Re: [Sidrops] ASPA verification algorithm error

[Ben Maddison <[e-mail]>]

Hi Jakob,

On 02/12, Jakob Heitz (jheitz) wrote:
> It seems we all agree that the path I illustrated is valid and the algorithm in the draft marks it unknown.
> The first priority is to get the correct result.

That's not quite what I said!
I think the logic you used to arrive at the conclusion is sound. I agree
that the path you illustrated should be accepted by the receiver.
However, I also gave several reasons why a validation state of Unknown
is appropriate here.
> 
> ASPA has to work as well as possible without full participation.
> It will never work if full participation is required.
> 
I'm not clear on why you believe the issue at hand impacts the
effectiveness of ASPA under partial deployment?

> I agree with Ben that it is difficult to reason with the model of ASPA as written in the draft.
> Here is an alternative:
> 
>     Every transit AS in the path must have at least one neighbor that calls it a provider.
> 
> That's a lot easier to reason about than trying to figure out where upstream turns to downstream
> in the presence of bilateral peers, siblings, complex relationships and ASes making no attestations.
> You only need to consider one AS at a time and what is to its left and to its right.
> 
> Repeating:
> 
> Consider the as-path (1 2 3 4), where
> 1 attests that 2 is its provider
> 4 attests that 3 is its provider
> 2 and 3 make no attestations.
> Then the path is valid.
> 
> Here is a simple and working algorithm:
> 
> 
>   *   The received AS-path is prepared:
>      *   Remove duplicate ASNs.
>      *   Prepend own ASN.
>      *   May also prepend Forwarded-to ASN to detect own leak. (optional)
>   *   For every sequence (A, B, C) of consecutive ASes in an AS-path:
>      *   If A attests that B is not a provider and C attests that B is not a provider,
> then B leaked the route: B is transiting for free. The segment is invalid.
>      *   If either A or C attests that B is a provider, then the AS-path segment  (A, B, C) is valid.
>      *   Else if either A or C make no attestation, then the leak state is unknown. Even if B lists both A and C as providers, it is not necessarily a leak, because either A or C could consider B as a provider for some of their routes, even though they don’t attest to it.
>   *   If all the path segments are valid, then the whole path is valid.
>   *   If any of the path segments is invalid, then the whole path is invalid.

The above looks sound to me on first sight.
I am going to poke it a little before I fully endorse it though...

>   *   Else, at least one path segment is unknown and one more rule must be applied: for any sequence of ASes (A, B1, ..., Bn, C), if A attests that B1 is not a provider and C attests that Bn is not a provider, then the AS-path is invalid. This is for any number of Bx greater than 1.
> 
The above final step is less clear to me. Could you explain your
reasoning in some more detail please?

Cheers,

Ben