Hi, On Mon, Oct 14, 2002 at 10:50:00AM +0200, Shane Kerr wrote:
Shane, your explanation is confusing me. There are other examples with "same route, different origin AS" in the RIPE-DB (check 194.97.0.0/16), which is sometimes necessary while migrating a network to a new origin AS.
So the database should permit entry of this *new* object, instead of checking for modification permission on the *existing* object.
We currently implement RPSS, as best we understand it.
I won't claim that I understand RPSS, but I claim to have observed actual practice :-)
I think the idea is that if there is a route object in the database, then it's creation has been authorised, and that it represents an actual route announcement. If somebody else starts advertising either the same IP space with a different origin, or a more specific route then it will affect traffic to the existing origin, so they should approve the creation.
Given this explanation, do you still think that the database should permit the creation of the new object?
Yes. I think that the creation of the new route: should NOT check the authorization on any existing route: objects, but should check mnt-routes: on the corresponding/encompassing inetnum: and on the AS-Object. "Unauthorized routes" should be sufficiently prevented by the inetnum: check. Yes, I am aware that this doesn't work for inetnum:s registered in a different database, unless distributed rps-auth is implemented. I do not have a proposal how to solve this in the mean time. [..]
The reality is that route checking is not 100% clear in the RPSS document, RFC 2725. For instance, when creating a route it is possible to have multiple parent routes with the same prefix, and it is not specified what the behaviour is. I believe it was decided not to look at this too carefully because some people in the IETF have decided that advertising the same prefix from multiple origin AS numbers is bad, and the authors of the document wanted to avoid a flame-war or even having the document rejected over this issue.
I agree with them - I think multiple different origin ASes *are* bad. Nevertheless migration of routes happen (think of "address space already allocated, AS number still in queue" or "address space already being used, but BGP not yet fully working at customer's site"). Sometimes, there might be other good reasons for multiple route: objects. Gert Doering -- NetMaster -- Total number of prefixes smaller than registry allocations: 48282 (47686) SpaceNet AG Mail: netmaster@Space.Net Joseph-Dollinger-Bogen 14 Tel : +49-89-32356-0 80807 Muenchen Fax : +49-89-32356-299