< pedantry alert >
> I am not knowledgable of every facet of rpki, but I thought that it was
> possible to express /length-or-longer? But Randy has already pointed
> that rpki doesnt cover communities; to middle men can alter it.
rpki does not cover anything in a bgp announcement. it is a distributed
database of address space ownership and authorization to announce (and
some other cruft).
rpki-based origin authentication doe not help here because the attacker
requesting my prefix be blackholed with merely forge my AS on the path.
rpki-based path validation, one possible future, would plug the forged
origin hole. as you say, the current drafts do not sign over
communities.
< /pedantry > < rant >
this proposal issues nuclear weapons to children who have repeatedly
shown an inability to reliably do the most basic hygenic practice.
the combination of being well-known and transitive means attack
amelioration relies on universal rigorous filtering which has failed
time and again.
randy
route-views>sh ip bg 0.0.0.0
BGP routing table entry for 0.0.0.0/0, version 37806771
Paths: (2 available, best #1, table default, RIB-failure(17))
Not advertised to any peer
Refresh Epoch 1
58511
103.247.3.45 from 103.247.3.45 (103.247.3.45)
Origin IGP, metric 0, localpref 100, valid, external, best
rx pathid: 0, tx pathid: 0x0
Refresh Epoch 1
20771 3356
80.241.176.31 from 80.241.176.31 (80.241.176.30)
Origin IGP, localpref 100, valid, external
rx pathid: 0, tx pathid: 0
route-views>sh ip bg 10.0.0.0
BGP routing table entry for 0.0.0.0/0, version 37806771
Paths: (2 available, best #1, table default, RIB-failure(17))
Not advertised to any peer
Refresh Epoch 1
58511
103.247.3.45 from 103.247.3.45 (103.247.3.45)
Origin IGP, metric 0, localpref 100, valid, external, best
rx pathid: 0, tx pathid: 0x0
Refresh Epoch 1
20771 3356
80.241.176.31 from 80.241.176.31 (80.241.176.30)
Origin IGP, localpref 100, valid, external
rx pathid: 0, tx pathid: 0
_______________________________________________
GROW mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/grow
