Re: [Sidrops] draft-ietf-sidrops-aspa-verification-01: Handling unknowns

"Jakob Heitz (jheitz)" <jheitz@cisco.com> Sat, 27 July 2019 01:35 UTC

Return-Path: <jheitz@cisco.com>
X-Original-To: sidrops@ietfa.amsl.com
Delivered-To: sidrops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF1411201E8 for <sidrops@ietfa.amsl.com>; Fri, 26 Jul 2019 18:35:36 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.5
X-Spam-Level:
X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=RbBNz3bP; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=uBP4PO4R
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Zk2qtjf_y__k for <sidrops@ietfa.amsl.com>; Fri, 26 Jul 2019 18:35:34 -0700 (PDT)
Received: from alln-iport-3.cisco.com (alln-iport-3.cisco.com [173.37.142.90]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5186A1201CE for <sidrops@ietf.org>; Fri, 26 Jul 2019 18:35:34 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=13459; q=dns/txt; s=iport; t=1564191334; x=1565400934; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=qYeArgxcvgXFIyCGx+R3quQF/H64TkCtiAk1KLsEjrU=; b=RbBNz3bPgnKJMPMpEbu641ZMC7KD/FI8TkAFatOjOHKpud9wPRm39Rc0 FzRWeMIzlMgZ5A8adnjjL7jskDwKK2dLj+NNHjENgN+C/deaI3fAsH6og aNqF5OxHqgVoviaLGTz2NMu1WWAkiBDSF0hGL0jnGiX2otM7MNxco4Neu I=;
IronPort-PHdr: =?us-ascii?q?9a23=3AthXqaxZBjEZqXI8OdI4ReCT/LSx94ef9IxIV55?= =?us-ascii?q?w7irlHbqWk+dH4MVfC4el20Q6bRp3VvvRDjeee87vtX2AN+96giDgDa9QNMn?= =?us-ascii?q?1NksAKh0olCc+BB1f8KavobyE7ANZqX15+9Hb9Ok9QS47z?=
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CrAADfqTtd/5FdJa1mGgEBAQEBAgE?= =?us-ascii?q?BAQEHAgEBAQGBZ4EVLyQsA4FCIAQLKoQeg0cDjH+ML4kohFeBQoEQA1QJAQE?= =?us-ascii?q?BDAEBLQIBAYRAAheCSyM4EwEDAQEEAQECAQZthR4MhUsCBBIRHQEBMAcBDwI?= =?us-ascii?q?BBgIOMQMCAgIfERQRAQEEDgUigwCBHk0DHQECj2iQYAKBOIhgcYEygnoBAQW?= =?us-ascii?q?CR4JBDQuCEwmBNItfF4FAP4ERJx+CTD6CGoF3ARIBgyoygiaOfoR/iG6NTkA?= =?us-ascii?q?JAoIakBmDdxuSMIVdij2MPYpHg08CBAIEBQIOAQEFgWchZ3FwFTsqAYJBUBA?= =?us-ascii?q?UgU6DcYpTcgGBKIpEgkMBAQ?=
X-IronPort-AV: E=Sophos;i="5.64,313,1559520000"; d="scan'208,217";a="309042533"
Received: from rcdn-core-9.cisco.com ([173.37.93.145]) by alln-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 27 Jul 2019 01:35:33 +0000
Received: from XCH-ALN-012.cisco.com (xch-aln-012.cisco.com [173.36.7.22]) by rcdn-core-9.cisco.com (8.15.2/8.15.2) with ESMTPS id x6R1ZXQI027719 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Sat, 27 Jul 2019 01:35:33 GMT
Received: from xhs-rtp-003.cisco.com (64.101.210.230) by XCH-ALN-012.cisco.com (173.36.7.22) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 26 Jul 2019 20:35:32 -0500
Received: from xhs-rtp-002.cisco.com (64.101.210.229) by xhs-rtp-003.cisco.com (64.101.210.230) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 26 Jul 2019 21:35:31 -0400
Received: from NAM05-CO1-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-002.cisco.com (64.101.210.229) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Fri, 26 Jul 2019 21:35:31 -0400
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=JMs3D0V80aEc/uGci4o5Cdgyky7LSjbKAGcfiLj7Gud5Ur00ChnsmyyUxu6iJduoYAIPEPNOsljAPWM3mDhEkRBIBX98iY1esiQw3cyttLem9qZfEzSrcVXmJtJtBsy2CIM6qdmaTzyL8T4ROurLeLQujTGLeuKdRIz/wOvuEsLK2KkIfCJGkQFSq2s4BzHw+XlCL2aQK2EAp3G9xHpuLdQ59T3Xnl+k2efV3bZpIoHeShn9gNk1omBSNzEm6PBuNn0KqyPk4t11FR0e4lG7qECVmIjNXR7jxWZK5wmrWUdbv3ZaWbLXLPtd8C9hUb4PDiYHi4D1CUVbLpHDNf5Wdw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qYeArgxcvgXFIyCGx+R3quQF/H64TkCtiAk1KLsEjrU=; b=miyaHEmlIETxmfndWBUOiDh0ImV4zHu/8JQ/ii0Uj4oG9EE0oMSgm+CZpNpFIjdGouPAOBtfgbA6ohUdK9GkFqR1U+JMs+lLFwBVzyj903zAhoi6yN0/oCMk2V6S3Qx4udBRDrhpd6r1wpF37ZsqZZDiL+x4mng9SDA2brLb42090R5JKzTemPT08gu2BLgU5MfKOMnRliLhj5AmonwwfBa8ISVNuYUjnreTOsBGAovoUaR8geHDWA4dmY8yJe1MOxBLFYOhD25F78+YcEjMgKL10wDka4KEDnC+IUt9j3XphdS7eAz9uRsHJEUlIlC9ea9dOqEKBqy5sjg6uDXphQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=cisco.com;dmarc=pass action=none header.from=cisco.com;dkim=pass header.d=cisco.com;arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qYeArgxcvgXFIyCGx+R3quQF/H64TkCtiAk1KLsEjrU=; b=uBP4PO4RZsYJ7Ai9kWEqr33xBtflYCZIb5d1yBErRTHrKkZkP0R4+UsJDWqaIg7b6XAebvvN1C9o0JFtaLy7JGtsbhnF1lKfmwNbbsh88uS/3L+VRR+sCQyOQ2YL/v7Tt6HkJp8oxjv+OIo8c6HwbNafTR6na41eZmY/aVWeu10=
