Re: [Gen-art] Gen-ART telechat review of draft-ietf-sidr-roa-validation-10.txt

[Brian E Carpenter <[e-mail]>]

Hi Geoff,

On 2011-04-28 17:13, Geoff Huston wrote:
> On 23/04/2011, at 11:51 AM, Brian E Carpenter wrote:
> 
>>>   It is a matter of local routing policy as to the actions to be
>>>   undertaken by a routing entity in processing those routes with
>>>   "unknown" validity states.
>> That leaves open the possibility that an AS_SET aggregated route (which
>> is by definition "unknown") would be rejected as part of a general policy
>> choice. At the least, it seems that this should be mentioned to ensure that
>> operators are aware of it. This is orthogonal to the fact that AS_SET
>> is intrinsically a security problem.
>>
>> Suggested sentence to add:
>>
>> Operators should be aware that a policy that rejects all "unknown" routes
>> will thereby reject any aggregated (AS_SET) route.
> 
> Thanks for your review Brian.
> 
> The draft already states "you really should not reject "unknown" routes":
> 
>    "Due to considerations of partial use of
>    ROAs in heterogeneous environments, such as in the public Internet,
>    it is advised that local policy settings should not result in
>    "unknown" validity state outcomes being considered as sufficient
>    grounds to reject a route outright from further consideration as a
>    local "best" route."
> 
> I believe that this is sufficient in terms of guidance for an informational 
> document to say "please don't shoot your foot off!" :-)

It's purely a matter of taste, so I won't push it.

    Brian