Subject: [Sidrops] BGPsec suports AS Ranges? - Re: ASPA provider ranges in draft-ietf-sidrops-8210bis-03?

From: "Borchert, Oliver (Fed)" <[email-masked]>
Date: Fri, 15 Oct 2021 18:55:33 +0000

Hi Claudio,

I changed the Subject to not hijack the main discussion started by Tim.

You brought up BGPsec and made an interesting statement: 

  " BGPsec has the same issue of supporting AS
    ranges for no valid reason. It only adds an attack vector to the
    protocol. "

and I was wondering if you could point me to where in RFC8205 or elsewhere it is written or implied that BGPsec supports the usage of AS Ranges. More over as you said for no valid reason. 

It's some time that I worked last on BGPsec itself and I cannot recall this nor did my quick scan over the documents show me where this is mentioned/implied ? 

Just out of curiosity.

Oliver

-----------------------------------------------
Oliver Borchert, Computer Scientist
National Institute of Standards and Technology
(Office) +1.301.975.4856
(GVoice) +1.240.668.4117

On 10/13/21, 5:56 AM, "Sidrops on behalf of Claudio Jeker" <[email-masked] on behalf of [email-masked]> wrote:

    On Wed, Oct 13, 2021 at 10:36:27AM +0100, Nick Hilliard wrote:
    > Job Snijders wrote on 13/10/2021 10:08:
    > > Has anyone ever said "I buy transit from AS 1 upto including 1000"?
    > 
    > More to the point, what would happen if someone created an object which
    > stated that they bought transit from AS1 up to AS4294967294?

    Since this is a nonsensical request the ASPA draft needs to be  adjusted
    and just plain not allow it. Please stop adding features that are complex
    to implement and not needed. BGPsec has the same issue of supporting AS
    ranges for no valid reason. It only adds an attack vector to the
    protocol.

    -- 
    :wq Claudio

    _______________________________________________
    Sidrops mailing list
    [email-masked]
    https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fsidrops&amp;data=04%7C01%7Coliver.borchert%40nist.gov%7C7601b7b8add648226a2908d98e2fbf49%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C637697158017804321%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=Pr%2BhYxSKEPVZMK9xRHXtzt82tTRz3zADPfO0V08AhEg%3D&amp;reserved=0

---

From: Job Snijders <[email-masked]>
Date: Fri, 15 Oct 2021 21:09:33 +0200

Hi Oliver,

Out of the three rfc3779 options (asid, range, or inherit), only “inherit”
was disallowed via
https://datatracker.ietf.org/doc/html/rfc8209#section-3.1.3.5

So I ended up with a switch statement like here:
https://github.com/openbsd/src/blob/08f6ba1906d01c4a24fa700d568400f71bcf9611/usr.sbin/rpki-client/cert.c#L1429-L1441

Kind regards,

Job

On Fri, 15 Oct 2021 at 20:55, Borchert, Oliver (Fed) <oliver.borchert=
[email-masked]> wrote:

> and I was wondering if you could point me to where in RFC8205 or elsewhere
> it is written or implied that BGPsec supports the usage of AS Ranges. More
> over as you said for no valid reason.
>
> It's some time that I worked last on BGPsec itself and I cannot recall
> this nor did my quick scan over the documents show me where this is
> mentioned/implied ?
>
> Just out of curiosity.
>
> Oliver
>
> On 10/13/21, 5:56 AM, "Sidrops on behalf of Claudio Jeker" <
> [email-masked] on behalf of [email-masked]> wrote:
>
> https://www.ietf.org/mailman/listinfo/sidrops
>

---

From: "Borchert, Oliver (Fed)" <[email-masked]>
Date: Mon, 18 Oct 2021 14:45:26 +0000

Job,
Thanks for the link.

Oliver

From: Job Snijders <job=[email-masked]>
Date: Friday, October 15, 2021 at 3:10 PM
To: Oliver Borchert <[email-masked]>
Cc: Oliver Borchert <[email-masked]>, Claudio Jeker <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [Sidrops] BGPsec suports AS Ranges? - Re: ASPA provider ranges in draft-ietf-sidrops-8210bis-03?

Hi Oliver,

Out of the three rfc3779 options (asid, range, or inherit), only “inherit” was disallowed via
https://datatracker.ietf.org/doc/html/rfc8209#section-3.1.3.5<https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Frfc8209%23section-3.1.3.5&data=04%7C01%7Coliver.borchert%40nist.gov%7C6d242b12d6fa4ed9781a08d9900f6194%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C637699218020216350%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=5%2BUP8H%2BFddyBXdPQV6jduS4bg6xRpSltss6GOuM9Qfg%3D&reserved=0>

Kind regards,

Job

On Fri, 15 Oct 2021 at 20:55, Borchert, Oliver (Fed) <oliver.borchert=[email-masked]<mailto:[email-masked]>> wrote:
Hi Claudio,

Just out of curiosity.

Oliver

On 10/13/21, 5:56 AM, "Sidrops on behalf of Claudio Jeker" <[email-masked]<mailto:[email-masked]> on behalf of [email-masked]<mailto:[email-masked]>> wrote:

    --
    :wq Claudio

    _______________________________________________
    Sidrops mailing list
    [email-masked]<mailto:[email-masked]>
    https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fsidrops&amp;data=04%7C01%7Coliver.borchert%40nist.gov%7C7601b7b8add648226a2908d98e2fbf49%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C637697158017804321%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=Pr%2BhYxSKEPVZMK9xRHXtzt82tTRz3zADPfO0V08AhEg%3D&amp;reserved=0<https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fsidrops&data=04%7C01%7Coliver.borchert%40nist.gov%7C6d242b12d6fa4ed9781a08d9900f6194%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C637699218020226295%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=prv5R5OTNRHfi%2B3F2bi1gev5r5BflUkWmGeVCLfNdjY%3D&reserved=0>

_______________________________________________
Sidrops mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sidrops<https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fsidrops&data=04%7C01%7Coliver.borchert%40nist.gov%7C6d242b12d6fa4ed9781a08d9900f6194%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C637699218020226295%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=prv5R5OTNRHfi%2B3F2bi1gev5r5BflUkWmGeVCLfNdjY%3D&reserved=0>