similar questions.

Besides that rant, I do have some other comments (please see below) aimed mostly at clarifying.  I would like to (at least) see the comments about the Security Considerations addressed before starting the IETF Last Call.

Thanks!

Alvaro.

[1] https://mailarchive.ietf.org/arch/msg/idr/YJPgIdtZg7DrY4PliefkrPm6Kas/?qid=fb7d4b6fce9500d97f5b7ab25a062d53



C1. s/This document specifies…/This document updates [RFC4486] by specifying…


C2. s/Cease NOTIFICATION message [RFC4486]/Cease NOTIFICATION message [RFC4271] – or simply take the reference off.


C3. Section 2. (Shutdown Communication)

OLD>
  … then the BGP speaker MAY send to the neighbor a
  NOTIFICATION message with the Error Code "Cease" and Error Subcode
  "Administrative Shutdown" or "Administrative Reset" followed by a
  length field and an UTF-8 encoded string.

NEW>
…and it sends a NOTIFIATION message with the Error Code "Cease" and Error Subcode "Administrative Shutdown" or "Administrative Reset" [RFC4486], it MAY include an UTF-8 encoded string.

Objective: move the MAY to indicate that the extra string is optional, and not the whole thing.  I know that a BGP speaker may end up not sending the Cease because rfc4486 has a SHOULD in it…but I also wanted to avoid confusion between that SHOULD and this MAY.


C4. Please put a Figure number to go with the encoding.


C5. Section 4. (Error Handling): “Any erroneous or malformed Shutdown Communication received SHOULD be logged for the attention of the operator and then MAY be discarded.”

C5.1. What does “erroneous or malformed” mean?  I guess this is beyond a bad length, but maybe it refers to invalid UTF-8 sequences, or maybe something different.  ??

C5.2. Does the fact the content is erroneous mean that the NOTIFICATION should be ignored?  I would assume not…but the “MAY be discarded” part may raise questions.  Do you only discard the “Shutdown Communication” part?  Or the whole NOTIFICATION?  Where you storing NOTIFICATIONs to start with?  I guess an implementation can keep the string around for historical purposes…but that seems an implementation detail and nothing like that is specified in the document.

C5.3. Section 2 already talks about reporting the contents -- I’m assuming the logging requirement here is the same (do whatever you want, but syslog SHOULD be used), right?  If so, then how is the handling of the “erroneous or malformed” information different than that of the one that isn’t?


C6. Section 5. (IANA Considerations) Why do you want the registry to refer to this document?  There’s nothing in this document that modifies or affects the registry, the policies or the assignments…  I think that the Updates tag is enough to show the relationship.


C7. Section 6.  (Security Considerations)

C7.1. REQUIRING is not an rfc2119 keyword.  Please work REQUIRED in there instead.

C7.2. I agree on the points about integrity and confidentiality.  However, neither rfc4486, rfc4271 nor rfc4272 are as specific as you’re being here.  I don’t think this is the document where we want to have the discussion about explicitly upgrading to TCP-AO, even if it’s just mentioned as an example.  Suggestion:  leave the text about the potential concern, take both examples out, and point at the security considerations in rfc4271/rfc4272.

NEW>
  Users of this mechanism should be aware that unless a transport that
  provides integrity is used for the BGP
  session in question, a Shutdown Communication message could be
  forged.  Unless a transport that provides confidentiality
  is used, a Shutdown Communication message could be
  snooped by an attacker.  These issues are common to any BGP message
  but may be of greater interest in the context of this proposal since
  the information carried in the message is generally expected to be
  used for human-to-human communication.  Refer to the related considerations
  in [RFC4271] and [RFC4272].

C7.3. In the Shepherd’s write-up [2], Sue wrote: “The Security-ADs will look at the ability to send data which indicates specific details regarding an operator or the operator's topology.”  Given that the operator can put anything in the string, it would be nice if you addressed this concern up front (and not wait for the SEC ADs).  Even if the information is being sent to a “trusted” peer, I think Sue raises an interesting point as “confidential” information may be inadvertently sent out.  One way to address this concern may be with guidance to operators and to reaffirm the fact that while the information is sent only one hop away (to your peer), it can be used as the receiver’s discretion.

[2] https://datatracker.ietf.org/doc/draft-ietf-idr-shutdown/shepherdwriteup/

Status:  Sent to IESG 2/14/2017 (Sue Hares)

Template date: (2/24/2012, via RFC4848)

(1) What type of RFC is being requested (BCP, Proposed Standard,
Internet Standard, Informational, Experimental, or Historic)?  Why
is this the proper type of RFC?  Is this type of RFC indicated in the
title page header?

Proposed Standard. 

(2) The IESG approval announcement includes a Document Announcement
Write-Up. Please provide such a Document Announcement Write-Up. Recent
examples can be found in the "Action" announcements for approved
documents. The approval announcement contains the following sections:

Technical Summary
  This document enhances the BGP Cease NOTIFICATION message
  "Administrative Shutdown" and "Administrative Reset" subcodes for
  operators to transmit a short freeform message to describe why a BGP
  session was shutdown or reset.  This document updates RFC 4486.

