IETF Logo Mail Archive

Re: [Sidrops] request to consider draft-spaghetti-sidrops-rpki-prefixlist for WG adoption

"Sriram, Kotikalapudi (Fed)" <kotikalapudi.sriram@nist.gov> Tue, 01 August 2023 01:20 UTC

Return-Path: <kotikalapudi.sriram@nist.gov>
X-Original-To: sidrops@ietfa.amsl.com
Delivered-To: sidrops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5CC22C151992 for <sidrops@ietfa.amsl.com>; Mon, 31 Jul 2023 18:20:14 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.108
X-Spam-Level:
X-Spam-Status: No, score=-3.108 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FROM_GOV_DKIM_AU=-0.999, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=nist.gov
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VAC4Rv7bA95c for <sidrops@ietfa.amsl.com>; Mon, 31 Jul 2023 18:20:10 -0700 (PDT)
Received: from GCC02-BL0-obe.outbound.protection.outlook.com (mail-bl0gcc02on2109.outbound.protection.outlook.com [40.107.89.109]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 60E3BC1519A1 for <sidrops@ietf.org>; Mon, 31 Jul 2023 18:20:10 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=TfPYGx6mnQE7iNpo0t1M7Fwj8OUvgSSX+emgljhG7cBjbVZDbAHAcv1UJ46N6AJolk39KURBFmDTujG0+n3oaJyZfpqvPiRK15p3s4+P0Pes+SEPTijqVd810tzwWgBwcoLL1hEy/r5kcjqgkiPhvpIlS//5gqaEag0Nq943Yig8N30bvugKGUqfSx5m4COoqXbOEL7eG5sWVLIgKiT3uVJjk5SlXqbzIzCz7zklTrsOWlJSUtZZQIM1mZCiGihDUrLcwlb8u7LRnQMHR/DpBchm7LsLlTXumuzmNh68YzJ/0G0zfkBk0TeunS6TzEX+w5f73FgRg83j4sPL4ABXwg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=EKmtqyxNRMGRUS3rE/IoYwHDRuxTT+RM3P0aZ1tNg5Q=; b=Xu6nFTM5rLm+zouEGShDpZBReagnWrKMdDRvgvmm7Pz/PTMvw1nij7SsfLVWndrNOP/7DRb14xllOhrHcedRaepz8eh3eV2DK3pP6/KliFR/I4vSBz05sNvX5KSamwO1ssmglZsr1PBtuMa41fULLggFoWIm9N0wfxBlj9fh5vXb/LNHKchvVUhd6KKeO1MxsrMLqhEWXOqQHcYH4BWYpaZ+S/IVTElfO75h04go5FhDBfVpyoI8ilmvS1qm+WdqWVg4ncUOa/SFUqVeuqg/Y9wslrHgVn5jX1OV0p8oKz0GxKl5v9KHu7DcI3C2kJVoZOK3ClLVHqunPuqdT6/YAw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nist.gov; dmarc=pass action=none header.from=nist.gov; dkim=pass header.d=nist.gov; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nist.gov; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=EKmtqyxNRMGRUS3rE/IoYwHDRuxTT+RM3P0aZ1tNg5Q=; b=pTFnavxCq9KSjU90qz3qMn+PLBF8lxrV/4DC/zG8i2BMXOH36eoQ5vqbMpGNdEhOaGIQy6zzdSPrlSr+4qum46DqXH4/blA9u0RNYXaKi342gPqS/rGGBZbyMD2EwyF+2Jdh/Gl1zOiBqvIXVHRVSZvVuG9+6EgGsK7Ry4olw674C2xpnJrTZDoWOlAFPyEcohsQTpPx2HnxzqgcXNrfU4mVc5WY367wJmLBO/u0Gpkf61/OsFLO91nbjVnMgseTIrBKnKOG3IBmJmxr7qqFTl/NfP8sbLBJSU2/yY1cxwEFvBmibzjz2XKZ9rDBxtXGzawqc/Wp/05ykha9iQndMQ==
Received: from SA1PR09MB8142.namprd09.prod.outlook.com (2603:10b6:806:171::8) by SA0PR09MB7340.namprd09.prod.outlook.com (2603:10b6:806:7e::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6631.39; Tue, 1 Aug 2023 01:20:07 +0000
Received: from SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::e94c:25d9:4f59:7846]) by SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::e94c:25d9:4f59:7846%6]) with mapi id 15.20.6631.042; Tue, 1 Aug 2023 01:20:06 +0000
From: "Sriram, Kotikalapudi (Fed)" <kotikalapudi.sriram@nist.gov>
To: Geoff Huston <gih902@gmail.com>
CC: "sidrops@ietf.org" <sidrops@ietf.org>
Thread-Topic: [Sidrops] request to consider draft-spaghetti-sidrops-rpki-prefixlist for WG adoption
Thread-Index: AQHZvx/6R7sNwzqkVEOM3yogtr3t86/QllUAgAHucmCAAEjXAIABoaYw
Date: Tue, 01 Aug 2023 01:20:06 +0000
Message-ID: <SA1PR09MB81421C3E226CA3ED52D874D9840AA@SA1PR09MB8142.namprd09.prod.outlook.com>
References: <SA1PR09MB8142D5B0AFE288F6494E27E68403A@SA1PR09MB8142.namprd09.prod.outlook.com> <ZMAKd1F8MnnkNowl@snel> <000001d9c20a$4b63bf30$e22b3d90$@cernet.edu.cn> <SA1PR09MB814241FCE402C998B8B5CB028404A@SA1PR09MB8142.namprd09.prod.outlook.com> <70F6B97C-55FB-4F76-93B8-59CCA681294B@gmail.com>
In-Reply-To: <70F6B97C-55FB-4F76-93B8-59CCA681294B@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nist.gov;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: SA1PR09MB8142:EE_|SA0PR09MB7340:EE_
