Subject: Re: [RPSEC] proposed message to the IESG

From: Sandy Murphy <[email-masked]>
Date: Fri, 21 Jan 2005 18:16:33 -0500 (EST)

>>> -- A is allocated 10.1.0.0/16.
>>> -- A suballocates 10.1.1.0/24 to B.
>>> ...
>
>>> Is the originator authorized to advertise the address space in the 
>>> route? In this case, A can advertise 10.1.0.0/16, and the answer is yes, 
>>> even though it actually contains 10.1.1.0/24, for which the answer is 
>>> technically no.
>>
>> REALLY???????!!!!!!!!!!
>...
>> I've never seen a suggestion that either in spec or in operational 
>> practice, that allocating an address to someone removes your ability to 
>> announce those addresses yourself.
>
>My point exactly.

So you are agreeing that you've never seen this either in a spec or
in an operational practice?

Then what makes you think it is true?  (Not a completely facetious question - 
I'd like to find out.)

I'm pretty sure I must not be understanding correctly here.

Russ, you seem to be saying that if a tier-1 AS allocates a subblock of its
allocated address space, that it is technically NOT ALLOWED to continue
to advertise that address space.  Is that a correct statement of what
you are saying?

I hope Blaine would chime in on that one.

Do you want to be continue that requirement and to represent that
in the security requirements?

>"Some 59,000 advertisements, or 55% of the total number of routing table 
>entries, are being used to punch policy holes in existing aggregate 
>announcements." draft-iab-bgparch-02.txt

But all the bgparch (now RFC3221) says is that people advertise
more specific prefixes for various reasons, policies being one
of them.

I don't read into that a statement that the aggregate announcement
is (technically) not allowed to be advertised.

I'm looking for a suggestion that an AS is *N*O*T**A*L*L*O*W*E*D
to continue to advertise a part of its own address space that it had
suballocated.  Or indeed that the sub-allocat-ee would want them
to cease to advertise the allocated sub-space.

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Russ White <[email-masked]>
Date: Fri, 21 Jan 2005 18:40:37 -0500 (Eastern Standard Time)

> So you are agreeing that you've never seen this either in a spec or in an 
> operational practice?

You missed the rest of my sentence?

"What's the correct solution here? Security wise, we have an ownership 
ambiguity. Operationally, we can't do business without doing it this way. 
It just won't scale."

This doesn't imply I know of a policy, or that I believe there to be a 
policy, but rather I'm pointing out an ambiguous situation.

> Russ, you seem to be saying that if a tier-1 AS allocates a subblock of 
> its allocated address space, that it is technically NOT ALLOWED to 
> continue to advertise that address space.  Is that a correct statement of 
> what you are saying?

> I'm looking for a suggestion that an AS is *N*O*T**A*L*L*O*W*E*D to 
> continue to advertise a part of its own address space that it had 
> suballocated.  Or indeed that the sub-allocat-ee would want them to cease 
> to advertise the allocated sub-space.

Okay, so say A owns 10.1.0.0/16. A suballocates 10.1.1.0/24 to B, so B now 
owns 10.1.1.0/24.

-- Would you say 10.1.1.0/24 is a part of 10.1.0.0/16, so that by 
advertising 10.1.0.0/16, you are, in fact, also advertising reachability to 
10.1.1.0/24?

-- Would you say that A advertising 10.1.0.0/16 is, in fact, advertising 
B's address space?

-- If your answer to these two questions is yes, what is your conclusion? 
>From a pure security perspective, would you say A should be able to 
continue advertising 10.1.0.0./16? I'm not stating this is a current policy 
anyplace, etc, I'm simply asking what you think.

I don't know of any policy or specification stating A should stop 
advertising 10.1.0.0/16. In fact, I've asserted A actually continues 
advertising 10.1.0.0/16 in the real world. I'm confused that you're 
confused about what I'm saying.... :-)

:-)

Russ

__________________________________
[email-masked] CCIE <>< Grace Alone

---

From: Blaine Christian <[email-masked]>
Date: Fri, 21 Jan 2005 18:52:52 -0500

> I hope Blaine would chime in on that one.

Okay... I can give you common practice from my perspective.  Common practice
is that an ISP will delegate a more specific prefix to a customer.  All the
ISP usually cares about is advertising the less specific prefix.  It is
normally a bad idea for the owner of a less specific chunk of prefixes who
has allocated a more specific prefix to a customer to advertise that more
specific prefix on their own (unless they are propagating a BGP advert).
This is left to the customer to decide.  So, it is technically "allowed" but
it would be considered inappropriate unless there are unusual circumstances.
Please realize that the above paragraph relates specifically to BGP.
However, even with static allocations I would be hard pressed to find common
examples of an ISP bothering (or desiring etc.) to advertise a specifically
allocated sub-block.  A, somewhat notable, diversion from this would be the
use of BGP and deaggregation to effect loadsharing between two different
AS'.  I have done this in the past but I have had to do a lot of crazy
things with BGP to get the job done.

The one "loaner" chunk of information that I HAVE seen as pretty much
forbidden by many is the use of a "loaner" AS outside of the owners control.
Even this is not illegal in the protocol, obviously, but it does create all
sorts of complications which contra-indicate its use (path loops getting
interesting here).

---

From: "Stephen J. Wilcox" <[email-masked]>
Date: Sat, 22 Jan 2005 00:59:13 +0000 (GMT)

Hi Blaine,
 I'm dropping in suggestions late here without reading the whole thread in 
detail and the thread seems to have forked a bit too!

ISPs appear to commonly allocate IPs whilst remaining to announce the less 
specific (i think thats what Sandy was saying). 

There are also lots of ISPs announcing more specifics as well as the less 
specific all from their own ASN.

I've not encountered any ISPs who suballoc a block then announce that specific 
block from their own ASN altho if a block is being moved from one ASN to 
another, or even if the allocating ISP bought the customer and is going thro a 
migration process then I can see reasons why these situations might exist for a 
temporary period...

Steve

---

From: Jeffrey Haas <[email-masked]>
Date: Mon, 24 Jan 2005 10:55:36 -0500

> specific prefix on their own (unless they are propagating a BGP advert).

To be clear here, you're specifically saying:
ISP-A(ggregate) will not be originating the more specific prefix into
the BGP network themselves?

If so, I think we're all in agreement.

>From a possible security infrastructure standpoint (pointing towards
the current RIR, IRR entities), it would be very unusual for someone
to allocate address space from a block and assign it for advertisement
to not only the delegated party, but also the owning party.  It would
be weird...

... but I can't see a reason to preclude it.

> sorts of complications which contra-indicate its use (path loops getting

At minimum, I think this would be bad key hygiene and you typically
would not want to do this.  The question is, do we want to make
allowances for this in our requirements?

-- 
Jeff Haas 
NextHop Technologies