[Sidrops] draft-ietf-sidrops-aspa-verification-01: Handling unknowns

"Jakob Heitz (jheitz)" <jheitz@cisco.com> Thu, 25 July 2019 05:04 UTC

Return-Path: <jheitz@cisco.com>
X-Original-To: sidrops@ietfa.amsl.com
Delivered-To: sidrops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C7A712020A for <sidrops@ietfa.amsl.com>; Wed, 24 Jul 2019 22:04:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.5
X-Spam-Level:
X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=JdnV5ygu; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=cFZA/C8b
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GB8HsQi4JSNH for <sidrops@ietfa.amsl.com>; Wed, 24 Jul 2019 22:04:36 -0700 (PDT)
Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A237B1201EE for <sidrops@ietf.org>; Wed, 24 Jul 2019 22:04:36 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3665; q=dns/txt; s=iport; t=1564031076; x=1565240676; h=from:to:subject:date:message-id: content-transfer-encoding:mime-version; bh=10KAF3OS4pL4FX3h+z2Hoz3G7B8jalTwymHZcjS0Ojg=; b=JdnV5ygusQ75jsCzcFHHw2eSFtMo9OSGiptoxClHgvdu7d42z4aqwF1w 4rXq7woMp5ix/KacArdvgGcqZRhOtOoheCOB7aRI7dTY/VLCb1ee4kVdA aE8SiinVwllhboQQoUsLCqX7xICu1EeOOMNS6fh8rKH62nzopqP5Lodqz 8=;
IronPort-PHdr: =?us-ascii?q?9a23=3AHGHUYBW0dvCGUryGlEeZmtnDBlLV8LGuZFwc94?= =?us-ascii?q?YnhrRSc6+q45XlOgnF6O5wiEPSANSJ8OpK3uzRta2oGXcN55qMqjgjSNRNTF?= =?us-ascii?q?dE7KdehAk8GIiAAEz/IuTtank4HMlDSE1N9HCgOk8TE8H7NBXf?=
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BuAAB3Nzld/4kNJK1lHQEBBQEHBQG?= =?us-ascii?q?BUwgBCwGBQyQsA21VIAQLKodkA4RSiCpMgg+XUIEugSQDVAkBAQEMAQEYDQg?= =?us-ascii?q?CAQGDekYCglkjNAkOAQMBAQQBAQIBBm2FHgELhUoBAQEBBAEQKAYBASwMCwY?= =?us-ascii?q?BGQQBAR83Cx0JAQQTCBqDAYFqAx0BAgyhQwKBOIhggiOCeQEBBYE2Ag5Bgwc?= =?us-ascii?q?YghMJgTQBi18XgUA/gRFGgwqCYQEBAgEBFoFJgzuCJqoCbQkCghmGWY1Sgi1?= =?us-ascii?q?thjiOOIo6gn2HSpAKAgQCBAUCDgEBBYFQOIFYcBUaIYJsCYI5g3GFFIU/coE?= =?us-ascii?q?pjE0BAQ?=
X-IronPort-AV: E=Sophos;i="5.64,305,1559520000"; d="scan'208";a="607080826"
Received: from alln-core-4.cisco.com ([173.36.13.137]) by rcdn-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 25 Jul 2019 05:04:34 +0000
Received: from XCH-ALN-012.cisco.com (xch-aln-012.cisco.com [173.36.7.22]) by alln-core-4.cisco.com (8.15.2/8.15.2) with ESMTPS id x6P54Xuw015986 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL) for <sidrops@ietf.org>; Thu, 25 Jul 2019 05:04:34 GMT
Received: from xhs-aln-002.cisco.com (173.37.135.119) by XCH-ALN-012.cisco.com (173.36.7.22) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 25 Jul 2019 00:04:33 -0500
Received: from xhs-aln-002.cisco.com (173.37.135.119) by xhs-aln-002.cisco.com (173.37.135.119) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 25 Jul 2019 00:04:31 -0500
Received: from NAM04-BN3-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-002.cisco.com (173.37.135.119) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Thu, 25 Jul 2019 00:04:31 -0500
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=MS6nWaRUmJO9GNpTuUtz50W+Xp3xiNSzEyb1M5vRApOQxuxGvPD1A8+bdYbt9vPbGUZWNPOo5xVuXfuW4XHDmhYJQTI+i5v7serS172D/TYAuz8yJo54ESt86pjP1wks1yjFMYapEGNvlpGVu7+Ouvbz4TYvu+LGOZgfOsy7WTAhuMPn/dZM9EMbsNlDaVbcCx9yinMIRE8P5h74QcFE/hkRoo7/iuysrdc6zck165l5gq9J8Pe2m3bdSoLjEFbiFqmTd1p9bpUMjnHH+uWwp80GnGGIemBq75sSsk/5BUu8zleHdp1pgZ/V4re+Ug2nc6KdxfO/yf2WWPjdqSU1Dw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=mxgM7BGpE43EQcSJSL9LPV/sov+8vMpgH7RXpEu9f58=; b=b+7UKGnzVLQAcOYdOkGl1L7WGHhv5oAQ7XFm1l0DX2YB9Y5C3h7f6L6xNQ0DQJClnqgxWAIkLrLRJ+ehCQpLlZNx9msFcnNaKziZqwvgr6JCXN6cPn5Gp0u+8G3h2bHWHdr0/xKx536VtduGAdO8+wyUoCl1NgBiRSjoP9189A5joyko3UAFReAkJIcFTAHftFbq5F4wgNN9l98NetRyf13PJIhKMzcwq/StBR+FrEiFR8sQ8COIeYmZsjiV1G0AwKgdLS3dARW/U6D8AcvKnTLZtaAQFelRJ13gXTXWbB0+gucoWRj/q4R1OSOFsTCZDSuJ8XEGvOYJ3b4hOUJkcw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=cisco.com;dmarc=pass action=none header.from=cisco.com;dkim=pass header.d=cisco.com;arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=mxgM7BGpE43EQcSJSL9LPV/sov+8vMpgH7RXpEu9f58=; b=cFZA/C8bTJ+HzQUVcyI6KxptLYIrhGgeqqtzVma7P2O4y/zDeWxMvjRjKTB7+jc+b2vbk48o5pgAor41lY59i01tc4kohyl/Dh2k+n87hJ1deYWHHoujEpT1J7JGoZ6xwUGf6qy73DoRggqWEpcLidvIpVQCp/QysYsJxwRunLk=
