IETF Logo Mail Archive

[Sidrops] ASPA false leak

"Jakob Heitz (jheitz)" <jheitz@cisco.com> Tue, 15 October 2019 23:45 UTC

Return-Path: <jheitz@cisco.com>
X-Original-To: sidrops@ietfa.amsl.com
Delivered-To: sidrops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 005491207FC for <sidrops@ietfa.amsl.com>; Tue, 15 Oct 2019 16:45:10 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.5
X-Spam-Level:
X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=PwPmv/TJ; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=Oh5pF996
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id quWWNxeAhLr5 for <sidrops@ietfa.amsl.com>; Tue, 15 Oct 2019 16:45:08 -0700 (PDT)
Received: from alln-iport-7.cisco.com (alln-iport-7.cisco.com [173.37.142.94]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F2292120019 for <sidrops@ietf.org>; Tue, 15 Oct 2019 16:45:07 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=8910; q=dns/txt; s=iport; t=1571183108; x=1572392708; h=from:to:subject:date:message-id:mime-version; bh=KbLapL439WGLCcb99qp8ekdKwRZmNSV6+2x8AL9rm4E=; b=PwPmv/TJFXHr4cEwRTTKtEHGdR2e0Pv5mcgtBK5+mMKI67PkBq6iy+K/ gw+W9zXZoOzS1gY6dFgLzw2u7QRwlqb7ZV8YWXNhP3rrrsbfshANv9COF 2WYL2Ij8r5qh30TSJhmJGyH6UecGzNtDscpQUkxLcTMUHvexly3iUr1VH w=;
IronPort-PHdr: 9a23:QVOWcxIP5tGp7FaljdmcpTVXNCE6p7X5OBIU4ZM7irVIN76u5InmIFeCtKd2lFGcW4Ld5roEkOfQv636EU04qZea+DFnEtRXUgMdz8AfngguGsmAXE/7If/2fQQxHd9JUxlu+HToeUU=
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0C7DADEWaZd/5BdJa1mHQEBAQkBEQUFAYF7gRwvUAVsVyAECyqHbAOKT02VLIRhglIDVAkBAQEMAQEtAgEBhEACgm4kOBMCAwkBAQQBAQECAQUEbYUtDIVkGxMBATgRAYEAJgEEGxqDAYF5TQMuAQKjeQKBOIhhgieCfQEBBYUBGIIXCYE0jA4YgUA/gRFGh1CDPoIsjGdKh3mCOYZ2jnYKgiKVNplCp2wCBAIEBQIOAQEFgWkigVhwFYMnUBAUgU+Dc4pTdIEpkCgBAQ
X-IronPort-AV: E=Sophos;i="5.67,301,1566864000"; d="scan'208,217";a="343924693"
Received: from rcdn-core-8.cisco.com ([173.37.93.144]) by alln-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 15 Oct 2019 23:45:04 +0000
Received: from XCH-RCD-012.cisco.com (xch-rcd-012.cisco.com [173.37.102.22]) by rcdn-core-8.cisco.com (8.15.2/8.15.2) with ESMTPS id x9FNj3ps007535 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL) for <sidrops@ietf.org>; Tue, 15 Oct 2019 23:45:03 GMT
Received: from xhs-rcd-001.cisco.com (173.37.227.246) by XCH-RCD-012.cisco.com (173.37.102.22) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 15 Oct 2019 18:45:02 -0500
Received: from xhs-aln-001.cisco.com (173.37.135.118) by xhs-rcd-001.cisco.com (173.37.227.246) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 15 Oct 2019 18:45:02 -0500
Received: from NAM02-CY1-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-001.cisco.com (173.37.135.118) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Tue, 15 Oct 2019 18:45:01 -0500
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=WyF3vc+kSofXgRPWVtVlXK3Wh+FjI9n7Ck5GUSR7k3JR6vDnoG6Dhhqdu10iu+zq4qWzFEALL3ym5jiBYp3tg6YFdRlbaVYvO8FQ6/dls+P8zgHYP/eY/Fx+SFb1oKAJyTCeASDIs9747X8kcGt3sCANTr2mzpt66KYPIllUijYeIZxBuDcfqPrRxm8x5PGY6RAaRMqamcJWKM4WCbnrTejqDOT2zjnuNneg/ZbwznukQcz3N8kQtwyFDQ5pV79Yj2/tmY/0ihbM88iLXAzb9V7L+ypoH6zLnNjkee+tisDjREUpxPo2iOJqt4hJcYfgwAkJHnAMyoy8KwKtAzd1cg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=JkvcTA9Bxw3FXVYao01nmjaMSPAObUwab7JesROWvlw=; b=k+ILYZFIKkx1LMVNH5stNo2/5W42R9SD2x9DoHjJm/KcJhuLt8N4WJ/dj1GOLbPlgunGnaEDod1gFdPIZl+c0jssAZnePkyL7E+GUS7SWDkU98SHXtz0yZsD7upBT2Y3nyB79acRYMBDzptMEtZB3yRSp1Ruf3sLd3Dx8Trxyc38jORonpUkHausZUYavJtBfqhmhaVBQqPLSzadN+190QbCQA7nC+hqCSQTjzePjC5Cm+Vuv5iWQ8tkiutaSRf5p9B9ie0Y9y+TOuYCK2v2CMUlhw5++02qr0pxes4K7JaTsDZxFDH0cBwb7tzZd4Dm+G/mvMJ1qJbEcArac6PdBg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=JkvcTA9Bxw3FXVYao01nmjaMSPAObUwab7JesROWvlw=; b=Oh5pF996ty/uSiuAE4VqGLPssnm0x2/oLiTN/aHPcNmQJeVyDLD0sEtyWYIzKDQIGr0QGQWxgVQ4MPUV+IdNsBOQssSjFIcKFRvpHQO7hEihOFiUTGlaf7s0oEVuMv8ds0mr56/LYRI+D+18creOLxEcGHoKoaRGTI5KVinWZZY=
Received: from BN8PR11MB3746.namprd11.prod.outlook.com (20.178.221.23) by BN8PR11MB3635.namprd11.prod.outlook.com (20.178.219.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2347.19; Tue, 15 Oct 2019 23:45:01 +0000
