Subject: [sidr] Suresh Krishnan's No Objection on draft-ietf-sidr-rpki-rtr-rfc6810-bis-08: (with COMMENT)

From: "Suresh Krishnan" <[email-masked]>
Date: Tue, 14 Feb 2017 19:34:04 -0800

Suresh Krishnan has entered the following ballot position for
draft-ietf-sidr-rpki-rtr-rfc6810-bis-08: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-rtr-rfc6810-bis/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I have read through the document and I still was unable to figure out
what the Max Len field for the IPvX PDUs is being used for. It is defined
as 

Max Length:  An 8-bit unsigned integer denoting the longest prefix
allowed by the Prefix element.

but I was not able to find any processing rules for this. i.e. what it is
actually used for. An example would greatly help.

---

From: Rob Austein <[email-masked]>
Date: Tue, 14 Feb 2017 22:52:34 -0500

Verbatim copy of the maxLength field from RFC 6482, q.v.
Unchanged from RFC 6810, use explained (tersely) in RFC 6811.

Perhaps references to RFC 6482 and 6811 would be appropriate?

---

From: Randy Bush <[email-masked]>
Date: Wed, 15 Feb 2017 12:53:25 +0900

> actually used for. An example would greatly help.

wrong document.  6810 does not define prefix or prefix len either :)

you want 6482 3.3, which i do not think you want to repro here, even if
tersified

   Within a ROAIPAddress structure, the addresses field represents
   prefixes as a sequence of type IPAddress.  (See [RFC3779] for more
   details).  If present, the maxLength MUST be an integer greater than
   or equal to the length of the accompanying prefix, and less than or
   equal to the length (in bits) of an IP address in the address family
   (32 for IPv4 and 128 for IPv6).  When present, the maxLength
   specifies the maximum length of the IP address prefix that the AS is
   authorized to advertise.  (For example, if the IP address prefix is
   203.0.113/24 and the maxLength is 26, the AS is authorized to
   advertise any more specific prefix with a maximum length of 26.  In
   this example, the AS would be authorized to advertise 203.0.113/24,
   203.0.113.128/25, or 203.0.113.0/25, but not 203.0.113.0/27.)  When
   the maxLength is not present, the AS is only authorized to advertise
   the exact prefix specified in the ROA.

---

From: Randy Bush <[email-masked]>
Date: Wed, 15 Feb 2017 12:56:09 +0900

> Perhaps references to RFC 6482 and 6811 would be appropriate?

imiho refs for all the fields will be overwhelming.

---

From: Suresh Krishnan <[email-masked]>
Date: Wed, 15 Feb 2017 04:07:05 +0000

Hi Rob and Randy,
  Thanks. The reference to RFC6482 clarified the field for me. I leave it to your discretion on whether you want to add a reference or not, but I personally found it extremely helpful. As a followup, why is there no associated error checking for the Max Length field in the IPvX PDUs (to ensure the MUST NOT be less than Prefix Length)?

Regards
Suresh

> On Feb 14, 2017, at 10:52 PM, Rob Austein <[email-masked]> wrote:
>

---

From: Randy Bush <[email-masked]>
Date: Wed, 15 Feb 2017 13:15:31 +0900

> why is there no associated error checking for the Max Length field in
> the IPvX PDUs

it is assumed any error checking was done *before* they are sent to the
router.  a major goal of this protocol is to relieve the router of any
load.  so, if field consistency is to be done, it should be in the
protocols at the rpki level, e.g. at the latest when the cache receives
and validates the data.

randy

---

From: Suresh Krishnan <[email-masked]>
Date: Thu, 16 Feb 2017 04:57:36 +0000

> On Feb 14, 2017, at 11:15 PM, Randy Bush <[email-masked]> wrote:
> 

OK. Sounds good to me.

Thanks
Suresh