Re: [Sidrops] request for feedback draft-spaghetti-sidrops-rpki-asgroup-00

[Job Snijders <[e-mail]>]

On Wed, Nov 16, 2022 at 01:56:35PM +0100, Ties de Kock wrote:
> > We put together a proposal to port the IRR 'as-set' class object
> > functionality to the RPKI framework; leveraging authorization
> > through validating a chain of AS Identifier extensions; resolve
> > object naming collisions; and additionally provide an opt-out
> > mechanism. We imagine the UI for operators could be very similar to
> > IRR AS-SET edit forms.
> 
> Interesting to describe this in the RPKI.
> 
> Do you know a good/authoritative description of the data model of
> AS-SETs in the IRR? That would help me in evaluating this draft.

I can share a bit of history:

RIPE-081 (february 1993) introduced the concept of "Representing IP
Routing Policies in the RIPE Database" (but lacked AS-SETs!)
https://www.ripe.net/publications/docs/ripe-081/pdf

Then came RIPE-181 (RFC 1786) which in section 7 introduced the concept
of "AS Macros" - a grouping of ASNs. I suspect that after a few months
of RIPE-81 deployment experience, it became clear some kind of
short-hand notation was needed, because copy+pasting long lists of ASNs
in all locations probably was tedious labor :-)
https://www.ripe.net/publications/docs/ripe-181/pdf
https://www.rfc-editor.org/rfc/rfc1786.html#section-7

Then in 1998, through RFC 2280 Section 5.2 the concept of 'AS Macros'
was renamed to "AS-SETs": https://www.rfc-editor.org/rfc/rfc2280#section-5.2

Nowdays AS-SETs still are in via tools like bgpq3/bgpq4, irrtoolset,
irrpt, arouteserver, or ixpmanager. An example invocation of bgpq4 is:

    $ bgpq4 -l listing -f1 -j AS15562:AS-SNIJDERS
    {"listing": [
      112,234,267,8952,12654,15562,31451,39765,
      41731,41996,43997,44854,48603,51861,57436,57782,
      60003,60927,61438,199036,202314,202539,205591,205593,
      205956,206479,206499,206551,208241,210089,212121
    ]}

An AS-SET contains AS numbers, or references to other AS-SETs. The
purpose and application of a given AS-SET is beholden to an agreement
between the publisher AS-SET and the consumer of the AS-SET.

> One nit, section 5, step 5:It would be clearer to me to use language
> here that the extension MUST NOT be present in the EE certificate (the
> inverse of 5.4).

Thanks, pull-requests welcome - 
https://github.com/job/draft-sidrops-asgroups/commit/cff3de6942ba77229de4406f31367fd944a7e55f

Kind regards,

Job