Subject: Re: [Sidrops] I-D Action: draft-ietf-sidrops-aspa-verification-08.txt

From: Andrei Robachevsky <[email-masked]>
Date: Mon, 25 Oct 2021 15:32:23 +0200

Hi,

I read the latest version of the draft and I am not sure that the 
Downstream Path verification procedure (sec 5.2) is correct.

The draft says:
> The first unequal pair of AS_SEQUENCE segments that has an "Invalid" outcome of the customer-provider verification procedure indicates the end of the Upstream fragment.

But the procedure described in items 3 and 4 seems to skip checking that 
the first downstream fragment of the path may return an invalid 
verification for the "reverse" ASPA (verify_pair(Seg(I), Seg(I-1), afi). 
By performing this check we can verify that that downstream customer 
indeed declared the top provider as its upstream.

It seems to me that a similar verification of a "reverse" ASPA needs to 
be done when detecting a leaking customer L, since verify_pair(Seg(L+1), 
Seg(L), afi) will likely return "Unknown", but verify_pair(Seg(L), 
Seg(L+1), afi) may be "Valid". In this case we can confidently state 
that it is a leak and return "Invalid".

Thanks,

Andrei

[email-masked] wrote on 25/08/2021 23:12:
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the SIDR Operations WG of the IETF.
> 
>          Title           : Verification of AS_PATH Using the Resource Certificate Public Key Infrastructure and Autonomous System Provider Authorization
>          Authors         : Alexander Azimov
>                            Eugene Bogomazov
>                            Randy Bush
>                            Keyur Patel
>                            Job Snijders
> 	Filename        : draft-ietf-sidrops-aspa-verification-08.txt
> 	Pages           : 15
> 	Date            : 2021-08-25
> 
> Abstract:
>     This document defines the semantics of an Autonomous System Provider
>     Authorization object in the Resource Public Key Infrastructure to
>     verify the AS_PATH attribute of routes advertised in the Border
>     Gateway Protocol.
> 
> 
> 
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-sidrops-aspa-verification/
> 
> There is also an htmlized version available at:
> https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-aspa-verification-08
> 
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-sidrops-aspa-verification-08
> 
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> 
> _______________________________________________
> Sidrops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidrops
>