Regarding the issue of empty AS-SET in databases
As the administrator of AKIX , we have observed a recurring issue where newly joined members frequently submit AS-SET objects without populating the mandatory members attribute in IRR databases. From both operational and RPSL (Routing Policy Specification Language) specification perspectives, an AS-SET containing no members represents an invalid configuration, as it fundamentally defeats its purpose of aggregating Autonomous Systems (AS) for routing policy management. We formally propose that IRR database maintainers implement mandatory validation during AS-SET creation to enforce: 1. Require at minimum one valid AS number in the members field 2. Reject AS-SET submissions containing empty/null members attributes 3. Provide clear error messaging specifying the validation requirements This technical enforcement would align with RFC 2725 (Routing Policy System Security) recommendations while significantly improving routing registry data quality and operational reliability for Internet Exchange ecosystems.
liu haoran wrote on 13/05/2025 17:48:
As the administrator of AKIX , we have observed a recurring issue where newly joined members frequently submit AS-SET objects without populating the mandatory members attribute in IRR databases. From both operational and RPSL (Routing Policy Specification Language) specification perspectives, an AS-SET containing no members represents an invalid configuration, as it fundamentally defeats its purpose of aggregating Autonomous Systems (AS) for routing policy management.
RPSL is based on set theory, where an empty set is completely ok. If someone has configured an as-set to be empty when it ought to have included some elements, then this is a configuration error on the part of the user, not a problem with the rpsl specification. You will need to engage with your members to help them understand how this component of RPSL works. Nick
Hello Liu, I have some clarifying questions, see below.
On 13 May 2025, at 17:48, liu haoran <qq593277393@outlook.com> wrote:
As the administrator of AKIX , we have observed a recurring issue where newly joined members frequently submit AS-SET objects without populating the mandatory members attribute in IRR databases. From both operational and RPSL (Routing Policy Specification Language) specification perspectives, an AS-SET containing no members represents an invalid configuration, as it fundamentally defeats its purpose of aggregating Autonomous Systems (AS) for routing policy management.
I confirmed that an as-set can be created in the RIPE database without any members: attribute. Approximately 2,000 of nearly 27,000 total as-sets do not have any members: attribute. If a members: attribute is supplied, the ASN or AS-SET value does not need to exist. Should we also validate either the ASN or AS-SET value?
We formally propose that IRR database maintainers implement mandatory validation during AS-SET creation to enforce: 1. Require at minimum one valid AS number in the members field
Since only hierarchical AS-SET objects can now be created in the RIPE database, if a parent AS-SET contains a "members:" attribute, can that allow the child to have no (additional) members?
2. Reject AS-SET submissions containing empty/null members attributes
This is already the case (if a members: attribute is specified, it cannot be empty or null).
3. Provide clear error messaging specifying the validation requirements This technical enforcement would align with RFC 2725 (Routing Policy System Security) recommendations while significantly improving routing registry data quality and operational reliability for Internet Exchange ecosystems.
RFC 2622 defines the as-set "members:" attribute to be type "optional, multi-valued", does RFC 2725 supercede this? https://datatracker.ietf.org/doc/html/rfc2622#section-5.1 Regards, Ed Shryane RIPE NCC
Dear Ed Shryane, Thank you for your questions. Regarding the validation requirements for AS-SET objects, I would like to provide the following clarifications: Parent-Child AS-SET Hierarchy: If a parent AS-SET includes a "members:" attribute, this does not exempt the child AS-SET from its own member requirements. Each AS-SET should independently fulfill its intended purpose, even within a hierarchical structure. A child AS-SET must still have explicitly defined members to ensure operational validity. RFC 2725 vs. RFC 2622: RFC 2622 explicitly defines the "members:" attribute of an AS-SET as "optional, multi-valued." While RFC 2725 focuses on routing policy system security, it does not directly override RFC 2622’s definition. RFC 2725 provides security recommendations but does not replace the foundational RPSL object specifications in RFC 2622. Validation of ASN/AS-SET Values: From a data integrity perspective, validating referenced ASNs or AS-SETs is beneficial. However, there may be use cases where referencing objects not yet created (e.g., pre-configurations) could serve specific operational needs. This becomes a policy decision, balancing flexibility with data quality. Empty AS-SET Observations: The 2,000 AS-SETs lacking members highlight a significant data quality issue. While technically compliant with RFC 2622, these empty AS-SETs serve no practical purpose and may lead to routing policy management challenges. Revised Proposal: To reduce empty AS-SETs at the source, we recommend modifying terminology and validation workflows to emphasize that AS-SETs must include members . Specifically: Retain the warning and secondary confirmation mechanism for submissions lacking members: Warning: "You are creating an AS-SET with no members Are you sure you want to proceed?" Secondary prompt: "Confirm creation of empty AS-SET (not recommended)." Best regards, HaoRan Liu Akaere NetWorks ________________________________ 发件人: liu haoran <qq593277393@outlook.com> 发送时间: 2025年5月14日 0:48 收件人: db-wg@ripe.net <db-wg@ripe.net> 主题: [db-wg] Regarding the issue of empty AS-SET in databases As the administrator of AKIX , we have observed a recurring issue where newly joined members frequently submit AS-SET objects without populating the mandatory members attribute in IRR databases. From both operational and RPSL (Routing Policy Specification Language) specification perspectives, an AS-SET containing no members represents an invalid configuration, as it fundamentally defeats its purpose of aggregating Autonomous Systems (AS) for routing policy management. We formally propose that IRR database maintainers implement mandatory validation during AS-SET creation to enforce: 1. Require at minimum one valid AS number in the members field 2. Reject AS-SET submissions containing empty/null members attributes 3. Provide clear error messaging specifying the validation requirements This technical enforcement would align with RFC 2725 (Routing Policy System Security) recommendations while significantly improving routing registry data quality and operational reliability for Internet Exchange ecosystems.
liu haoran wrote on 13/05/2025 20:09:
A child AS-SET must still have explicitly defined members to ensure operational validity.
no, this isn't actually the case, which is why members: is optional. Your position might be that this is beneficial for your members on the basis of your policy, but that's a different issue. There's no reason in the specification that an as-set can't be empty, even if your IXP might have a different policy position on this.
The 2,000 AS-SETs lacking members highlight a significant data quality issue. While technically compliant with RFC 2622, these empty AS-SETs serve no practical purpose and may lead to routing policy management challenges.
There may be valid operational reasons why an operator would want their as-set to be empty, e.g. they might want a placeholder as-set in someone else's routing policy which they can update as required. Or they might want to use specific constructions like AS-NULL in their routing policy for some reason. Nick
participants (3)
-
Edward Shryane -
liu haoran -
Nick Hilliard