Re: ignore max length as an argument of roa_check

2021-03-30 Thread Ondrej Zajicek
On Tue, Mar 30, 2021 at 09:31:32PM +0200, Pier Carlo Chiodi wrote: > Hi, > > > Let's assume an IXP has member A who has customer B, who propagates some > address range. Who is responsible for originating blackhole route for IP > addres from such range propagated to the IXP? > > FWIW, my understan

Re: ignore max length as an argument of roa_check

2021-03-30 Thread Pier Carlo Chiodi
Hi, > Let's assume an IXP has member A who has customer B, who propagates some address range. Who is responsible for originating blackhole route for IP addres from such range propagated to the IXP? FWIW, my understanding of "Local Scope of Blackholes" from https://tools.ietf.org/html/rfc7999#sect

Re: ignore max length as an argument of roa_check

2021-03-30 Thread Douglas Fischer
Hi Ondrej! Your analysis is correct, based on RF7999, considering the Well-Know BlackHole community. But each Autonomous System can have its own Traffic Engineering Communities, including RTBH. This is a very useful resource for some type of reaction to attacks. Let's say that I'm an ISP here in

Re: ignore max length as an argument of roa_check

2021-03-30 Thread Ondrej Zajicek
On Tue, Mar 30, 2021 at 10:04:08AM -0300, Douglas Fischer wrote: > It does make sense! A LOT! > > It is the only way I see that is possible to use RPKI as a source of > information to validate RTBH with the available information existent now. > > P.S.: I even mentioned some about that on SIDROPS

Re: ignore max length as an argument of roa_check

2021-03-30 Thread Mikhail Grishin
Hi, We use this option in production environment (2.0.7 with patches) , started in 2020. Some side effects: Doubled number of tcp sessions with validator, doubled number of roa tables (per each BIRD instanse). Wbr, Milkhail, MSK-IX Douglas Fischer пишет 30.03.2021 16:04: It does make sens

Re: ignore max length as an argument of roa_check

2021-03-30 Thread Douglas Fischer
It does make sense! A LOT! It is the only way I see that is possible to use RPKI as a source of information to validate RTBH with the available information existent now. P.S.: I even mentioned some about that on SIDROPS https://mailarchive.ietf.org/arch/msg/sidrops/vbfKT9yduwAtTNQVBoc5KCRPkmM/ T