Last Call - creation of new out of region ROUTE(6) objects
Colleagues Plans to implement the solution for NWI-5 by dropping the auth requirement from ASNs in ROUTE(6) object creation and marking existing out of region ROUTE(6) objects in the database with a different source tag are progressing. In December I asked if we should continue to allow the creation of new ROUTE(6) objects in the RIPE Database (with the new source tag) for non RIPE address space. There were a few comments supporting the view NOT to allow any new object creations. There were no comments supporting the continued creation of any new objects. During the earlier, lengthy discussion on NWI-5 quite a few people supported the use of the RIPE Database for ROUTE(6) objects for non RIPE address space. With the plan to drop the ASN auth requirement are those people satisfied that we no longer need to create these ROUTE(6) objects in the RIPE Database? So basically I am making a last call to see if anyone still feels there is any need to allow creation of any new ROUTE(6) objects in the RIPE Database for non RIPE address space? cheersdenisco-chair DB WG
Dear Denis, On Wed, Jan 10, 2018 at 11:21:44PM +0000, denis walker via db-wg wrote:
In December I asked if we should continue to allow the creation of new ROUTE(6) objects in the RIPE Database (with the new source tag) for non RIPE address space. There were a few comments supporting the view NOT to allow any new object creations. There were no comments supporting the continued creation of any new objects. During the earlier, lengthy discussion on NWI-5 quite a few people supported the use of the RIPE Database for ROUTE(6) objects for non RIPE address space. With the plan to drop the ASN auth requirement are those people satisfied that we no longer need to create these ROUTE(6) objects in the RIPE Database?
So basically I am making a last call to see if anyone still feels there is any need to allow creation of any new ROUTE(6) objects in the RIPE Database for non RIPE address space?
I don't think there is a good case to continue to allow the creation of new ROUTE(6) objects in the RIPE DB for non RIPE address space. I'm seeing quite some abuse of this 'feature', where spammers/hijackers register out-of-region prefixes to sneak them into people's prefix-list filters. It would be good if that hole can be plugged. Separately, a study should be done on how to deal with the existing non-RIPE-managed ROUTE(6) objects in the DB. Maybe some cleanup can be done for at least for a subset of those objects. Kind regards, Job
Hello Denis, On Thu, 2018-01-11 at 00:03 +0000, Job Snijders wrote:
I don't think there is a good case to continue to allow the creation of new ROUTE(6) objects in the RIPE DB for non RIPE address space.
I'm seeing quite some abuse of this 'feature', where spammers/hijackers register out-of-region prefixes to sneak them into people's prefix-list filters. It would be good if that hole can be plugged.
Separately, a study should be done on how to deal with the existing non-RIPE-managed ROUTE(6) objects in the DB. Maybe some cleanup can be done for at least for a subset of those objects.
I fully agree with Job's position regarding the foreign route(6) objects. I think that we should also do a cleanup the existing objects too. Kind regards, -- Clément Cavadore
I do not believe any future ROUTE and ROUTE6 object creation should be permitted routinely, for non-RIPE address space, inside the RIPE NCC routing registry. -George On Thu, Jan 11, 2018 at 9:21 AM, denis walker via db-wg <db-wg@ripe.net> wrote:
Colleagues
Plans to implement the solution for NWI-5 by dropping the auth requirement from ASNs in ROUTE(6) object creation and marking existing out of region ROUTE(6) objects in the database with a different source tag are progressing.
In December I asked if we should continue to allow the creation of new ROUTE(6) objects in the RIPE Database (with the new source tag) for non RIPE address space.
There were a few comments supporting the view NOT to allow any new object creations. There were no comments supporting the continued creation of any new objects.
During the earlier, lengthy discussion on NWI-5 quite a few people supported the use of the RIPE Database for ROUTE(6) objects for non RIPE address space. With the plan to drop the ASN auth requirement are those people satisfied that we no longer need to create these ROUTE(6) objects in the RIPE Database?
So basically I am making a last call to see if anyone still feels there is any need to allow creation of any new ROUTE(6) objects in the RIPE Database for non RIPE address space?
cheers denis co-chair DB WG
In message <CAKr6gn3ZUQ-Rcix4jAxiiO5ntenEWwNtkFZR2-2VRgc5WjcSbQ@mail.gmail.com> George Michaelson <ggm@algebras.org> wrote:
I do not believe any future ROUTE and ROUTE6 object creation should be permitted routinely, for non-RIPE address space, inside the RIPE NCC routing registry.
