Subject: [sidr] 4-byte vs 2 byte ASN (was re: I-D Action: draft-ietf-sidr-pfx-validate-03.txt)

From: "George, Wes" <[email-masked]>
Date: Tue, 1 Nov 2011 14:05:51 -0400

Posing the question about 4-byte ASNs in my review of the BGPSec design reqs draft yesterday makes me wonder about the same in pfx-validate. The draft makes reference to AS_PATH in several locations. I'm thinking that we need a comment early in the draft stating that for the remainder of the draft no distinction is being made between AS_PATH and AS4_PATH, and that this standard is expected to support origin validation of both. Or alternatively, specify that this validation is performed on AS4_PATH and require support for 4893 as a prerequisite for SIDR.
If we don't explicitly require hosts that support SIDR origin validation to support 4-byte ASN, we may also need some direction regarding specific handling for AS23456, such as to always treat as unknown since there is no way to determine validity for the combination of a prefix and a non-unique placeholder ASN (except for local TA), but we don't necessarily want those routes to be treated as invalid.

I'm not sure if some of this belongs within sidr-arch, roa-validation, origin-ops, etc, but a quick scan through those docs don't reveal any obvious references to 4893, AS4_PATH, etc.

Thanks
Wes George

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> [email-masked]
> Sent: Monday, October 31, 2011 2:21 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: [sidr] I-D Action: draft-ietf-sidr-pfx-validate-03.txt
>
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories. This draft is a work item of the Secure Inter-Domain
> Routing Working Group of the IETF.
>
>       Title           : BGP Prefix Origin Validation
>       Author(s)       : Pradosh Mohapatra
>                           John Scudder
>                           David Ward
>                           Randy Bush
>                           Rob Austein
>       Filename        : draft-ietf-sidr-pfx-validate-03.txt
>       Pages           : 13
>       Date            : 2011-10-31
>
>    To help reduce well-known threats against BGP including prefix mis-
>    announcing and monkey-in-the-middle attacks, one of the security
>    requirements is the ability to validate the origination AS of BGP
>    routes.  More specifically, one needs to validate that the AS number
>    claiming to originate an address prefix (as derived from the AS_PATH
>    attribute of the BGP route) is in fact authorized by the prefix
>    holder to do so.  This document describes a simple validation
>    mechanism to partially satisfy this requirement.
>
>
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-ietf-sidr-pfx-validate-03.txt
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
> This Internet-Draft can be retrieved at:
> ftp://ftp.ietf.org/internet-drafts/draft-ietf-sidr-pfx-validate-03.txt
> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr

This E-mail and any of its attachments may contain Time Warner Cable proprietary information, which is privileged, confidential, or subject to copyright belonging to Time Warner Cable. This E-mail is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient of this E-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and attachments to this E-mail is strictly prohibited and may be unlawful. If you have received this E-mail in error, please notify the sender immediately and permanently delete the original and any copy of this E-mail and any printout.

---

From: John Leslie <[email-masked]>
Date: Tue, 1 Nov 2011 19:04:26 -0400

George, Wes <[email-masked]> wrote:
> 
> I'm thinking that we need a comment early in the draft stating that
> for the remainder of the draft no distinction is being made between
> AS_PATH and AS4_PATH,

   I wouldn't phrase it that way -- I'd emphasize instead that the AS
Path being validated is the AS Path _after_ reconstruction using
AS4_PATH in the case where routing information comes from a peer which
doesn't recognize 4-byte ASNs.

   (It would be simply wrong to "validate" AS4_PATH in the case where
you don't also do the reconstruction, or in the protocol-violating
case where you receive AS4_PATH from a peer which does speak 4-byte
ASNs.)

> Or alternatively, specify that this validation is performed on
> AS4_PATH

   That would also be wrong. :^(

> and require support for 4893 as a prerequisite for SIDR.

   IMHO, support for 4-byte ASNs should be a prerequisite. Alas, this
_does_ need to be stated.

