[Sidrops] first route leak prevented by ASPA

[Claudio Jeker <[e-mail]>]

Hi all,

Since a few days OpenBGPD is able to do ASPA verification and filtering
based on the outcome. Right now my system detected one ASPA invalid path
that is an actuall route leak. So it seems ASPA is working :)

    --- begin terminal transcript ---
    $ bgpctl show rib in avs invalid as 945
    flags: * = Valid, > = Selected, I = via IBGP, A = Announced,
           S = Stale, E = Error
    origin validation state: N = not-found, V = valid, ! = invalid
    aspa validation state: ? = unknown, V = valid, ! = invalid
    origin: i = IGP, e = EGP, ? = Incomplete
    
    flags  vs destination          gateway         lpref   med aspath origin
          V-! 2606:b0c0:b00b::/48  2001:4bf8::253    100     0 8271 6939 61138 945 i
    --- end terminal transcript ---
    
This is because of the following ASPA record [1]:
    customer-as 945 provider-as { 1299, 6939, 32097, 50058 }

combined with a Locally Added Assertion for my upstream AS:
    customer-as 8271 provider-as { 13030, 174 }

AS 8271 has a lateral peering with AS 6939, so upstream path validation
happens and as AS 945 didn't include 61138 as provider, the path is
invalid.

With such minimal ASPA records my system already sees around 170,000 ASPA
valid prefixes!

All of this (including a ASPA-capable validator) is available in the
lastest OpenBSD-current snapshot!

I'll share an implementation report later on.

Regards
-- 
:wq Claudio

[1]: https://console.rpki-client.org/rpki.august.tw/repo/AS945/0/AS945.asa.html