Subject: Re: [RPSEC] BGP Requirements Draft

From: Sandy Murphy <[email-masked]>
Date: Mon, 26 Sep 2005 10:26:57 -0400 (EDT)

Thought suddenly popped into my head (no comments please on relative
infrequency of this event).

How  do you perform the peering adjacency test if one or more of
the AS_PATH elements is a set?  Like
[A {BC} D]  or
[{AB} {CD} {EF}]?

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Jeffrey Haas <[email-masked]>
Date: Mon, 26 Sep 2005 10:47:27 -0400

> the AS_PATH elements is a set?  Like

You don't.  At least on BGP as it exists today.  This is one of the
big reasons aggregation is problematic.  (As is one of the bgp
ECMP proposals.)

You can still use the elements to check for a plausible path but
at that point you have to guess at adjacencies.

If a proposed solution had separated loop prevention information from
path propagation info, it could look something like this:

10.0/17 B C
10.128/17 D E

Aggregate:
10/16 A [B C D E]; 

	      B C
             /
Update path A
             \
	      D E

If signature chains are in use, B C is one chain (and verifiable)
D E is another chain (similarly verifiable).
A injects a new route (probably out of scope of being verifiable 
against RIR).

It's arguable whether or not the increased state or even keeping
the forked chains around without noting the individual contributors
is actually useful.  It's probably arguable that a better solution
would be to simply inject a new route, claim A as the root for
verifiability and flag it somehow that it's an aggregate.

-- 
Jeff Haas 
NextHop Technologies

---

From: Paul Jakma <[email-masked]>
Date: Mon, 26 Sep 2005 15:48:35 +0100 (IST)

> the AS_PATH elements is a set?  Like

Work out all the possible paths and verify each. Whether to reject 
based on whether there are no plausible paths or whether any path is 
implausible, i dont.

A-B-D
A-C-D

The latter (is impossible with a leading sequence, call it X) you 
wouldn't see today, I'm not sure what it would represent, in the 
broadest possibility:

X-A-C-E
X-A-C-F
X-A-D-E
X-A-D-F
X-B-C-E
X-B-C-F
X-B-D-E
X-B-D-F

However, the only application of AS_SET's out there today is 
aggregation, in which case you would get (say):

 	A-B-C-{E,F}

And you would have an AGGREGATOR AS to validate the NLRI against. Eg, 
if the aggregator is C, one presumably could instead validate whether 
it is plausible for C to originate the given aggregate for path 
A-B-C.

More to the point, how would AS_PATH signing cope? :)

regards,
-- 
Paul Jakma	[email-masked]	[email-masked]	Key ID: 64A2FF6A
Fortune:
Marge, what's wrong?  Are you hungry?  Sleepy?  Gassy?  Gassy?  Is it
gas?  It's gas, isn't it?

 		-- Homer Simpson
 		   Fear of Flying

---

From: Jeffrey Haas <[email-masked]>
Date: Mon, 26 Sep 2005 11:30:12 -0400

On Mon, Sep 26, 2005 at 03:48:35PM +0100, Paul Jakma wrote:
> And you would have an AGGREGATOR AS to validate the NLRI against.

Which will be overwritten at next aggregation, if it was ever attached. :-)

-- 
Jeff Haas 
NextHop Technologies

---

From: Paul Jakma <[email-masked]>
Date: Mon, 26 Sep 2005 16:38:46 +0100 (IST)

On Mon, 26 Sep 2005, Jeffrey Haas wrote:

> Which will be overwritten at next aggregation,

Ah, hang on: must never aggregate an aggregate ;).

> if it was ever attached. :-)

Then it can't be validated. Tough luck for that route, if your 
security policy is to ignore routes which can not be validated, you 
ignore it.

regards,
-- 
Paul Jakma	[email-masked]	[email-masked]	Key ID: 64A2FF6A
Fortune:
Law stands mute in the midst of arms.
 		-- Marcus Tullius Cicero

---

From: Paul Jakma <[email-masked]>
Date: Mon, 26 Sep 2005 17:18:52 +0100 (IST)

On Mon, 26 Sep 2005, Jeffrey Haas wrote:

> On Mon, Sep 26, 2005 at 04:38:46PM +0100, Paul Jakma wrote:
> Why not?

Ah, oops. I misread. They can be aggregated.

You'd need an additive mechanism to record the aggregator information 
in that, if you wished to be able validate the origination of the 
aggregate. Or, such paths simply could not be validated.

regards,
-- 
Paul Jakma	[email-masked]	[email-masked]	Key ID: 64A2FF6A
Fortune:
He that breaks a thing to find out what it is has left the path of wisdom.
 		-- J.R.R. Tolkien

---

From: Jeffrey Haas <[email-masked]>
Date: Mon, 26 Sep 2005 12:12:09 -0400

Why not?

-- 
Jeff Haas 
NextHop Technologies