Subject: [Sidrops] Clarification of draft-ietf-sidrops-aspa-verification-03

From: Luuk Hendriks <[email-masked]>
Date: Thu, 9 Jan 2020 12:46:09 +0100

Hi all,

Reading through draft-ietf-sidrops-aspa-verification-03 left me with
some questions. I have not followed the entire evolution of this
document, so apologies if I nag about things that have been discussed
before.  Especially with regards to the actual validation steps, I (or
rather we, there has been a lot of discussion in our office) think we
might be missing or misinterpreting some parts, and I'd like to get on
the same page before diving into details.

With regards to the upstream/downstream and allowing one Invalid to
occur in the 'chain' so to say, we picture it as follows:

                             +-----+
                    +--------> AS2 +--------+
                    |        +-----+        |
                 +-----+                 +--v--+
        +------->+ AS1 |                 | AS3 +--------+
        |        +-----+                 +--^--+        |
     +-----+                                         +--v--+
     | AS0 |                                         | AS4 |
     +-----+                                         +-----+
                                                        |
                                                     +--v--+
                                                     | AS5 |
                                                     +-----+

Say, we are AS5, receiving an announcement with AS_PATH 4 3 2 1 0 , thus
AS0 being the originating AS. The upstream part is AS0 -> AS1 -> AS2,
the downstream part is AS2 -> AS3 -> AS4 . (Correct?)

Then looking at the diagrams in the draft, there is an I++ when this
allowed Invalid is observed. Does that mean that the relation between
the ASes just after the upstream/downstream point (thus, whether AS2 is
a provider of AS3) is not checked? If so, is that on purpose, and how
does it not break the validation chain?

Hopefully someone can clarify whether we are on the right track of
understanding these concepts.

Thanks,
 luuk

---

From: Alexander Azimov <[email-masked]>
Date: Tue, 14 Jan 2020 18:04:34 +0300

Hi Luuk,

In the terms of the draft AS0->AS1->AS2 is an upstream path, while AS3->AS4
is a downstream path.
The invalid state of (AS2, AS3) pair triggers the change of the
'direction', but the following downstream path verification procedure is
not applicable to (AS3, AS2) since it can be a peering link, that's why I++
is used.

чт, 9 янв. 2020 г. в 14:46, Luuk Hendriks <[email-masked]>:

> _______________________________________________
> Sidrops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidrops
>

-- 
Best regards,
Alexander Azimov

---

From: Luuk Hendriks <[email-masked]>
Date: Tue, 21 Jan 2020 09:05:53 +0100

Hi Alexander, all,

> not applicable to (AS3, AS2) since it can be a peering link, that's why I++

Thanks for clarifying, it seems that we did interpret those parts of the draft
correctly then. But we are still wondering whether skipping the check after the
direction change is introducing a problem. (Again, this might be us not having
much operational experience with actual routing, so please bear with me..)

What if a bad actor, AS9, inserts itself in the path like this:

                             +-----+
                    +--------> AS2 +--------+
                    |        +--+--+        |
                 +-----+        |        +--v--+
        +------->+ AS1 |        | +----->| AS3 +--------+
        |        +-----+        | |      +--^--+        |
     +-----+                  +-v-+-+                +--v--+
     | AS0 |                  | AS9 |                | AS4 |
     +-----+                  +-----+                +-----+
                                                        |
                                                     +--v--+
                                                     | AS5 |
                                                     +-----+

No valid (AS2, AS9) ASPA is found, so we assume it is a peering link (the
I++). Direction is changed, so continuing, (AS3, AS9) and (AS4, AS3) are
checked. Now, if and only if any of these yield Invalid, the final result will
be Invalid. Otherwise, the result will be Valid or Unknown, even though there is
a malicious AS in the path. In other words, is the draft in its current revision
beneficial without (close to) 100% adoption?
Or, is this situation not considered a problem in reality due to the longer
AS_PATH and thus a lower preference anyway?

Thanks,
 luuk