Re: [Sidrops] draft-ietf-sidrops-aspa-verification-01: Handling unknowns

[Alexander Azimov <[e-mail]>]

I'm sorry for the last email. It was supposed to be bigger.

пт, 26 июл. 2019 г. в 08:38, Jakob Heitz (jheitz) <[e-mail]>:

> If you receive an AS-PATH of 2 ASes and neither of them make any
> attestation,
>
> then your procedure calls it valid. It could be invalid,
>
> so it must be considered unknown.
>
It an interesting point. When I was writing the ASPATH verification
procedure I had in mind that we need to detect invalids. But for debugging
purposes, it might be also useful to distinguish fully verified paths where
all pairs are valid and those paths that represent a combination of valid
and unknown pairs. It will also require clarification that for backward
compatibility such unknown paths MUST be treated as valid. We should add
this option into consideration.

If an AS-PATH contains an AS-SET, then the segments on either side of
>
> the AS-SET can still be verified. If any such segment turns out to be
>
> invalid, then the whole path must be considered invalid, not unverifiable.
>
I do agree and that's how both downstream path upstream path procedures are
defined in the draft.
As we discussed in person, we might need additional clarification in the
beginning where {AS(I), AS(I-1)...} sequence is defined.


> My procedure accounts for these cases and more.
>
> For the cases where every AS makes an attestation, my procedure agrees
> with yours.
>
If you have ASPA(1, 2) you can't make assumptions about relations of 2.
Otherwise, it may lead to incorrect results in the case of siblings.

BTW, you have a copy/paste error in 5.2 Downstream paths:
>
> If a route from ROUTE_AFI address family is received from a customer
>
> should be:
>
> If a route from ROUTE_AFI address family is received from a provider
>
> Yes, you are right. Copy-paste can become tricky. Will be fixed in the
next version.