Received: from BYAPR11MB3751.namprd11.prod.outlook.com (20.178.238.144) by BYAPR11MB3269.namprd11.prod.outlook.com (20.177.185.10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.10; Sat, 27 Jul 2019 01:35:29 +0000
Received: from BYAPR11MB3751.namprd11.prod.outlook.com ([fe80::a894:a92:ad6e:ee2a]) by BYAPR11MB3751.namprd11.prod.outlook.com ([fe80::a894:a92:ad6e:ee2a%7]) with mapi id 15.20.2115.005; Sat, 27 Jul 2019 01:35:29 +0000
From: "Jakob Heitz (jheitz)" <jheitz@cisco.com>
To: Alexander Azimov <a.e.azimov@gmail.com>
CC: "sidrops@ietf.org" <sidrops@ietf.org>
Thread-Topic: [Sidrops] draft-ietf-sidrops-aspa-verification-01: Handling unknowns
Thread-Index: AdVCo7iaisAZRDdHT/a/3q2UygwIOwAgqjYAABL4rDAAFn4rgAAT1XNE
Date: Sat, 27 Jul 2019 01:35:29 +0000
Message-ID: <D85DA5AE-703D-4DC8-A656-D0D2C6A3B776@cisco.com>
References: <BYAPR11MB37517CDEF18A211F9D9B6324C0C10@BYAPR11MB3751.namprd11.prod.outlook.com> <CAEGSd=BJ+zbpaOTjb0mQm+TktVZO+yU_xhnjM1ZMcVFLQo20xA@mail.gmail.com> <BYAPR11MB3751F9334FDC8E598D004388C0C00@BYAPR11MB3751.namprd11.prod.outlook.com>, <CAEGSd=BYK-mN9hWQ6Fn3KK8ACqnUy=ePLeE1EboYufHod2H8EQ@mail.gmail.com>
In-Reply-To: <CAEGSd=BYK-mN9hWQ6Fn3KK8ACqnUy=ePLeE1EboYufHod2H8EQ@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=jheitz@cisco.com;
x-originating-ip: [2600:387:b:5::a1]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 3fef9b16-17bb-4baa-90b0-08d71232b547
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:BYAPR11MB3269;
x-ms-traffictypediagnostic: BYAPR11MB3269:
x-microsoft-antispam-prvs: <BYAPR11MB326964CA59B42C1FCA4181C0C0C30@BYAPR11MB3269.namprd11.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:10000;
x-forefront-prvs: 01110342A5
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(396003)(376002)(346002)(366004)(39860400002)(136003)(189003)(199004)(446003)(6436002)(102836004)(76176011)(99286004)(6506007)(53546011)(478600001)(71190400001)(5660300002)(25786009)(14454004)(6916009)(4326008)(486006)(476003)(15650500001)(11346002)(46003)(71200400001)(66946007)(68736007)(316002)(66446008)(66556008)(186003)(8936002)(81156014)(8676002)(81166006)(2906002)(76116006)(6116002)(66476007)(6512007)(54896002)(2616005)(256004)(36756003)(86362001)(7736002)(33656002)(6246003)(6486002)(229853002)(5070765005)(53936002)(14444005)(236005)(64756008)(91956017); DIR:OUT; SFP:1101; SCL:1; SRVR:BYAPR11MB3269; H:BYAPR11MB3751.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1;
received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: 7YK1E2d02qIvNIAoLVY1PmeJccAaOEhbA6JY9b8MpManN3W4qv0QZSk6qTWjjJDgAuxGMBTb2zgcsQfrXwzk98LLFw9qINn14fUcwaEfdG9N0QvURuoZDR9nuhZ3TkcgyTJy77FSYG57V+Bqepi+544UiYj4l9zXKGlheS3HGjoV8/gxLeSJAQYbBfqV+RmJ5PtbBPwP+q7Tfcyx+7iUY8zqwkghx6BwwTFqsqCvuG8+8S3hsn7YfOGFIAB1JMIxsHJG91Xsp9VB+o3jMri8OfQXeTqDQpXooSXfLv0SGFDaPILlezsSpWhhUW6MhgQIp0cNZRayAZF371clb7NsRn0dw5rKGRPT0b742gpzFVJc9F8VFrAEWccPxS0WlC6CmNCdJ6FpVNlevtgmbQsGWihwYvAqaW/TNKm8R1VyvwU=
Content-Type: multipart/alternative; boundary="_000_D85DA5AE703D4DC8A656D0D2C6A3B776ciscocom_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 3fef9b16-17bb-4baa-90b0-08d71232b547
X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Jul 2019 01:35:29.3386 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: jheitz@cisco.com
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR11MB3269
X-OriginatorOrg: cisco.com
X-Outbound-SMTP-Client: 173.36.7.22, xch-aln-012.cisco.com
X-Outbound-Node: rcdn-core-9.cisco.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/sidrops/av36AvbpMB0yCAl_KAJLEE6ccoc>
Subject: Re: [Sidrops] draft-ietf-sidrops-aspa-verification-01: Handling unknowns
X-BeenThere: sidrops@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: A list for the SIDR Operations WG <sidrops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sidrops>, <mailto:sidrops-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/sidrops/>
List-Post: <mailto:sidrops@ietf.org>
List-Help: <mailto:sidrops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sidrops>, <mailto:sidrops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 27 Jul 2019 01:35:37 -0000