x-ms-office365-filtering-correlation-id: db61396a-552c-498b-7410-08db922d70f4
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: Z87ApOJSlsi89TDraxSV999zuuk2c8OQvqCmpELQgwd84Ipwk5QKJLD+gChfYFR3OgcMqObzK/Koq3Z1EIsei4okO9kqfaGi9Zr7I+6OojyiZ89mKc/DQ+W2g8DJoYIp76zrn3miiKSyy8OVy0B9q/UAlfjpWWphSOBqicCXtz6POMwiGX0K/9CzO/cQdrEArgc/64BfDpOhdWQNcer6DlNppe6IGELUkQUy7cLoAyKgzhuK0OCDxaYuyMDkUB1G9BsHgDSAJRJ4GlElDCt1BpTjZeBgROlORraegKXjlrhjEKX7dyhgRHbBOC83o9VK49+5EMYQyAX9Dz2F80bE2s1Kv55wtdHs9eahLw5fdnz11zNBc/S3n5BT+68pikgS+ORhH8FT1hrU2p6QX5CdwvR+rzl411fpL6CjiEUQC0oPhd37FCLnPlEt8YWEdkbbPQ0TAvGKXMNtshy4j43ImoIAZ1IZHigpsJZi9YLjAK8yIKgCbAFxnRRXRplpFvMEEBizgVtBD7ya1Jf6/uaSy+BwhJM9qdM8QKidl76BptWAO1Jem1I1CL/HEoDrOpwiMndvrIjfufh6Uawq87zbnnf3+moMjHSDt/jOVgww8GXQ6tHDestZPIxrL8OYhVRb
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SA1PR09MB8142.namprd09.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230028)(4636009)(366004)(451199021)(9686003)(7696005)(55016003)(53546011)(6506007)(26005)(83380400001)(186003)(76116006)(33656002)(66946007)(52536014)(66556008)(122000001)(82960400001)(38070700005)(38100700002)(86362001)(66476007)(5660300002)(66446008)(6916009)(4326008)(8676002)(8936002)(64756008)(2906002)(71200400001)(498600001); DIR:OUT; SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: bv/l2DgyMFUJHF4oA1UliL7nY9swrUBy8Mqh82lsy5tEcb4up0r5ANYP/LAf2rZ9HDeUUN3JPFvhkg639xiZZZ73Gpm3N2FIiXQJCwrbHW8lk1JMGmVbVwuFmteME4u/BcbwrJw91ceEIoyL5f80nmN9cECe/LmtauCoh9TeCvkF5RgkP4ddNskYRijfBJS3jaK2LBSOaqCi86xKwDBr97E647LIQ1iWW3ac8VQk/oBzyq4VWalGpzQ4YnI+nWyhksA3Om3MUKVyni6rgfIft4v2FkzESKNAKJbF6gSUUARtC7THFg81h57WpqO/aKHTpKr0I3TkqQDM2yb0BHhqGPjqT2L79ORsaFWHYswSr9pN5e+1R/mRYk4iuoIOSgmBDXYwGKOVqFwtJ3Yg0uA97SakqwylQS724clgMF2pIAvGB0A7UkRsy0EoIzm4P4yo7rjfnmGp78CcDslKzAFLiPk8OkDrvEezeFNJ4eyHdRr6TAUsKd4q9kDz+SMgZIPhsW4dJ1aTDFBvoPXmN1PkiG7EDHseK18Z5ULbN2x7buMoxY9IT3Gj7mcFreR70+GJuSQ+iGkjNl58R7XHPfJzyhUQ2Wz0oT3YD2RcWakeuzCHKqy0RB5CZtAnVxvVeVqHHAs1Zhxd7SgU16ZRB7Gf3PkPBVZoUrBkW9NSunzlP03tp8kzSaa2BxayCPhFH9KSnMkpZ3AfGuLDChhjkU8bujIrKiitvfW20eIdjWJnq3y0ZCc7Wfjg+Nn6933IsIc0g+zP5BaoI//TY3P05rzr4dUvAs17lnEYAQzcQDY/pZOgXybqY1xOg7vTOumndb18qvm1NPFVqeLsp8DJr2fKJz6pehVpChjlizB86N7lffIH2c75ld8wdHxmJH+qLHGJ+M94m3486X6v6HWLOfzb4U7rrnxjIVxJ4K6ZjkPLo5IVlMqo5ALDg1c/dPJ5UDTKoTTCYax5+xJBVSzmJ3+zDe3O/A9rffs+RXJnOLVH72sDDa7LfFvTK44YafWjq3VQR95QDBTuqnphSj8LF+hmVDYSRs+5c3qAHi04bML+P97YkiLq5BvsL9Y3S0waCOmH4UipuIdrHXSbf50I43JEQcFZdKsyP0HFl1TSmOzb8dhBxcC+eQ4+7SSQyCHSw0RMxkKLYljvVuJ8NOxfK8xUakDuAR6Q5EvL18kkBEG4zIa7jFejVTzGTuZVq75t3b9x6gn8qFX2bdPqumfL5U46mJZcuWsFy/0frFhGhq8dTAxNdMYm+KAGOPk8vZoLlh2T2U5gbn+sThHBulp6lUG/xJuGl8ZMzNSVT39k/8xxcxCrBbz3lBPy2mTapYAbP8IULrQNXKkHriQTejV9ou+WqnlwELJjWTZJ6RxNXywqjsoa3apRpzZtT93AzjmXkfxrYIefgFPNFPY/pdHONyMu98lC/VnM0QXQQdxL/U2GGU9YzmnLbSO4tG5mdH35Ylfa3tJ8JpwDq9x4sq/kwq3MGnASZsE1U7ubmLrneXaBXL6/dauRk8Ovf74plFGtr1LLij+Tm23bYyfvstW4/X04IIHZcdQ52ggoBVm5TQ6BzNs=
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: nist.gov
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SA1PR09MB8142.namprd09.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: db61396a-552c-498b-7410-08db922d70f4
X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Aug 2023 01:20:06.8730 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR09MB7340
Archived-At: <https://mailarchive.ietf.org/arch/msg/sidrops/pBcPtGHGNmqyliG9jmrw-vZPZ3A>
Subject: Re: [Sidrops] request to consider draft-spaghetti-sidrops-rpki-prefixlist for WG adoption
X-BeenThere: sidrops@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: A list for the SIDR Operations WG <sidrops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sidrops>, <mailto:sidrops-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/sidrops/>
List-Post: <mailto:sidrops@ietf.org>
List-Help: <mailto:sidrops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sidrops>, <mailto:sidrops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Aug 2023 01:20:14 -0000

