Subject: Re: [Idr] [sidr] Levels of BGPsec/RPKI validation, was: Re: wglc for draft-ietf-sidr-bgpsec-protocol-11
From: Matthew Lepinski <[email-masked]>
To: Iljitsch van Beijnum <[email-masked]>
Cc: "[email-masked] wg" <[email-masked]>, "[email-masked]" <[email-masked]>, [email-masked]
Date: Thu, 30 Apr 2015 13:48:18 -0400
List-Id: Inter-Domain Routing <idr.ietf.org>

Iljitsch,

Thank you for the feedback. With regards to bgpsec-protocol and/or
bgpsec-overview, I am not sure what text would be helpful.

For path validation (as opposed to origin validation), the path validation
algorithm returns one of two states. That is, either an update has a valid
signed path or it doesn't. (We discussed previously in SIDR whether there
was a useful third case for path validation, and the working group wasn't
able to come up with one.)

This means that there are six possible states that come from SIDR
validation (assuming you are using both origin validation and path
validation). That is, three possible origin validation states and two
possible path validation states yields six possible joint states. Of
course, one's local policy is free to collapse that state-space if they
wish to treat of some of those states as identical. (Perhaps if origin is
invalid, then it doesn't matter whether path is valid or not ... maybe it
is foolish to care about whether there are signatures on a path if the path
is headed to a bad destination. I don't know ... but it is a matter of
local policy, and it is perfectly fine for different operators to handle
such cases differently.)

In any case, with regards to path validation, I think that in general  one
wants to prefer routes with valid, signed paths over routes that lack
valid, signed paths. However, personally, for path validation, I would not
recommend throwing out all route advertisements where path validation
returns invalid. That is, if the only route you know of to get to a
particular block of address space has a signature that doesn't valid (or
lack signatures because someone in the middle doesn't have BGPsec turned
on), I think it is probably a good idea to use that route despite the lack
of valid signature chain. (But again, this is a matter of local policy, and
I don't want to mandate policy decisions for network operators in the base
protocol specification.)

- Matt Lepinski

On Tue, Apr 28, 2015 at 2:01 PM, Iljitsch van Beijnum <[email-masked]>
wrote:

> On 28 Jan 2015, at 23:38, Sandra Murphy <[email-masked]> wrote:
>
> > idr folk, your attention and comments would be appreciated as well.
>
> Since you ask...
>
> I'm sending this to both idr and sidr as I think this needs broader input
> than just sidr. (And it seems I'm no longer on the sidr list.)
>
> I read draft-ietf-sidr-bgpsec-protocol-11 and
> draft-lepinski-bgpsec-overview-00.txt as well as RFC 6483.
>
> I think what's lacking here is any discussion of what happens when
> certificates etc expire. Please stay with me for a bit:
>
> RFC 6483 talks about RPKI route validation, which suggests that there are
> three possible states:
>
> valid
> unknown
> invalid
>
> where valid is preferred over unknown and unknown over invalid, and:
>
> "It is a matter of local routing policy as to whether routes with an
> "invalid" validity state are considered to be ineligible for further
> consideration in a route selection process."
>
> Actually, I think the only reasonable approach is to filter out invalids
> and prefer valids over unknowns. The important part here is that if there's
> a ROA for 193.0.0.0/21 and then someone announces a more specific like
> 193.0.7.0/24, that /24 will be "invalid", so even in partial deployment
> RPKI users are protected against malicious or accidental more specifics.
> But if invalids are accepted, even with a very low preference, then they
> still get to divert traffic.
>
> So far, so good.
>
> But now what if a certificate expires? We know from the web that this is
> extremely common. If an expired certificate means the prefixes involved are
> marked invalid, this means that filtering invalids becomes very
> problematic: not only will prefixes randomly drop off the net as people
> forget to generate or install certificates or RPKI caches get stale, but if
> things get really bad the resulting lack of connectivity makes it
> impossible to correct the problem...
>
> So what we need is for expired certificates to make the affected prefixes
> revert to unknown rather than invalid. Turns out, that's what happens today:
>
> http://mailman.nanog.org/pipermail/nanog/2014-December/071907.html
>
> However, unless this is specified in one of the related documents other
> than the three mentioned above, this seems to be an implementation choice.
>
> I think the above issue needs to be discussed in an update of RFC 6483 or
> in one of the BGPsec documents.
>
> And there's probably a bit more to think about: wouldn't it make sense to
> be able to filter on the signature algorithm at some point during the
> transition from one algorithm to the next? Or to be able to filter on
> "expired" explicitly? A binary valid/invalid isn't enough.
> Valid/unknown/invalid is workable, but maybe four or five levels is even
> better.
>
> (And have a look at how this works in practice:
> http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/command/irg-cr-book/bgp-m1.html
> search for PEX.)
>
> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr
>