Clarification of the Flowspec Redirect Extended Community
obsoleted by
- rfc-8955 — Dissemination of Flow Specification Rules
updates
- rfc-5575 — Dissemination of Flow Specification Rules
Extracted elements (12)
RFC 5575 registered only a single codepoint (0x8008) for the Flowspec Redirect Extended Community without clearly specifying the Route Target format, leading to 'value wildcard' matching behavior at receiving routers. This ambiguity caused wrong VRF matching decisions because the format of the Route Target in the Redirect community was undefined.
The low-order nibble of the Redirect Extended Community's Type field is intentionally aligned with the Route Target Extended Community format field (Type), so that 0x00, 0x01, and 0x02 in the nibble correspond to 2-octet AS, IPv4, and 4-octet AS formats respectively. The Sub-Type is 0x08 for Redirect rather than 0x02 as used for Route Targets.
Deployed implementations of BGP Flowspec do not implement wildcard Route Target matching; instead, they use format-specific Redirect Extended Communities. This document formalizes that deployed practice by defining three distinct Redirect communities differentiated by Route Target encoding format.
Implementations matching a received Redirect Extended Community's Route Target value must account for the community's specific format (AS-2byte, IPv4, or AS-4byte) and not perform format-agnostic wildcard matching, as the format is now encoded in the high-order type octet.
Three Redirect Extended Communities are defined: redirect AS-2byte (type 0x8008, encoding 2-octet AS + 4-octet Value), redirect IPv4 (type 0x8108, encoding 4-octet IPv4 Address + 2-octet Value), and redirect AS-4byte (type 0x8208, encoding 4-octet AS + 2-octet Value).
IANA created the 'Generic Transitive Experimental Use Extended Community Part 3 Sub-Types' registry under the BGP Extended Communities registry (type 0x82). Sub-type 0x08 is assigned 'Flow spec redirect AS-4byte format'; range 0x00-0xBF uses First Come First Served, 0xC0-0xFF requires IETF Review.
IANA updated the 'BGP Generic Transitive Experimental Use Extended Community Sub-Types' registry to clarify that sub-type 0x08 is 'Flow spec redirect AS-2byte format', referencing both RFC 5575 and RFC 7674.
IANA updated the 'BGP Transitive Extended Community Types' registry to add type 0x81 (Generic Transitive Experimental Use Extended Community Part 2) and type 0x82 (Generic Transitive Experimental Use Extended Community Part 3), each with associated Sub-Types registries.
This document introduces no additional security considerations beyond RFC 5575. However, the previously ambiguous wildcard matching behavior—if implemented—could lead to Flowspec rules being installed in an incorrect VRF, causing traffic to be incorrectly delivered.
redirect AS-2byte (type 0x8008): 2-octet Autonomous System number followed by a 4-octet Value field, sub-type 0x08. This preserves the original RFC 5575 codepoint but constrains it to the two-octet AS Route Target format.
redirect AS-4byte (type 0x8208): 4-octet Autonomous System number followed by a 2-octet Value field, sub-type 0x08. The high-order type octet 0x82 is a new Generic Transitive Experimental Use Extended Community Part 3 type.
redirect IPv4 (type 0x8108): 4-octet IPv4 address followed by a 2-octet Value field, sub-type 0x08. The high-order type octet 0x81 is a new Generic Transitive Experimental Use Extended Community Part 2 type.