Hi Geoff,

>Some specific examples may help me understand why you are making this assertion.

Maybe I am getting ahead of your thought process. So, let us step back a bit and ask the following questions:

One use case you mention in the draft is this:

   In other words, if a
   given BGP route is covered by a RPKI PrefixList, but also is
   "invalid" from a Route Origin Validation perspective, it is
   RECOMMENDED to reject the route announcement.

Q1: ISPs today can (and do) reject a route if it is "invalid" from an ROV perspective [RFC 6811]. So, the first part of checking "if a given BGP route is covered by a RPKI PrefixList" is superfluous in this scenario. Do you agree?

So what is an actual use case for the PrefixList? Is there a scenario where an RP would use PrefixList-valid result to do something differently than how the RP uses the corresponding ROV result.      

>given that we need to recognise the reality of partial adoption of ROAs

How is the PrefixList used to overcome a lack of a ROA?  

Based on your answer, I can perhaps generate an example.

Sriram

-----Original Message-----
From: Geoff Huston <gih902@gmail.com> 
Sent: Sunday, July 30, 2023 4:39 PM
To: Sriram, Kotikalapudi (Fed) <kotikalapudi.sriram@nist.gov>
Cc: sidrops@ietf.org
Subject: Re: [Sidrops] request to consider draft-spaghetti-sidrops-rpki-prefixlist for WG adoption

> On 30 Jul 2023, at 10:18 am, Sriram, Kotikalapudi (Fed) <kotikalapudi.sriram=40nist.gov@dmarc.ietf.org> wrote:
> 
> Prefixlist amounts to giving power to a potential prefix hijacker because undermines the semantics of a ROA.    


I find this an odd assertion. Given that a ROA is published by the prefix holder without any consultation with, or approval from, the AS holder, and given that we need to recognise the reality of partial adoption of ROAs by prefix holders then exactly how does an AS holder publishing a prefix list “undermine the semantics of a ROA”? And how does that publication of a prefix list give “power to a potential prefix hijacker?”

Some specific examples may help me understand why you are making this assertion.

thanks,

  Geoff

v2.46.0 | Report a Bug | By Email | System Status