> If we don't explicitly require hosts that support SIDR origin
> validation to support 4-byte ASN, we may also need some direction
> regarding specific handling for AS23456,

   It would be good to add that anyway, since I contend that we can't
be sure AS23456 will always be removed.

--
John Leslie <[email-masked]>

---

From: Randy Bush <[email-masked]>
Date: Wed, 02 Nov 2011 05:04:21 +0100

aven i, an old fuddy duddy, kinda assume that an AS number is two or
four bytes, an ip address is ipv4 or ipv6, etc.  i can understand
clarifying once in a document where it is critical to do so, but would
not be inclined to make it explicit everywhere AS is used or ip address
is used.

randy

---

From: Pradosh Mohapatra <[email-masked]>
Date: Tue, 1 Nov 2011 23:09:36 -0700

> Posing the question about 4-byte ASNs in my review of the BGPSec  
> design reqs draft yesterday makes me wonder about the same in pfx- 
> validate. The draft makes reference to AS_PATH in several locations.  
> AS_PATH and AS4_PATH, and that this standard is expected to support  
> origin validation of both. Or alternatively, specify that this  
> validation is performed on AS4_PATH and require support for 4893 as  
> a prerequisite for SIDR.
> regarding specific handling for AS23456, such as to always treat as  
> unknown since there is no way to determine validity for the  
> combination of a prefix and a non-unique placeholder ASN (except for  
> local TA), but we don't necessarily want those routes to be treated  
> as invalid.

I think it's fair to assume that routers supporting origin validation  
also support 4893.

- Pradosh

---

From: Hannes Gredler <[email-masked]>
Date: Wed, 2 Nov 2011 15:53:37 +0100

On Tue, Nov 01, 2011 at 11:09:36PM -0700, Pradosh Mohapatra wrote:
| >Posing the question about 4-byte ASNs in my review of the BGPSec
| >design reqs draft yesterday makes me wonder about the same in pfx-
| >validate. The draft makes reference to AS_PATH in several
| >locations. I'm thinking that we need a comment early in the draft
| >stating that for the remainder of the draft no distinction is
| >being made between AS_PATH and AS4_PATH, and that this standard is
| >expected to support origin validation of both. Or alternatively,
| >specify that this validation is performed on AS4_PATH and require
| >support for 4893 as a prerequisite for SIDR.
| >If we don't explicitly require hosts that support SIDR origin
| >validation to support 4-byte ASN, we may also need some direction
| >regarding specific handling for AS23456, such as to always treat
| >as unknown since there is no way to determine validity for the
| >combination of a prefix and a non-unique placeholder ASN (except
| >for local TA), but we don't necessarily want those routes to be
| >treated as invalid.
| 
| 
| I think it's fair to assume that routers supporting origin
| validation also support 4893.

i concur;

---

From: "George, Wes" <[email-masked]>
Date: Wed, 2 Nov 2011 12:38:35 -0400

> From: Randy Bush [mailto:[email-masked]]
>
[WEG] And I agree with the notion that unless specified as one or the other, it means the combination. However, especially in documents dealing with the mechanics of wrangling the bits on the router, that is not an implementation detail I want to leave purely to assumption/interpretation. Doesn't have to be stated and restated ad infinitum, I simply mention the other docs because I wasn't 100% certain where it made the most sense to cover it.

Based on the comments thus far, sounds like the questions are:

Q1) is RFC4893 support a prerequisite for those routers supporting SIDR Origin and Path validation
A: Yes.
I believe that this needs to be explicitly documented, where is the most appropriate location?

Q2) Do we need to incorporate something like: "MUST validate the AS Path _after_ reconstruction using AS4_PATH in the case where routing information comes from a peer which doesn't recognize 4-byte ASNs" as John suggested?

Q3) do we need some sort of language recommending a method to handle AS23456 as an origin (or in a path in the case of BGPSec), especially if it does not coincide with valid AS4_PATH info?
Technically if we're saying 4893 is a prereq, this shouldn't happen, but I could see it as a possible attack vector if we don't explicitly cover it.