Received: from BN8PR11MB3746.namprd11.prod.outlook.com ([fe80::c1ad:20a:be24:fe90]) by BN8PR11MB3746.namprd11.prod.outlook.com ([fe80::c1ad:20a:be24:fe90%5]) with mapi id 15.20.2347.023; Tue, 15 Oct 2019 23:45:01 +0000
From: "Jakob Heitz (jheitz)" <jheitz@cisco.com>
To: SIDR Operations WG <sidrops@ietf.org>
Thread-Topic: ASPA false leak
Thread-Index: AdWDr4IJUqd9dgFSRaS/zGHcilvp8Q==
Date: Tue, 15 Oct 2019 23:45:00 +0000
Message-ID: <BN8PR11MB37463090DCE5AF62C9D8B9E5C0930@BN8PR11MB3746.namprd11.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=jheitz@cisco.com;
x-originating-ip: [2001:420:30d:1254:68ee:ac2e:9d42:aa6f]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: f306ff44-4bb8-4e36-a6a2-08d751c9b1d9
x-ms-traffictypediagnostic: BN8PR11MB3635:
x-microsoft-antispam-prvs: <BN8PR11MB36357DED278E60FC99EB0597C0930@BN8PR11MB3635.namprd11.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:8882;
x-forefront-prvs: 01917B1794
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(396003)(39860400002)(366004)(346002)(136003)(376002)(199004)(189003)(6306002)(486006)(55016002)(476003)(478600001)(9686003)(54896002)(3480700005)(25786009)(4744005)(6436002)(5660300002)(7116003)(316002)(6506007)(86362001)(2906002)(46003)(6116002)(790700001)(7696005)(6916009)(81156014)(14454004)(66946007)(76116006)(66476007)(64756008)(8676002)(33656002)(8936002)(81166006)(14444005)(256004)(66446008)(66556008)(7736002)(99286004)(186003)(52536014)(74316002)(71200400001)(71190400001)(102836004); DIR:OUT; SFP:1101; SCL:1; SRVR:BN8PR11MB3635; H:BN8PR11MB3746.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1;
received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: YIBX5K0qbeFVC5CQP37o9q2boOd5KHp8fLw8bXVJpuonGbTpi1tVO0UHllC6IJxYzS/o8lfeaQZrsOFRmP3ZLWD2FerWQbiRCrNCThiJc7NcziYeWg5CJASW+dfSFmECWG2fxJfYEoBu78u1qClwillLsnuV1MApe+ab1IwH3hRfoAhnN1T8ilIPl0d1pbdJ1kw/WoBezEdlxQl+ikE8CE+g+46u24PLbNJY1bJhrPckgzYq708yGU8pev9Pw/fOmtF9e3i9YP0pjS0mcfwXmwm8H+DT8B6bZ9ngxtSfCqvNiIrRPH5v7GtUGmjvr8gQtz/G5kUDgJMJWkDZW26JmV7oqm/DJmeWF0s2+2zjHrnEfcAGT3TaNAjCbnYsdMtjDTApezvDEJXENI6OHs+HIKgdKA+IpPsvO9FohUcJnRw=
x-ms-exchange-transport-forked: True
Content-Type: multipart/alternative; boundary="_000_BN8PR11MB37463090DCE5AF62C9D8B9E5C0930BN8PR11MB3746namp_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: f306ff44-4bb8-4e36-a6a2-08d751c9b1d9
X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Oct 2019 23:45:00.9152 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: H9Nvz3LM+EvPSC57ZZ+P5x+TaFlNF7QevsWK8QgigKrlNPNlQNXdfz8HJwvq9Is4H30SN6nOov+xG1ToBnKiRw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8PR11MB3635
X-OriginatorOrg: cisco.com
X-Outbound-SMTP-Client: 173.37.102.22, xch-rcd-012.cisco.com
X-Outbound-Node: rcdn-core-8.cisco.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/sidrops/EemFJzUvQuZhXxaQIO-lC0FcHps>
Subject: [Sidrops] ASPA false leak
X-BeenThere: sidrops@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: A list for the SIDR Operations WG <sidrops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sidrops>, <mailto:sidrops-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/sidrops/>
List-Post: <mailto:sidrops@ietf.org>
List-Help: <mailto:sidrops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sidrops>, <mailto:sidrops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Oct 2019 23:45:10 -0000

Consider the topology:

   AS5      AS3
     \     /   \
      \   /     \
       AS4     AS2
         \     /
          \   /
           AS1

AS1 has providers AS2 and AS4.
AS2 has provider  AS3.
AS4 has providers AS3 and AS5.

AS5 receives a route with AS-path (4 3 2 1).
ASPA would declare that AS4 leaked the route from AS3 to AS5.
However, AS4 is an authorized provider for AS1.
Even though AS4 has a path to AS1, it chose to use an alternative
valid path to reach AS1. This might be to relieve congestion or to
avoid an outage. Regardless of the reason, I don't think this
route should be rejected.

I think we need an additional rule:
If an AS is found to be leaking a route, but an alternative valid
path can be found from that AS to the originator AS, then the AS
is not leaking. A path (X(1), ..., X(n)) is a valid alternative
if for each X(i), X(i+1) attests that X(i) is its provider.

Thoughts?

Regards,
Jakob.

v2.23.0 | Report a Bug | By Email