Re: [Sidrops] New Version Notification for draft-sriram-sidrops-drop-invalid-policy-00.txt

["Sriram, Kotikalapudi (Fed)" <[e-mail]>]

Tim:

>For BOAs / AS0 ROAs to work here the semantics would have to be changed to something like: if *any* of the address space in a prefix is covered by a BOA / AS0 ROA *only* then consider it *invalid* - or *forbidden* even if we want to recognise this as a different flavour of invalid.

I agree with the spirit of your suggestion. But I feel we need to be 
careful about the meaning of "Covered by ROA."

I can think of a scenario:
ROA 1: 10.1.0.0/16   AS 0    
ROA 2: 10.1.0.0/18   ML=20   AS 64511
ROA 3: 10.1.0.0/22  AS 0
Update: 10.1.0.0/24   with some origin AS (other than AS 0)

Update for the /24 is Invalid due to any of the three ROAs.
I am pretty sure you want this Update dropped. Right?
The definition of "Covered by ROA" matters.
Especially, as I am thinking about your emphasis on *only*.
"Covered by ROA" is not defined in RFC 6811.
Instead "Covered by VRP" is defined (page 5):

   o  Covered: A Route Prefix is said to be Covered by a VRP when the
      VRP prefix length is less than or equal to the Route prefix
      length, and the VRP prefix address and the Route prefix address
      are identical for all bits specified by the VRP prefix length.
      (That is, the Route prefix is either identical to the VRP prefix
      or more specific than the VRP prefix.)

So I would suggest:

... for the Invalid route in consideration, consider the list of ROAs 
which make the route Invalid. From this list, consider 
the subset of ROAs (this may be one ROA or more)  with the *most specific prefix*.
If any of the ROAs in this subset contains an AS number that is not AS 0,
then proceed to the next step in the algorithm;
else, the Invalid route MUST be dropped.

Does this work for you? (We can discuss this further in London.)

Thank you.

Sriram