Geoff: The following wording is in both -07 and -08 versions: "If the final path segment of the AS_PATH is of type AS_SET, indicating that the route is an aggregate, then the origin AS is taken as the AS component of the AGGREGATOR attribute [RFC4271], if present."
In light of all our discussions, why not replace the above wording with: "If the final path segment of the AS_PATH is of type AS_SET, indicating that the route is an aggregate, then the route's origin AS cannot be determined." That would clearly avoid the new attack vector on normal prefixes that I have explained before. There is no point in allowing an additional new type of attack possibility on 300K or more normal prefixes (i.e., those originated without AS_SET and proxy aggregation) in order to somehow cater to miniscule prefix-updates with AS_SET. Sriram > -----Original Message----- > From: Geoff Huston [mailto:[email protected]] > Sent: Thursday, October 28, 2010 3:52 PM > To: Sriram, Kotikalapudi > Cc: Christopher Morrow; Sandra Murphy; [email protected] wg > Subject: Re: [sidr] WG LC request for draft-ietf-sidr-roa-validation-08.txt > > Hi Srinam, > > I don't believe that wording is appropriate for an RFC. The wording that is > consistent with > the current BGP spec is actually in the -07 version. > > regards, > > Geoff > > On 29/10/2010, at 3:34 AM, Sriram, Kotikalapudi wrote: > > > Geoff: > > > > Sorry about the previous email with an incomplete message. > > I hit some key accidentally and off it went :( > > > > As you know, the following email messages between you, Chris and > > myself are relevant to your 08-rev as well. > > > > http://www.ietf.org/mail-archive/web/sidr/current/msg02020.html > > http://www.ietf.org/mail-archive/web/sidr/current/msg02017.html > > http://www.ietf.org/mail-archive/web/sidr/current/msg02015.html > > > > Consistent with the above messages, > > I would like to suggest removing the algorithmic aspects > > of how to handle updates with AS_SET. > > Instead wording along the lines (you may fine tune the wording) > > should be included: > > It is recognized that in a very small percentage of updates, > > proxy aggregation with inclusion AS_SET attribute is found. > > There is a proposal under consideration in the IDR WG > > to deprecate AS_SETs. Description of the part of the algorithm > > that deals with origin validation of updates with AS_SET is deferred > > pending outcome of the IDR WG action on this issue. > > > > Sriram > > _______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
