Re: [Sidrops] feedback on draft-michaelson-rpki-rta
Claudio Jeker <cjeker@diehard.n-r-g.com> Tue, 29 December 2020 10:14 UTC
Return-Path: <cjeker@diehard.n-r-g.com>
X-Original-To: sidrops@ietfa.amsl.com
Delivered-To: sidrops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3E07A3A134B for <sidrops@ietfa.amsl.com>; Tue, 29 Dec 2020 02:14:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.894
X-Spam-Level:
X-Spam-Status: No, score=-1.894 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hpLnkpTV-RSn for <sidrops@ietfa.amsl.com>; Tue, 29 Dec 2020 02:14:20 -0800 (PST)
Received: from diehard.n-r-g.com (diehard.n-r-g.com [62.48.3.9]) (using TLSv1.2 with cipher ECDHE-RSA-CHACHA20-POLY1305 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 15FA83A134C for <sidrops@ietf.org>; Tue, 29 Dec 2020 02:14:19 -0800 (PST)
Received: (qmail 46778 invoked by uid 1000); 29 Dec 2020 10:14:12 -0000
Date: Tue, 29 Dec 2020 11:14:12 +0100
From: Claudio Jeker <cjeker@diehard.n-r-g.com>
To: Job Snijders <job@sobornost.net>
Cc: sidrops@ietf.org
Message-ID: <20201229101412.GA56136@diehard.n-r-g.com>
References: <X+d3+e5Rj/Q7Dchv@bench.sobornost.net>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <X+d3+e5Rj/Q7Dchv@bench.sobornost.net>
User-Agent: Mutt/1.10.1 (2018-07-13)
Archived-At: <https://mailarchive.ietf.org/arch/msg/sidrops/ifqMUM5I3lXYzvFnwTPxsLheCxc>
Subject: Re: [Sidrops] feedback on draft-michaelson-rpki-rta
X-BeenThere: sidrops@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: A list for the SIDR Operations WG <sidrops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sidrops>, <mailto:sidrops-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/sidrops/>
List-Post: <mailto:sidrops@ietf.org>
List-Help: <mailto:sidrops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sidrops>, <mailto:sidrops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 29 Dec 2020 10:14:23 -0000
On Sat, Dec 26, 2020 at 05:50:49PM +0000, Job Snijders wrote: > Dear group, > > Reading draft-michaelson-rpki-rta-02 while writing some work-in-progress > code, I have some suggestions that hopefully improve the ease of use > of RTAs. WIP: http://sobornost.net/~job/rpki-client-rta.patch.txt I checked your diff and the draft. I think one thing in the draft. There is a big issue with the fact that RTA can be cross signed by multiple certs. No other resource in RPKI does that and it causes some issues with the validation process. Until now each CA repo could be checked independently once ready but now RTA files suddenly have interdependencies that need special attention. I would like to know why this complication is needed for RTA - what is the actual use case where multiple signers are necessary. I currently don't see why this is required (especially since the resources (ASnum and IP blocks) need to be allowed by all those CA certs. Your diff needs some work to actually do the full validation. We should not punt this off to 3rd party. Also in rta_parse() the calloc uses a wrong sizeof() rta instead of roa (or better just use sizeof(*p.res)). RFCs like this need some demo resources to play with. -- :wq Claudio
- [Sidrops] feedback on draft-michaelson-rpki-rta Job Snijders
- Re: [Sidrops] feedback on draft-michaelson-rpki-r… Claudio Jeker
- Re: [Sidrops] feedback on draft-michaelson-rpki-r… Job Snijders
- Re: [Sidrops] feedback on draft-michaelson-rpki-r… Stephen Kent
- Re: [Sidrops] feedback on draft-michaelson-rpki-r… Claudio Jeker
- Re: [Sidrops] feedback on draft-michaelson-rpki-r… Job Snijders
- Re: [Sidrops] feedback on draft-michaelson-rpki-r… Stephen Kent
- Re: [Sidrops] feedback on draft-michaelson-rpki-r… Ben Maddison
- Re: [Sidrops] feedback on draft-michaelson-rpki-r… Tim Bruijnzeels
- Re: [Sidrops] feedback on draft-michaelson-rpki-r… Korsback, Fredrik
- Re: [Sidrops] feedback on draft-michaelson-rpki-r… Tim Bruijnzeels
- Re: [Sidrops] feedback on draft-michaelson-rpki-r… Stephen Kent
- Re: [Sidrops] feedback on draft-michaelson-rpki-r… George Michaelson
- Re: [Sidrops] feedback on draft-michaelson-rpki-r… Ben Maddison
- Re: [Sidrops] feedback on draft-michaelson-rpki-r… Martin Hoffmann
- Re: [Sidrops] feedback on draft-michaelson-rpki-r… Job Snijders
- Re: [Sidrops] feedback on draft-michaelson-rpki-r… George Michaelson
- Re: [Sidrops] feedback on draft-michaelson-rpki-r… Job Snijders
- Re: [Sidrops] feedback on draft-michaelson-rpki-r… Job Snijders
- Re: [Sidrops] feedback on draft-michaelson-rpki-r… Martin Hoffmann
- Re: [Sidrops] feedback on draft-michaelson-rpki-r… Di Ma