Re: [Sidrops] draft-ietf-sidrops-aspa-verification-01: Handling unknowns

["Jakob Heitz (jheitz)" <[e-mail]>]

If you receive an AS-PATH of 2 ASes and neither of them make any attestation,
then your procedure calls it valid. It could be invalid,
so it must be considered unknown.

If an AS-PATH contains an AS-SET, then the segments on either side of
the AS-SET can still be verified. If any such segment turns out to be
invalid, then the whole path must be considered invalid, not unverifiable.

My procedure accounts for these cases and more.
For the cases where every AS makes an attestation, my procedure agrees with yours.

BTW, you have a copy/paste error in 5.2 Downstream paths:
If a route from ROUTE_AFI address family is received from a customer
should be:

If a route from ROUTE_AFI address family is received from a provider

s/ ot / or /


Regards,
Jakob.

From: Alexander Azimov <[e-mail]>
Sent: Thursday, July 25, 2019 1:20 PM
To: Jakob Heitz (jheitz) <[e-mail]>
Cc: [e-mail]
Subject: Re: [Sidrops] draft-ietf-sidrops-aspa-verification-01: Handling unknowns

Jakob,

I believe your reading of the ASPA verification procedure is incorrect.

Section 4 defines pairs wise verification procedure (let's call pair_verification) which returns valid, invalid and unknown.
Sections 5.1 and 5.2 define verification procedure for upstream and downstream path respectively.

In these procedures, the 'valid' and 'unknown' outcome of pair_verification is the same. These procedures return 'valid', 'invalid' and 'unverifiable' (in case of valid AS_SEQ + presence of AS_SET). So, your assumption that the algorithm works when all ASes in the as-path make attestations is incorrect.

To perform verification you don't need to split ASPATH into triplets (or even bigger windows). I sent previously a linear function that makes verification for the downstream path, for the upstream path it even simpler. Since you are already working on the implementation I suggest to discuss it in person before the end of this meeting. It makes me really anxious if the specification is unclear for implementers.

чт, 25 июл. 2019 г. в 08:04, Jakob Heitz (jheitz) <[e-mail]<mailto:[e-mail]>>:
I believe the path verification algorithm works when all ASes in the as-path
make attestations. If some of the ASes make no attestations, then a more complete
algorithm is as follows:

For every sequence (A, B, C) of consecutive ASes in an AS-path:
If A attests that B is not a provider and C attests that B is not a provider,
then B leaked the route: B is transiting for free. The segment is invalid.
If either A or C attests that B is a provider, then the AS-path segment  (A, B, C) is valid.
If neither A nor C make an attestation, then the leak state is unknown. Even if B lists both A and C as providers, it is not necessarily a leak, because either A or C could consider B as a provider for some of their routes, even though they don't attest to it.

If all the path segments are valid, then the whole path is valid.
If any of the path segments is invalid, then the whole path is invalid.
Else, at least one path segment is unknown and one more rule must be applied: for any sequence of ASes (A, B1, ..., Bn, C), if A attests that B1 is not a provider and C attests that Bn is not a provider, then the AS-path is invalid. This is for any number of Bx greater than 1.

This algorithm breaks the AS-PATH into triples instead of pairs.
For example, the AS_PATH (A,B,C,D,E) is broken into the triples:
(A,B,C), (B,C,D), (C,D,E).
I find it easier to reason about it like that.
It can probably be re-worded into pairs.

An additional point:
If AS-SETs exist then complete sequences between the AS-SETs can be checked for invalidity.
The best such an AS-PATH can get is unknown, but it can also be verified invalid.

Regards,
Jakob.

-----Original Message-----
From: Sidrops <[e-mail]<mailto:[e-mail]>> On Behalf Of [e-mail]<mailto:[e-mail]>
Sent: Monday, July 8, 2019 1:24 PM
To: [e-mail]<mailto:[e-mail]>
Cc: [e-mail]<mailto:[e-mail]>
Subject: [Sidrops] I-D Action: draft-ietf-sidrops-aspa-verification-01.txt


A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the SIDR Operations WG of the IETF.

        Title           : Verification of AS_PATH Using the Resource Certificate Public Key Infrastructure and Autonomous System Provider Authorization
        Authors         : Alexander Azimov
                          Eugene Bogomazov
                          Keyur Patel
                          Job Snijders
        Filename        : draft-ietf-sidrops-aspa-verification-01.txt
        Pages           : 10
        Date            : 2019-07-08

Abstract:
   This document defines the semantics of an Autonomous System Provider
   Authorization object in the Resource Public Key Infrastructure to
   verify the AS_PATH attribute of routes advertised in the Border
   Gateway Protocol.



The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-sidrops-aspa-verification/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-sidrops-aspa-verification-01
https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-aspa-verification-01

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-sidrops-aspa-verification-01


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org<http://tools.ietf.org>.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
Sidrops mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/sidrops

_______________________________________________
Sidrops mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/sidrops


--
Best regards,
Alexander Azimov