Re: [Sidrops] Alvaro Retana's No Objection on draft-ietf-sidrops-rpkimaxlen-12: (with COMMENT)

[Alvaro Retana <[e-mail]>]

On August 10, 2022 at 9:37:13 AM, Sriram, Kotikalapudi wrote:


Sriram:

Hi!


> You suggested:
> > In particular, operators with short prefixes and many advertisements of
> > both IPv4 and IPv6 may have a harder time keeping up with changes. I would
> > love to see some text around the challenges that applying the
> > recommendations at scale may bring, which may also "result in a self-
> > inflicted denial of service" (to use the description in §7).
>
> The text that is already in the draft and addresses the challenges (exception
> cases where the maxlength recommendation need not be heeded) is as follows:
>
> In general, except in some special cases, operators SHOULD avoid
> using the maxLength attribute in their ROAs, since its inclusion will
> usually make the ROA non-minimal.
>
> One such exception may be when all more specific prefixes permitted
> by the maxLength are actually announced by the AS in the ROA.
> Another exception is where: (a) the maxLength is substantially larger
> compared to the specified prefix length in the ROA, and (b) a large
> number of more specific prefixes in that range are announced by the
> AS in the ROA.
>
> This recognizes both IPv4 and IPv6 cases when the operator may decide to use
> maxLength rather than enumerate a large number of sub-prefixes in the ROA.
> Let us know if you feel the above text is not adequate.

Yes, that text is helpful.  I like Ben's proposal too as it directly
addresses the complexity.



> Ben and Alvaro:
>
> Elsewhere in the doc, I feel that saying "Failure to do so could, in the
> worst case, result in a self-inflicted denial of service." is not helpful or
> necessary. It can be deleted. The operator can make many different kinds of
> mistakes (e.g., a single typo) with ROAs that can cause self-inflicted denial
> of service.

True, other mistakes are possible, but I think it's good to explicitly
point at the ones that may happen because of the procedures
recommended in the document.  IOW, it's always good to point at the
possible risk.

Thanks!

Alvaro.