Received: from BYAPR11MB3751.namprd11.prod.outlook.com (20.178.238.144) by BYAPR11MB2806.namprd11.prod.outlook.com (52.135.228.24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.17; Thu, 25 Jul 2019 05:04:30 +0000
Received: from BYAPR11MB3751.namprd11.prod.outlook.com ([fe80::a894:a92:ad6e:ee2a]) by BYAPR11MB3751.namprd11.prod.outlook.com ([fe80::a894:a92:ad6e:ee2a%7]) with mapi id 15.20.2094.017; Thu, 25 Jul 2019 05:04:30 +0000
From: "Jakob Heitz (jheitz)" <jheitz@cisco.com>
To: "sidrops@ietf.org" <sidrops@ietf.org>
Thread-Topic: draft-ietf-sidrops-aspa-verification-01: Handling unknowns
Thread-Index: AdVCo7iaisAZRDdHT/a/3q2UygwIOw==
Date: Thu, 25 Jul 2019 05:04:30 +0000
Message-ID: <BYAPR11MB37517CDEF18A211F9D9B6324C0C10@BYAPR11MB3751.namprd11.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=jheitz@cisco.com;
x-originating-ip: [2001:420:c0c8:1001::216]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 34058dd3-912e-41cd-59ba-08d710bd9381
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:BYAPR11MB2806;
x-ms-traffictypediagnostic: BYAPR11MB2806:
x-ms-exchange-purlcount: 5
x-microsoft-antispam-prvs: <BYAPR11MB2806C2B3CD1BC83D6182DB90C0C10@BYAPR11MB2806.namprd11.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:10000;
x-forefront-prvs: 0109D382B0
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(366004)(396003)(346002)(39860400002)(136003)(376002)(13464003)(199004)(189003)(33656002)(9686003)(6116002)(25786009)(6436002)(53936002)(476003)(74316002)(2906002)(5640700003)(7736002)(6506007)(6306002)(55016002)(14444005)(256004)(53546011)(305945005)(102836004)(7696005)(46003)(14454004)(186003)(66574012)(64756008)(66446008)(6916009)(66946007)(966005)(66556008)(66476007)(15650500001)(486006)(68736007)(76116006)(2351001)(99286004)(2501003)(52536014)(86362001)(8676002)(5660300002)(81156014)(81166006)(478600001)(1730700003)(316002)(71200400001)(8936002)(71190400001); DIR:OUT; SFP:1101; SCL:1; SRVR:BYAPR11MB2806; H:BYAPR11MB3751.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1;
received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: VIi8OB0MvbuxOCyXQLjBCNC19ZjJB2zsxrPvpWHkWe/ZGqvOSS5yQcSe/VGu2UedSv8j537ELUgiqa3l2ht3jOWR9FmugIUbIfkbIGiZ1mI1ixFMMOreT9/XOufzuxze+isZKamDnMqaexTK56zUDQhoxmoCvzCI2UjihQ8wD1EFCbLjaKxdCcAvVrdPij/zRPjnURHbYjxXk3BUczIzscPnL4F30Z+e1f5+DPHZeyUOFSB2+/cAR815+WD8P0Lu6LPoa1/zruBPJ2vZDdk11/jAFMH/IN16kQstIhblgkuUiGMxGFIevN2OggoKsiiFYhkb84CpkACuY1L6tUXp245/lr4aIdppVefw5XJC3ZeHnvnMammkpeNC/lMMqz3+F9ds/L6Q6cVG2X1DKAbZeT2bjEGk15p4a+TFKSQUh7U=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 34058dd3-912e-41cd-59ba-08d710bd9381
X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Jul 2019 05:04:30.4126 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: jheitz@cisco.com
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR11MB2806
X-OriginatorOrg: cisco.com
X-Outbound-SMTP-Client: 173.36.7.22, xch-aln-012.cisco.com
X-Outbound-Node: alln-core-4.cisco.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/sidrops/fvJUWlCAs0AnpudFRN1DANKsHSc>
Subject: [Sidrops] draft-ietf-sidrops-aspa-verification-01: Handling unknowns
X-BeenThere: sidrops@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: A list for the SIDR Operations WG <sidrops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sidrops>, <mailto:sidrops-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/sidrops/>
List-Post: <mailto:sidrops@ietf.org>
List-Help: <mailto:sidrops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sidrops>, <mailto:sidrops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 25 Jul 2019 05:04:39 -0000