I would go futher than that and say that it was a colossal error in judgement to have EVER allowed any of this nonsense. I have a massive quantity of never before revealed evidence showing just how prodigiously various crooks and spammers have abused this "feature". I will share that, if there is anyone on these lists who is as yet unconvinced of either the ability or willingness of various crooks and spammers to drive the proverbial truck through this massive, gaping and absurd security hole, mostly with respect to IPv4, but also, as has been described by others, with respect to IPv6 as well. It is well past time for RIPE to stop allowing any random, arbitrary, and unidentified orangutan with a keyboard to determine what routes are placed into the global routing table. Regards, rfg
Hi Ronald I understand your viewpoint, but I think it is a bit harsh to criticise the judgement of the early developers of the routing system. As Sandra explained in this posthttps://www.ripe.net/ripe/mail/archives/db-wg/2017-October/005707.html the early model was based on ASs. Then as the reliance moved more towards IPs the systems and procedures were modified to encompass the changing model. And also not all RIRs operated an IRR for many years so the ROUTE objects had to go somewhere. And Internet abuse may not have been much of a concern during the development of the early routing system and later modifications. It is generally accepted now that there are serious concerns with the current model and we are all working towards resolving these issues. cheersdenisco-chair DB WG From: Ronald F. Guilmette via db-wg <db-wg@ripe.net> To: Database WG <db-wg@ripe.net>; RIPE Routing Working Group <routing-wg@ripe.net> Sent: Thursday, 11 January 2018, 2:23 Subject: Re: [db-wg] [routing-wg] Last Call - creation of new out of region ROUTE(6) objects In message <CAKr6gn3ZUQ-Rcix4jAxiiO5ntenEWwNtkFZR2-2VRgc5WjcSbQ@mail.gmail.com> George Michaelson <ggm@algebras.org> wrote:
I do not believe any future ROUTE and ROUTE6 object creation should be permitted routinely, for non-RIPE address space, inside the RIPE NCC routing registry.
I would go futher than that and say that it was a colossal error in judgement to have EVER allowed any of this nonsense. I have a massive quantity of never before revealed evidence showing just how prodigiously various crooks and spammers have abused this "feature". I will share that, if there is anyone on these lists who is as yet unconvinced of either the ability or willingness of various crooks and spammers to drive the proverbial truck through this massive, gaping and absurd security hole, mostly with respect to IPv4, but also, as has been described by others, with respect to IPv6 as well. It is well past time for RIPE to stop allowing any random, arbitrary, and unidentified orangutan with a keyboard to determine what routes are placed into the global routing table. Regards, rfg
In message <698723772.1802950.1515672632190@mail.yahoo.com>, denis walker <ripedenis@yahoo.co.uk> wrote:
I understand your viewpoint, but I think it is a bit harsh to criticise the judgement of the early developers of the routing system. As Sandra explain ed in this posthttps://www.ripe.net/ripe/mail/archives/db-wg/2017-October/0 05707.html the early model was based on ASs. Then as the reliance moved more towards I Ps the systems and procedures were modified to encompass the changing model . And also not all RIRs operated an IRR for many years so the ROUTE objects had to go somewhere. And Internet abuse may not have been much of a concer n during the development of the early routing system and later modifications.
It is generally accepted now that there are serious concerns with the curre nt model and we are all working towards resolving these issues.
To the extent that my comments may have appeared harsh, I do apologize. However I am not sure whether you and I are even talking about the same thing, as opposed to talking past one another. So let me endeavor to be clear. I don't pretend to understand very much about the routing system, or about RIPE's IRR, or the numerous foibles and complexities associated therewith. However I'm not sure that it takes a PhD in routing to grasp the fundamental problem here. As it has been explained to me, literally anybody can create a login account with/for RIPE and can then set about to create and enter whatever routes he or she desires and all of those will thenceforth be present in the RIPE data base... a now unreliable data base that, sadly, zillions of parties around the world are currently using to make decisions about route filtering. I feel sure that it can be argued... and that it most probably has been argued, probably at length... who exactly should be empowered to create specific route objects in the data base. Should it be the AS registrant, the registrant of the affected IP range, some combination or permutation thereof? But from my perspective all such discusssions amount to arguing over the proper placement of the deck chairs on the Titanic. Quite simply, there are five RIRs. Each of those has a set of dues paying members. Each of those could be, and I would argue, should be given some sort of a magic cookie... a cookie of a kind that non-dues-payers would never have. Only a party in possession of such a cookie should be permitted to enter route objects into the RIPE data base. This would at least keep the random drive-by criminals out, which would be a dramatic improvement over the current status quo, as I understand it. Regards, rfg
participants (5)
-
Clement Cavadore -
denis walker -
George Michaelson -
Job Snijders -
Ronald F. Guilmette