Re: [Sidrops] as23456 in ROAs
Christopher Morrow <christopher.morrow@gmail.com> Mon, 01 April 2019 01:55 UTC
Return-Path: <christopher.morrow@gmail.com>
X-Original-To: sidrops@ietfa.amsl.com
Delivered-To: sidrops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4CCD31200EC for <sidrops@ietfa.amsl.com>; Sun, 31 Mar 2019 18:55:24 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SbdqkKG_XrfW for <sidrops@ietfa.amsl.com>; Sun, 31 Mar 2019 18:55:22 -0700 (PDT)
Received: from mail-ua1-x92d.google.com (mail-ua1-x92d.google.com [IPv6:2607:f8b0:4864:20::92d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 907FE12006F for <sidrops@ietf.org>; Sun, 31 Mar 2019 18:55:22 -0700 (PDT)
Received: by mail-ua1-x92d.google.com with SMTP id l17so2373386uar.4 for <sidrops@ietf.org>; Sun, 31 Mar 2019 18:55:22 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=xtpgoT5rFRj3/re/lPlMhQbkgzWuoyMQRkSHTVHQ50k=; b=c/wama4ib4kzV581ABW6CHu/so+x/DPhCVTeR7aA783nKehsEYqmDz2iKMC74X77bG Rd0rv9sc6xe60izU3LxTYlSPw0y9rkpzgCzrp6HGIghi05G/MAB+UUaL/7B1CEFKyBec Y7dat1LetX4OMx8cSR8kwIC/+d9gE3E+iB6gSD2dCK1IEbxg5gaNLDVFsJ3u1Qf5hSp3 P6LmOUb/wf71kQKzkdw9UFdfOcgglWQISsGTOgYbzzX1rFwwXlI1HghHH7fQGnkmzOPN KnFlY6xigbro4AcpYYl/HortPaDimPgRr5fyyZFNyq4QYOJUPNpjfgBP+Xew+Zwm05yf 4o8A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=xtpgoT5rFRj3/re/lPlMhQbkgzWuoyMQRkSHTVHQ50k=; b=XYeKfG32hh8EtjQwe1eDmGL4HWvdpcJlCecfPKd3Xs8mQPNeMRtEm3N0/zndWoevyr Ei0OuBzWmDyjZ2aeQWRBVPtN9ulkNHDxgHrd3mkWGPB8w0C5wipWydTapcTCbItoI3Qh cdQQmZHhdAU3gNgj6Nz/JRaHAqbZHdnHGsY75GEhaLvc5WtMqyDC2IItlnztgyzPo/ee r3z/OUAOiwF2DwoN9W6pPZRttMIWSSOfqHxjgoss28052QDdnhL5ODnW1SEwKht4pXNA KUkSW1wFfyguSE8vtuI3Z2f6tNVFTaZ6t2cFtG4BSvc3ieDkK+SR9QFtKrkE/cTjIaoL IFog==
X-Gm-Message-State: APjAAAXzJYnpoOXTbnwygfpDZdYDeced7Pb+df/sKZDoilCkAWEODdWe q6gM3JnT4oZQ98Avl/Xl6PBVwO9D6on/OrrsO2s=
X-Google-Smtp-Source: APXvYqza//omXpJucX7zaAhdzqTF1vHR3TbL/Smm/6Qk731z2KTUzGzHxzo0hcCvY752kr7DXvks2H7X/jVmX/aZ6qo=
X-Received: by 2002:ab0:185a:: with SMTP id j26mr18686573uag.132.1554083721347; Sun, 31 Mar 2019 18:55:21 -0700 (PDT)
MIME-Version: 1.0
References: <23713.4600.388005.282115@oz.mt.att.com>
In-Reply-To: <23713.4600.388005.282115@oz.mt.att.com>
From: Christopher Morrow <christopher.morrow@gmail.com>
Date: Sun, 31 Mar 2019 18:55:10 -0700
Message-ID: <CAL9jLaY7uMn+n+dcD0NWAvNfSti5m2OEBaiqg=4G20d-7fg8Eg@mail.gmail.com>
To: Jay Borkenhagen <jayb@braeburn.org>
Cc: Ruediger Volk <rv@nic.dtag.de>, SIDR Operations WG <sidrops@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <https://mailarchive.ietf.org/arch/msg/sidrops/nNYdblrXjMuJozRJvAy0l0fSg5s>
Subject: Re: [Sidrops] as23456 in ROAs
X-BeenThere: sidrops@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: A list for the SIDR Operations WG <sidrops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sidrops>, <mailto:sidrops-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/sidrops/>
List-Post: <mailto:sidrops@ietf.org>
List-Help: <mailto:sidrops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sidrops>, <mailto:sidrops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 01 Apr 2019 01:55:25 -0000
On Sun, Mar 31, 2019 at 12:16 PM Jay Borkenhagen <jayb@braeburn.org> wrote: > > Hi Ruediger, > Hi SIDROps, > > With respect to Ruediger's second presentation at IETF104 last week, > in which he mentioned (among other things) finding as23456 as the > authorized ASN in some published ROAs: > > I checked those ROAs (well, actually their VRPs) and found that in > each current case, the same prefix has been authorized also to > originate in an autonomous system number greater than 65535. Details > below. <snip> > > Not saying I like it or would recommend taking steps to work around > networks that still do not grok 4B-ASNs in 2019, but perhaps an > as23456 ROA is not totally without motivation. > ] So, I thought one of the requirements for doing BGPSEC (maybe not OV though?) was: "must have 4-byte capability" clearly signing a ROA for: "shared asn" is a poor plan :( but really you shouldn't ever see 23456 in a secure path... (again, sure that's BGPSEC not OV) funny though. -chris > > > === 138.185.76.0/22 === > AS23456,138.185.76.0/22,24,lacnic > AS263824,138.185.76.0/22,24,lacnic
- [Sidrops] as23456 in ROAs Jay Borkenhagen
- Re: [Sidrops] as23456 in ROAs Christopher Morrow
- Re: [Sidrops] as23456 in ROAs Randy Bush