[Sidrops] Re: ASPA validation of paths received from customers and providers

[Job Snijders <[e-mail]>]

On Fri, May 30, 2025 at 12:44:27PM +0200, Maria Matejka wrote:
> > Thanks to merely two 'role' keywords, I'll never leak routes from my
> > provider A2B to the Frys-IX Route Servers, or vice-versa, AND have
> > RFC9234 protections going via OTC attribute!
> 
> In our case in BIRD, you need `local role customer` and `local role
> rs_client` which is, admittedly, about six bytes longer, for the same
> thing.

My apologies, it was not my intention to focus on a few bytes here and
there. I wanted to highlight the concept of making it impossible for
operators to configure contradicting roles or forget to configure one
type of role but not the other type.

> > This is extremely powerful anti-route-leak stuff, in the old world this
> > would've required many more lines of configuration. :-)
> 
> I expect for ASPA you need also at least
> 
>     deny quick from ebgp avs invalid

Correct.

> which is, admittedly, about twenty bytes shorter than our config
> 
>     if aspa_check_upstream(at) = ASPA_INVALID then reject;

Yes.

> Automatic inference of the algorithm variant in BIRD will be
> implemented probably after the draft is finalized and RFC'd.

Nice! That is great news.

Kind regards,

Job