I believe the path verification algorithm works when all ASes in the as-path
make attestations. If some of the ASes make no attestations, then a more complete
algorithm is as follows:

For every sequence (A, B, C) of consecutive ASes in an AS-path:
If A attests that B is not a provider and C attests that B is not a provider,
then B leaked the route: B is transiting for free. The segment is invalid.
If either A or C attests that B is a provider, then the AS-path segment  (A, B, C) is valid.
If neither A nor C make an attestation, then the leak state is unknown. Even if B lists both A and C as providers, it is not necessarily a leak, because either A or C could consider B as a provider for some of their routes, even though they don't attest to it.

If all the path segments are valid, then the whole path is valid.
If any of the path segments is invalid, then the whole path is invalid.
Else, at least one path segment is unknown and one more rule must be applied: for any sequence of ASes (A, B1, ..., Bn, C), if A attests that B1 is not a provider and C attests that Bn is not a provider, then the AS-path is invalid. This is for any number of Bx greater than 1.

This algorithm breaks the AS-PATH into triples instead of pairs.
For example, the AS_PATH (A,B,C,D,E) is broken into the triples:
(A,B,C), (B,C,D), (C,D,E).
I find it easier to reason about it like that.
It can probably be re-worded into pairs.

An additional point:
If AS-SETs exist then complete sequences between the AS-SETs can be checked for invalidity.
The best such an AS-PATH can get is unknown, but it can also be verified invalid.

Regards,
Jakob.

-----Original Message-----
From: Sidrops <sidrops-bounces@ietf.org> On Behalf Of internet-drafts@ietf.org
Sent: Monday, July 8, 2019 1:24 PM
To: i-d-announce@ietf.org
Cc: sidrops@ietf.org
Subject: [Sidrops] I-D Action: draft-ietf-sidrops-aspa-verification-01.txt


A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the SIDR Operations WG of the IETF.

        Title           : Verification of AS_PATH Using the Resource Certificate Public Key Infrastructure and Autonomous System Provider Authorization
        Authors         : Alexander Azimov
                          Eugene Bogomazov
                          Keyur Patel
                          Job Snijders
	Filename        : draft-ietf-sidrops-aspa-verification-01.txt
	Pages           : 10
	Date            : 2019-07-08

Abstract:
   This document defines the semantics of an Autonomous System Provider
   Authorization object in the Resource Public Key Infrastructure to
   verify the AS_PATH attribute of routes advertised in the Border
   Gateway Protocol.



The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-sidrops-aspa-verification/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-sidrops-aspa-verification-01
https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-aspa-verification-01

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-sidrops-aspa-verification-01


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
Sidrops mailing list
Sidrops@ietf.org
https://www.ietf.org/mailman/listinfo/sidrops