[Sidrops] Clarification of draft-ietf-sidrops-aspa-verification-03

[Luuk Hendriks <[e-mail]>]

Hi all,

Reading through draft-ietf-sidrops-aspa-verification-03 left me with
some questions. I have not followed the entire evolution of this
document, so apologies if I nag about things that have been discussed
before.  Especially with regards to the actual validation steps, I (or
rather we, there has been a lot of discussion in our office) think we
might be missing or misinterpreting some parts, and I'd like to get on
the same page before diving into details.

With regards to the upstream/downstream and allowing one Invalid to
occur in the 'chain' so to say, we picture it as follows:


                             +-----+
                    +--------> AS2 +--------+
                    |        +-----+        |
                 +-----+                 +--v--+
        +------->+ AS1 |                 | AS3 +--------+
        |        +-----+                 +--^--+        |
     +-----+                                         +--v--+
     | AS0 |                                         | AS4 |
     +-----+                                         +-----+
                                                        |
                                                     +--v--+
                                                     | AS5 |
                                                     +-----+


Say, we are AS5, receiving an announcement with AS_PATH 4 3 2 1 0 , thus
AS0 being the originating AS. The upstream part is AS0 -> AS1 -> AS2,
the downstream part is AS2 -> AS3 -> AS4 . (Correct?)

Then looking at the diagrams in the draft, there is an I++ when this
allowed Invalid is observed. Does that mean that the relation between
the ASes just after the upstream/downstream point (thus, whether AS2 is
a provider of AS3) is not checked? If so, is that on purpose, and how
does it not break the validation chain?


Hopefully someone can clarify whether we are on the right track of
understanding these concepts.


Thanks,
 luuk