Subject: Re: [RPSEC] proposed message to the IESG

From: Sandy Murphy <[email-masked]>
Date: Fri, 21 Jan 2005 18:56:23 -0500 (EST)

>Okay, so say A owns 10.1.0.0/16. A suballocates 10.1.1.0/24 to B, so B now 
>owns 10.1.1.0/24.
>
>-- Would you say 10.1.1.0/24 is a part of 10.1.0.0/16, so that by 
>advertising 10.1.0.0/16, you are, in fact, also advertising reachability to 
>10.1.1.0/24?
>
>-- Would you say that A advertising 10.1.0.0/16 is, in fact, advertising 
>B's address space?
>
>-- If your answer to these two questions is yes, what is your conclusion? 

My answer would be yes to both questions - A is allowed to continue to
advertise reachability to addresses it has sub-allocated to B.  And I
don't see a problem with that.  Surely that's OK?  A will still be
able to reach B, surely?  Blackholes aside.  So parts of the world that
do see B's announcement will send traffic by that route and if there
are parts of the world that see A's announcement but not B's (could
happen, right?) will send the traffic through A.

(Leaving aside the case of the non-BGP-speaker who is allocated
addresses.)  I'm ok with the definition of authorized-to-advertise
as "has been allocated", which does not say "has been allocated and
has not suballocated".

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Stefan Mink <[email-masked]>
Date: Sat, 22 Jan 2005 01:26:49 +0100

>as "has been allocated", which does not say "has been allocated and

I agree with you that this is the current state, but is it granted to
always be like this? What if for whatever reason an RIR changes
its policy... ? This would have to be somehow taken into account
when verifying the origin authorization of a route.

   tschuess
             Stefan Mink
-- 
Stefan Mink, Schlund+Partner AG (AS 8560)
Primary key fingerprint: 389E 5DC9 751F A6EB B974  DC3F 7A1B CF62 F0D4 D2BA

---

From: Russ White <[email-masked]>
Date: Fri, 21 Jan 2005 22:38:03 -0500 (Eastern Standard Time)

> don't see a problem with that.  Surely that's OK?  A will still be able 
> to reach B, surely?  Blackholes aside.  So parts of the world that do see 
> B's announcement will send traffic by that route and if there are parts 
> of the world that see A's announcement but not B's (could happen, right?) 
> will send the traffic through A.

What if A's policy were such that some parts of the world weren't supposed 
to see its address space at all? How would A enforce this policy?

I'm surprised you don't find this rather loose definition of ownership 
problematic at all. It's a lot like me selling a room in my house, and the 
new owner and I both listing it on our tax returns, isn't it? Would it 
bother you if a credit card company gave you a number from a block, then 
used that block to charge something, with the result that your bill 
increased? If it wouldn't bother you, can I have your credit card 
number???.... :-)

> addresses.)  I'm ok with the definition of authorized-to-advertise as 
> "has been allocated", which does not say "has been allocated and has not 
> suballocated".

This actually happens, to--or at least it used to.... Suppose you have a 
customer who wants to dual home, but doesn't want to run BGP? You could 
give your customer a block, say a /24, and tell them to have their other 
provider run a static, and originate the route as well. I don't think this 
happens often any longer, but when I was working the TAC, I encountered 
this on a regular basis.

:-)

Russ

__________________________________
[email-masked] CCIE <>< Grace Alone