IETF Logo Mail Archive

Re: [sidr] BGPSEC Threat Model ID

Christopher Morrow <morrowc.lists@gmail.com> Sat, 05 November 2011 03:22 UTC

Return-Path: <christopher.morrow@gmail.com>
X-Original-To: sidr@ietfa.amsl.com
Delivered-To: sidr@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3678111E80AA for <sidr@ietfa.amsl.com>; Fri, 4 Nov 2011 20:22:56 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -103.533
X-Spam-Level:
X-Spam-Status: No, score=-103.533 tagged_above=-999 required=5 tests=[AWL=0.066, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id igr0i9wUVZ1v for <sidr@ietfa.amsl.com>; Fri, 4 Nov 2011 20:22:55 -0700 (PDT)
Received: from mail-yw0-f44.google.com (mail-yw0-f44.google.com [209.85.213.44]) by ietfa.amsl.com (Postfix) with ESMTP id B05DC11E8087 for <sidr@ietf.org>; Fri, 4 Nov 2011 20:22:55 -0700 (PDT)
Received: by ywt2 with SMTP id 2so3623364ywt.31 for <sidr@ietf.org>; Fri, 04 Nov 2011 20:22:55 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=1LsUfLOJWT5vDBfk+S+a+fsqbtgnhk+c666yCQbRwRM=; b=cAdz5ekjaLqu+xFfrrlSuYkGC3QoohYy7gXc58vA+lVuXxbB0L3zK5x3u8dhJFw0nl 2nInp8NojCpO6vbyA+jTVDk50v5sGEQtgDnuAUHD0Sk3jXTHuhEw//FPiOlfHWkoOmnt Pi88T2c3y815i8zBbxtf9sGOrdv4EUeLxmnGw=
MIME-Version: 1.0
Received: by 10.50.36.161 with SMTP id r1mr17098889igj.37.1320463375197; Fri, 04 Nov 2011 20:22:55 -0700 (PDT)
Sender: christopher.morrow@gmail.com
Received: by 10.231.202.142 with HTTP; Fri, 4 Nov 2011 20:22:54 -0700 (PDT)
In-Reply-To: <70A18355-789E-4FF2-8789-1AFB00CD9B8F@castlepoint.net>
References: <E96517DD-BAC7-4DD8-B345-562F71788C6A@tcb.net> <p06240807cad42f85eb7d@193.0.26.186> <32744.216.168.239.87.1320175657.squirrel@webmail.tcb.net> <p06240801cad6ab773279@193.0.26.186> <D9A38669-883D-4090-9F95-BC5C63220950@tcb.net> <p06240801cad800485596@193.0.26.186> <EEBF68E0-FAD9-4AF3-B81B-78760D200D9B@tcb.net> <p06240808cad85ff73d61@193.0.26.186> <080F8FFF-D2C7-4414-B53A-233F88D2009F@vpnc.org> <CAFU7BATC-6DUDNuadakwSa5wj0ryy0=49=XveBXD5Wv=5JL-ag@mail.gmail.com> <m2aa8c489s.wl%randy@psg.com> <53FA9B4A-552C-4998-8F69-592A0F5AA13B@verisign.com> <CAL9jLaZj1wcmDnbm1f9=csUv2Uuq_w3rS6UEYmUHAQDPWT9zFg@mail.gmail.com> <F83858F5-1505-433B-8B60-EE4F9F6E3E25@castlepoint.net> <CAL9jLaYw140egPh6g5PQsg5f-zSkjSyHeK8nq4ZGtC7RkyNyGQ@mail.gmail.com> <70A18355-789E-4FF2-8789-1AFB00CD9B8F@castlepoint.net>
Date: Fri, 04 Nov 2011 23:22:54 -0400
X-Google-Sender-Auth: lCVly6NQ26_zOKXLuH8qNsuCl4I
Message-ID: <CAL9jLaZ2aaR9SFSmOsjHiFVpkHTuCANdPpTcF8yu8zZtA=Vwwg@mail.gmail.com>
From: Christopher Morrow <morrowc.lists@gmail.com>
To: Shane Amante <shane@castlepoint.net>
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: quoted-printable
Cc: sidr wg list <sidr@ietf.org>
Subject: Re: [sidr] BGPSEC Threat Model ID
X-BeenThere: sidr@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Secure Interdomain Routing <sidr.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sidr>, <mailto:sidr-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/sidr>
List-Post: <mailto:sidr@ietf.org>
List-Help: <mailto:sidr-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sidr>, <mailto:sidr-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 05 Nov 2011 03:22:56 -0000

On Fri, Nov 4, 2011 at 11:12 PM, Shane Amante <shane@castlepoint.net> wrote:
>>
>> agreed, some manner of prefix + as-path seems like it'd sure solve
>> this problem. :(
>
> Please note that, for the specific case above, I did not mention "complicated" & "burdensome" prefix-list filtering … just AS_PATH sanity check filtering, i.e.: if you see AS (FOO|BAR|BAZ) in the path, drop (don't learn) the route.  Also, I would note that this type of configuration re-emphasizes what Russ White has said, specifically that (this) policy is local to each AS and is _not_ 'shared' with any other ASN.

understood, don't disagree... and yes, Russ's point about the local
policy not being exposed publicly means ... we can't today figure this
out easily.



-chris

v2.23.0 | Report a Bug | By Email