Subject: [Sidrops] Block ROA creation for AS23456?

From: Alex Band <[email-masked]>
Date: Thu, 18 May 2017 13:36:45 +0200

Hello SidrOps folks,

One of our members argues that we should be preventing that ROAs are created which authorise AS23456, as referred to in RFC6793 [1]. It would allegedly open up possibilities for abuse. You could make the same argument for several other special registry AS Numbers [2]. 

I’m curious to hear if you think this argument holds any truth, and if we should be thinking about such measures.

Cheers,

Alex Band
Product Manager
RIPE NCC

[1] https://tools.ietf.org/html/rfc6793 <https://tools.ietf.org/html/rfc6793>
[2] https://www.iana.org/assignments/iana-as-numbers-special-registry/iana-as-numbers-special-registry.xhtml <https://www.iana.org/assignments/iana-as-numbers-special-registry/iana-as-numbers-special-registry.xhtml>

---

From: "Roque Gagliano (rogaglia)" <[email-masked]>
Date: Thu, 18 May 2017 12:25:39 +0000

Hi Alex,

Are we talking about the CA should prevent creation and/or the RP should ignore it when validating?

Roque

----- Reply message -----
From: "Alex Band" <[email-masked]>
To: "[email-masked]" <[email-masked]>
Subject: [Sidrops] Block ROA creation for AS23456?
Date: Thu, May 18, 2017 13:42

Hello SidrOps folks,

I'm curious to hear if you think this argument holds any truth, and if we should be thinking about such measures.

Cheers,

Alex Band
Product Manager
RIPE NCC

[1] https://tools.ietf.org/html/rfc6793
[2] https://www.iana.org/assignments/iana-as-numbers-special-registry/iana-as-numbers-special-registry.xhtml

---

From: Alex Band <[email-masked]>
Date: Thu, 18 May 2017 14:31:38 +0200

Hi Roque,

We’re only talking about actively preventing creation of the ROA under the CA.

Cheers,

Alex

> On 18 May 2017, at 14:25, Roque Gagliano (rogaglia) <[email-masked]> wrote:
> 
> Hi Alex,
>

---

From: Job Snijders <[email-masked]>
Date: Thu, 18 May 2017 14:39:59 +0200

On Thu, May 18, 2017 at 01:36:45PM +0200, Alex Band wrote:
> One of our members argues that we should be preventing that ROAs are
> created which authorise AS23456, as referred to in RFC6793 [1]. It
> would allegedly open up possibilities for abuse. You could make the
> same argument for several other special registry AS Numbers [2]. 

One probably has to carefully assess per 'special ASN' whether it makes
sense or not. Preventing that ROAs are created with AS0 would be counter
productive in some scenarios.

> I’m curious to hear if you think this argument holds any truth, and if
> we should be thinking about such measures.

Did the member elaborate on what problem the restriction would resolve?
I'd be interested to learn more about the possibilities for abuse.

Kind regards,

Job

---

From: "Roque Gagliano (rogaglia)" <[email-masked]>
Date: Thu, 18 May 2017 12:51:09 +0000

Hi,

I would be more inclined to let the RP to solve it. Maybe with a switch to “ignore-roas-with-reserved-asn-other-than-0” and let that to be a SP decision to turn it ON/OFF with maybe the default to be to ignore them.

Regards,
Roque

— 
Roque Gagliano
Tail-f Solutions Architect Southern Europe
+41 76 449 8867

On 18/05/17 14:31, "Alex Band" <[email-masked]> wrote:

    Hi Roque,

    Cheers,
    
    Alex

---

From: "Dickinson, Ian" <[email-masked]>
Date: Thu, 18 May 2017 13:38:23 +0000

Inline [Ian]

-----Original Message-----
From: Sidrops [mailto:[email-masked]] On Behalf Of Job Snijders
Sent: 18 May 2017 13:40
To: Alex Band <[email-masked]>
Cc: [email-masked]
Subject: Re: [Sidrops] Block ROA creation for AS23456?

[Ian] Indeed - https://tools.ietf.org/html/rfc6483#section-4 will serve a useful purpose when sufficient filtering support is deployed.

[Ian] Yes. Me too. But I'm certainly not inherently against well defined best practice being developed.

Kind regards,

Job

_______________________________________________
Sidrops mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sidrops
Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky plc and Sky International AG and are used under licence.

Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075) and Sky Subscribers Services Limited (Registration No. 2340150) are direct or indirect subsidiaries of Sky plc (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD.

---

From: "Carlos M. Martinez" <[email-masked]>
Date: Thu, 18 May 2017 10:51:43 -0300

Indeed. This should be an RP’s call to make IMO.

On 18 May 2017, at 9:51, Roque Gagliano (rogaglia) wrote:

> Hi,
>
> I would be more inclined to let the RP to solve it. Maybe with a 
> switch to “ignore-roas-with-reserved-asn-other-than-0” and let 
> that to be a SP decision to turn it ON/OFF with maybe the default to 
> be to ignore them.
>
> Regards,
> Roque
>
>
>
> —
> Roque Gagliano
>     > One of our members argues that we should be preventing that ROAs 
> are created which authorise AS23456, as referred to in RFC6793 [1]. It 
>     > I’m curious to hear if you think this argument holds any 
> truth, and if we should be thinking about such measures.
>     >
>     > Cheers,
>     >
>     > Alex Band
>     > Product Manager
>     > RIPE NCC
>     >
>     > [2] 
> https://www.iana.org/assignments/iana-as-numbers-special-registry/iana-as-numbers-special-registry.xhtml
>
>
>

---

From: Yang Yu <[email-masked]>
Date: Thu, 18 May 2017 13:28:38 -0500

Is there a legitimate use of AS23456 ROA?

 >rfc7115 section 6
Routers that perform RPKI-based origin validation must support Four- 
octet AS Numbers (see [RFC6793]), as, among other things, it is not 
reasonable to generate ROAs for AS 23456.

Yang

On 05/18/2017 08:51 AM, Carlos M. Martinez wrote:
>> switch to “ignore-roas-with-reserved-asn-other-than-0” and let that to 
>> be a SP decision to turn it ON/OFF with maybe the default to be to 
>> ignore them.
>>
>> Regards,
>> Roque
>>
>>
>>
>> —
>> Roque Gagliano
>>     > I’m curious to hear if you think this argument holds any truth, 
>> and if we should be thinking about such measures.
>>     >
>>     > Cheers,
>>     >
>>     > Alex Band
>>     > Product Manager
>>     > RIPE NCC
>>     >

---

From: Randy Bush <[email-masked]>
Date: Fri, 19 May 2017 11:44:16 +0900

> should ignore it when validating?

imiho, ideally, it would be covered in 6811

randy