Re: [Sidrops] Which 8210-bis error code should be used?

[Job Snijders <[e-mail]>]

Dear all,

I would not object to removing afiLimit - even though it’s late in the
game. I too am willing to do the work on all ASPA-aware software I
contribute to to make it so.

I think unification of IPv4 and IPv6 in this aspect of the ecosystem will
pay off dividends in the long run: less error prone for operators,
virtually all networks intend to dual-stack with their existing upstreams
anyway, I think it helps deployment for both AFIs.

Kind regards,

Job

On Wed, 24 May 2023 at 11:39, Claudio Jeker <[e-mail]>
wrote:

> On Wed, May 24, 2023 at 10:05:58AM +0200, Martin Hoffmann wrote:
> > Claudio Jeker wrote:
> > >
> > > I agree that ASPA-generating CAs (especially the RIR portals) need to
> > > stop or warn operators when they create entries that only cover one
> > > AFI. Actually the portals should discourage the operator to use AFI
> > > specific entries in the first place.
> >
> > This sounds a lot like we are creating the next max-len debacle. Have
> > we seriously considered just not having afiLimit at all? The
> > consequence would be that a couple ASPAs have a couple ASNs in their
> > provider set that aren’t valid providers for a subset of prefixes.
> >
> > How does the added protection weigh against the added complexity
> > at all stages of the protocol, particular in view of the strong
> > recommendation to not use the feature at all?
> >
> > I.e.:
> >
> > > Remember:
> > > Rule number one to improve security is to remove options, not adding
> > > them.>
> >
> >
> >   -- Martin
> >
> > PS: Yes, I know it is very late in the process. But this keeps popping
> >     up which is a good indicator that it will keep popping up later and
> >     cause operational issues. Perhaps avoiding that is worth the extra
> >     hassle now?
>
> I would love to remove the optional afiLimit from ASPA.
> I brought this up a few times (well before there was any implementation of
> any ASPA draft) and every time the answer of some of the authors was no
> (without any particular reason).
>
> As one of the developers of the first RP and only BGP implementation
> handling ASPA I would enjoy to remove all the code required to handle the
> afiLimit. We probably control most test deployments (RP and BGP side) and
> are willing to make this change.
>
> --
> :wq Claudio
>