Working Group Summary

WG consensus call was quiet compared to the adoption call.
The final discussion has operators and implementers agreeing to this work.
6 implementations exist on open source (included in document0.

Adoption call:
https://www.ietf.org/mail-archive/web/idr/current/msg17080.html

WG LC (first 2 weeks):
https://www.ietf.org/mail-archive/web/idr/current/msg17320.html
Two week extension:
https://www.ietf.org/mail-archive/web/idr/current/msg17349.html
Consensus Call:

Document Quality
6 implementations in open source.  Commercial vendors indicate interest.

Shepherd review:
https://www.ietf.org/mail-archive/web/idr/current/msg17319.html

RTG-DIR QA Review:
https://www.ietf.org/mail-archive/web/idr/current/msg17385.html

Personnel
Document Shepherd: Susan Hares
AD: Alvaro Retana 

(3) Briefly describe the review of this document that was performed by
the Document Shepherd.  If this version of the document is not ready
for publication, please explain why the document is being forwarded to
the IESG.

1) NITS,
2) technical review (see Shepherd report) 
3) review of implementatino
4) IPR check

(4) Does the document Shepherd have any concerns about the depth or
breadth of the reviews that have been performed?
No.

(5) Do portions of the document need review from a particular or from
broader perspective, e.g., security, operational complexity, AAA, DNS,
DHCP, XML, or internationalization? If so, describe the review that
took place.

Nothing beyond the normal checks.
Security directorate and OPS-DIR will look at the passing of the extra text in their review.
The Security-ADs will look at the ability to send data which indicates specific details regarding an operator or the operator's topology. 

(6) Describe any specific concerns or issues that the Document Shepherd
has with this document that the Responsible Area Director and/or the
IESG should be aware of? For example, perhaps he or she is uncomfortable
with certain parts of the document, or has concerns whether there really
is a need for it. In any event, if the WG has discussed those issues and
has indicated that it still wishes to advance the document, detail those
concerns here.

None.  Operators need this specification to solve an operational issue.

(7) Has each author confirmed that any and all appropriate IPR
disclosures required for full conformance with the provisions of BCP 78
and BCP 79 have already been filed. If not, explain why.

Job Snijders
https://www.ietf.org/mail-archive/web/idr/current/msg17399.html

Jakob Heitz
https://www.ietf.org/mail-archive/web/idr/current/msg17400.html

John Scudder:
https://www.ietf.org/mail-archive/web/idr/current/msg17403.html


(8) Has an IPR disclosure been filed that references this document?
If so, summarize any WG discussion and conclusion regarding the IPR
disclosures.
none

(9) How solid is the WG consensus behind this document? Does it
represent the strong concurrence of a few individuals, with others
being silent, or does the WG as a whole understand and agree with it? 

Solid - in that earlier debate formed WG adoption.
Operators make this one of the "must-haves" for 2017.
The WG LC has less participation after the adoption debayte.

(10) Has anyone threatened an appeal or otherwise indicated extreme
discontent? If so, please summarise the areas of conflict in separate
email messages to the Responsible Area Director. (It should be in a
separate email because this questionnaire is publicly available.)

No.

(11) Identify any ID nits the Document Shepherd has found in this
document. (See https://www.ietf.org/tools/idnits/ and the Internet-Drafts
Checklist). Boilerplate checks are not enough; this check needs to be
thorough.

No nits. Warning on the  disclaimer for pre-RFC5378 work that seems to come up in all documents.

(12) Describe how the document meets any required formal review
criteria, such as the MIB Doctor, media type, and URI type reviews.

no specific.

(13) Have all references within this document been identified as
either normative or informative?

Yes.

(14) Are there normative references to documents that are not ready for
advancement or are otherwise in an unclear state? If such normative
references exist, what is the plan for their completion?
No.

(15) Are there downward normative references references (see RFC 3967)?
If so, list these downward references to support the Area Director in
the Last Call procedure.
No.
(16) Will publication of this document change the status of any
existing RFCs? Are those RFCs listed on the title page header, listed
in the abstract, and discussed in the introduction? If the RFCs are not
listed in the Abstract and Introduction, explain why, and point to the
part of the document where the relationship of this document to the
other RFCs is discussed. If this information is not in the document,
explain why the WG considers it unnecessary.

Yes - RFC 4486.

(17) Describe the Document Shepherd's review of the IANA considerations
section, especially with regard to its consistency with the body of the
document. Confirm that all protocol extensions that the document makes
are associated with the appropriate reservations in IANA registries.
Confirm that any referenced IANA registries have been clearly
identified. Confirm that newly created IANA registries include a
detailed specification of the initial contents for the registry, that
allocations procedures for future registrations are defined, and a
reasonable name for the new registry has been suggested (see RFC 5226).


No new registries.  Simply adding additional RFC reference to
existing entries in IANA  BGP Cease NOTIFICATION message subcodes" registry under
  the "Border Gateway Protocol (BGP) Parameters" group

(18) List any new IANA registries that require Expert Review for future
allocations. Provide any public guidance that the IESG would find
useful in selecting the IANA Experts for these new registries.

not applicable.

(19) Describe reviews and automated checks performed by the Document
Shepherd to validate sections of the document written in a formal
language, such as XML code, BNF rules, MIB definitions, etc.

not applicable.