The draft states:

An ASPA attests that a Customer AS holder (CAS) has authorized a particular Provider AS (PAS) to propagate the Customer’s IPv4/IPv6 announcements onward, e.g. to the Provider’s upstream providers or peers.

I suggest to make this more precise and to add the "otherwise" condition:

An ASPA attests that a Customer AS holder (CAS) has authorized a particular Provider AS (PAS) to propagate the Customer’s IPv4/IPv6 announcements to all of the provider's neighbors. If an AS, AS-A publishes at least one ASPA and it lists AS-B as a provider and AS-C is connected to AS-A, but AS-A does not list AS-C in an ASPA, then AS-A authorizes AS-B to propagate the announcements of AS-A to all of AS-B's neighbor ASes and authorizes AS-C to propagate AS-A's announcements only to ASes that consider AS-C to be their provider. I.e., AS-A prohibits AS-C from propagating the announcements of AS-A to AS-D if AS-D does not consider AS-C to be provider for AS-D.

Consequently, a chain of ASPAs can be used to verify the plausibility of an AS-PATH.


Thanks,
Jakob.


On Jul 26, 2019, at 11:08 AM, Alexander Azimov <a.e.azimov@gmail.com<mailto:a.e.azimov@gmail.com>> wrote:

I'm sorry for the last email. It was supposed to be bigger.

пт, 26 июл. 2019 г. в 08:38, Jakob Heitz (jheitz) <jheitz@cisco.com<mailto:jheitz@cisco.com>>:
If you receive an AS-PATH of 2 ASes and neither of them make any attestation,
then your procedure calls it valid. It could be invalid,
so it must be considered unknown.
It an interesting point. When I was writing the ASPATH verification procedure I had in mind that we need to detect invalids. But for debugging purposes, it might be also useful to distinguish fully verified paths where all pairs are valid and those paths that represent a combination of valid and unknown pairs. It will also require clarification that for backward compatibility such unknown paths MUST be treated as valid. We should add this option into consideration.

If an AS-PATH contains an AS-SET, then the segments on either side of
the AS-SET can still be verified. If any such segment turns out to be
invalid, then the whole path must be considered invalid, not unverifiable.
I do agree and that's how both downstream path upstream path procedures are defined in the draft.
As we discussed in person, we might need additional clarification in the beginning where {AS(I), AS(I-1)...} sequence is defined.

My procedure accounts for these cases and more.
For the cases where every AS makes an attestation, my procedure agrees with yours.
If you have ASPA(1, 2) you can't make assumptions about relations of 2. Otherwise, it may lead to incorrect results in the case of siblings.

BTW, you have a copy/paste error in 5.2 Downstream paths:
If a route from ROUTE_AFI address family is received from a customer
should be:

If a route from ROUTE_AFI address family is received from a provider

Yes, you are right. Copy-paste can become tricky. Will be fixed in the next version.