Subject: Re: [sidr] revision to draft-ietf-sidr-roa-validation

From: Terry Manderson <[email-masked]>
Date: Sun, 2 Aug 2009 02:08:10 -0700

On 1/08/09 8:36 AM, "Geoff Huston" <[email-masked]> wrote:

> "ends"?
> 
> perhaps an example may help here
> 
> A ROA is issued for 203.0.113.0/24, maxlength 25, oroginating AS 65534
> 
> using only this ROA, and nothing else, the revised draft would
> generate the following outcomes:
> 
> 203.0.113.0/24, originated by AS 65534 -> "valid"
> 203.0.113.128/25, originated by AS 65534 -> "valid"
> 
> 203.0.113.0/26, originated by AS 65534 -> "invalid" (more specific
> than max length permits)

Yes, the maxLength essentially stipulates that no more specific prefixes can
possibly ever be valid in this example, irrespective of AS.

So this implies to me that an LIR who issues a ROA for their aggregate
prefix, immediately invalidates all routes of its multi-homed customers if
those customers allocated from the lir prefix and do not (yet) participate
in RPKI.

>From your example above, the customer, with a different AS:
 
203.0.113.0/26, originated by AS 65520 -> "invalid"

>> 
>> 2) The SIDR-WG is following the paradigm of 'make before break'?
>> (yes/no)
> 
> 
> WG co-chair hat off - still.
> 
> Do IETF WGs "follow" paradigms? How are such paradigm's "adopted" to
> follow in the first place? Are such "paradigms" intended to act as
> strictly applied technical constraints? Where are the paradigm police
> to enforce that such paradigms are obeyed?

I think that is extrapolating my question in a very different direction.
Perhaps my question could be rephrased. In past 'make before break' has been
discussed in this working group and on the mailing list, and several times
participants have used that as an adjudication factor in thinking through
the issues to support or rebuff options. My understanding is that currently
the WG documents that highlight the overall behaviour of the SIDR posit a
make before break approach. Am I incorrect in that 'reading' ..

Terry

---

From: Rob Austein <[email-masked]>
Date: Mon, 03 Aug 2009 11:46:28 -0400

At Fri, 31 Jul 2009 07:57:56 -0700, Terry Manderson wrote:
> 
> May I ask for clarification on two items, just to be sure I have it clear?
> 
> 1) The ROA ends with an implicit deny for any more specific prefix not
> encapsulated by maxLength. (ie stop more specific hijack)? (yes/no)

I think I see your difficulty.  ROAs have maxlen, certs don't.

If any ROAs exist with certs that cover a particular prefix, that
prefix is routable if and only if one or more of the ROAs in question
covers the prefix.

That is: in the case of a prefix longer than maxlen, an entity capable
of issuing ROAs for the longer prefix demonstrably exists, but has not
chosen to issue said ROAs.  So this is either an oops or an attack.

See Randy's slide pack for examples of the various permutations.

> 2) The SIDR-WG is following the paradigm of 'make before break'? (yes/no)

Can't speak for the WG.  At least one implementor is trying to follow
make-before-break rules when performing operations that could
invalidate ROAs, because Mr. Route Flap is not your friend.