Re: [db-wg] proposal: disallow creation of new non-hierarchically named AS-SET objects

16 Nov 2022

      ...
Limiting database updates
to only accounts associated with LIR sounds reasonable.
I cannot support this unless it is limited to AS-SET and similar; i for example hand out IPv6 prefixes to endusers and that would be impossible if they are unable to create MNT/Person/ORGs. 

I support this in general for AS-SET which makes no sense to have access to unless you have an ASN, but the startup maintainer process should stay the same.
Same for ORGs - to request ASNs the enduser needs an ORG and i as LIR should not have to create that or even have MNT-BY on it.

—
William

Sent from my iPhone
...
On 16.11.2022, at 12:00, db-wg-request@ripe.net wrote:
Send db-wg mailing list submissions to
   db-wg@ripe.net
To subscribe or unsubscribe via the World Wide Web, visit
   https://lists.ripe.net/mailman/listinfo/db-wg
or, via email, send a message with subject or body 'help' to
   db-wg-request@ripe.net
You can reach the person managing the list at
   db-wg-owner@ripe.net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of db-wg digest..."
Today's Topics:
1. Re: proposal: disallow creation of new non-hierarchically
     named AS-SET objects (Pierfrancesco Caci)
  2. Re: proposal: disallow creation of new non-hierarchically
     named AS-SET objects (Yang Yu)
  3. Re: proposal: disallow creation of new non-hierarchically
     named AS-SET objects (Teun Vink)
----------------------------------------------------------------------
Message: 1
Date: Wed, 16 Nov 2022 10:48:18 +0100
From: Pierfrancesco Caci <pcaci@pccwglobal.com>
To: Job Snijders via db-wg <db-wg@ripe.net>
Subject: Re: [db-wg] proposal: disallow creation of new
   non-hierarchically named AS-SET objects
Message-ID: <20221116104818.25bba55e@lavoro.tippete.net>
Content-Type: text/plain; charset=US-ASCII
Hi 
Speaking as be.ccafrique and uk.pccwg-uk I support Job's proposal.
Pf
...
On Mon, 14 Nov 2022 17:41:16 +0000
Job Snijders via db-wg <db-wg@ripe.net> wrote:
CAUTION:  External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.
Dear DB-WG,
Speaking in individual capacity.
In RFC 2622 section 5 specifies the naming convention for AS-SET
objects. https://www.rfc-editor.org/rfc/rfc2622#section-5.1
There basically are two styles:
* "short" (example: AS-SNIJDERS)
   * "hierarchical" (example: AS15562:AS-SNIJDERS)
Problem statement
=================
In recent weeks a number of hypergiant cloud providers have faced the
thorny effects of adversarial AS-SET object naming collisions between
IRR databases.
An example of this phenomenon is the existence of AS-AMAZON in both RADB
and RIPE. According to https://www.peeringdb.com/net/1418 the RADB copy
of the object is the the correct one and populated with a number of
members entries. The RIPE one is empty, and not under control of Amazon.
The existence of the AS-AMAZON object in the RIPE database might cause
some operators to inadvertently apply empty prefix-filters to EBGP
sessions which in turn causes various problems.
It seems Amazon has no recourse to get the AS-AMAZON object removed from
the RIPE database; because the existence of that object in the RIPE
database does not violate any policies (as far as I know). But perhaps,
going forward, this community can do a little bit more to help prevent
similar situations from happening to others.
Solution proposal
=================
I think the solution is to - GOING FORWARD - disallow creation of new
AS-SET objects which follow the 'short' naming style.
The advantage of hierarchical naming is that the existing authorization
rules as applied by the RIPE Whois Server database engine do a decent
job of protecting/separating namespaces. 'Grandfathering' existing
short-named objects ensures that implementation of this solution
proposal causes minimal (if any) disruption to existing workflows.
The RIPE database engine blocking creation of short-named AS-SETs might
help nudge the industry towards making hierarchical naming the norm.
Related work
============
Related work throughout the registry industry: IRRd version 4 forces new
AS-SET objects to be structured hierarchically:
https://github.com/irrdnet/irrd/issues/408
Kind regards,
Job
--
To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/db-wg
-- 
Pierfrancesco Caci <pcaci@pccwglobal.com> 
VP Network & Security Architecture - AS3491 Peering Coordinator
Tel.: +39 0287 049 871
www.pccwglobal.com
This message (and any attachments) may contain information that is 
confidential, proprietary, privileged or otherwise protected by law.
The message is intended solely for the named addressee (or a person
responsible for delivering it to the addressee). If you are not the
intended recipient of this message, you are not authorized to read,
print, retain, copy or disseminate this message or any part of it. If
you have received this message in error, please destroy the message or
delete it from your system immediately and notify the sender. PCCW
Global cannot guarantee that this e-mail is secure, error-free and/or
virus-free as e-mail messages could be intercepted, altered, corrupted,
lost, delayed or become incomplete and/or infected by viruses in the
course of their transmission. PCCW Global and the sender therefore do
not accept liability for any loss or damage arising from any errors or
omissions in the contents of this e-mail.
------------------------------
Message: 2
Date: Wed, 16 Nov 2022 04:06:57 -0600
From: Yang Yu <yang.yu.list@gmail.com>
To: denis walker <ripedenis@gmail.com>
Cc: Job Snijders <job@sobornost.net>, db-wg@ripe.net
Subject: Re: [db-wg] proposal: disallow creation of new
   non-hierarchically named AS-SET objects
Message-ID:
   <CAFwKRnR1U7X99nXsE_pqk982Hf4BXOZ9RoV+Aa7Y4C-Zyu=4fA@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
I support this proposal.
...
It seems Amazon has no recourse to get the AS-AMAZON object removed from
the RIPE database; because the existence of that object in the RIPE
database does not violate any policies (as far as I know).
Also ran into this issue and would like to see policy support to
handle this kind of abuse.
...
On Mon, Nov 14, 2022 at 3:08 PM denis walker via db-wg <db-wg@ripe.net> wrote:
Interesting timing. I was about to make the same suggestion but for a
different reason...accountability. Currently ANYONE can create a set
object in the RIPE Database. You can be completely anonymous, not a
member or LIR, hold no resources. All you need to do is create a ROLE,
MNTNER and set object.
Anyone with an email can make a RIPE account and start creating
objects in RIPE database. In other registries there are usually some
safeguards on user / mntner object creation. Limiting database updates
to only accounts associated with LIR sounds reasonable.
Yang
------------------------------
Message: 3
Date: Wed, 16 Nov 2022 11:19:17 +0100
From: "Teun Vink" <teun@bit.nl>
To: "Job Snijders" <job@sobornost.net>
Cc: db-wg@ripe.net
Subject: Re: [db-wg] proposal: disallow creation of new
   non-hierarchically named AS-SET objects
Message-ID: <A2DF4E9C-3BA7-415C-8C0A-FDBE11BF9736@bit.nl>
Content-Type: text/plain
Hi all,
On 14 Nov 2022, at 18:41, Job Snijders via db-wg wrote:
[...]
...
Solution proposal
=================
I think the solution is to - GOING FORWARD - disallow creation of new
AS-SET objects which follow the 'short' naming style.
I support this proposal.
Kind regards,
-- 
Teun Vink
BIT           | teun@bit.nl     | +31 318 648 688
KvK: 09090351 | GPG: 0xFC8B25D6 | RIPE: TEUN-RIPE
------------------------------
Subject: Digest Footer
--
To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/db-wg
------------------------------
End of db-wg Digest, Vol 135, Issue 8
*************************************

William Weber

tags

participants (1)