Re: [v6ops] Fwd: RIPE-555 fundamentaly changes the way how we can filter IPv6 & IPv4 martians?

["Fred Baker (fred)" <[e-mail]>]

On Jul 11, 2012, at 10:57 AM, Turchanyi Geza wrote:

> There were several people, including me, that openly argued against some new RIPE policies that neglect the consecquences at the routing level, however, there is a noisy minority acting at the RIPE policy working group, overlooking reasonable arguments.

There have been calls in the past for the IETF to make recommendations to the RIRs on such policy. One of the proposals, if memory serves, was to recommend that service providers filter prefixes longer than /48, and another was that they filter prefixes longer than were allocated by the RIR in question or the IANA. The general comment was to shout the suggestion down: "that's for the RIR communities to comment on, not the IETF".

If I understand the dialog here (and no, I'm not involved in RIPE Policy), it sounds like there might be value in comments on the architectural implications of policy decisions on routing.

If I were to make a filtering proposal, I might look at the RPKI work. I could imagine an RPKI database maintained by an RIR having a key for each allocated prefix and each aggregated prefix (e.g., I could imagine Europe and the Americas routing to "APNIC prefixes" as an aggregated class, and only to more specifics within or close to the Asia Pacific region), and a recommendation from v6ops to the effect that an ISP should filter to prefixes that are in the RPKI database (and attested to by it) barring specific business requirements; deaggregation by a business partner acceptable to a given network might be an example of a business requirement, as would acceptance of the announcement of a specific ULA. I could also imagine the RIR offering a service to a network that wants to deaggregate, that would allow it to file signed keys for the more specific prefixes it wants to announce.

I could also imagine the operators in the room saying "that's why we don't want advice from the IETF" :-)

Question for the accumulated folks "in the room": Is the architectural implications of routing and filtering policy an appropriate topic to invite a draft concerning? If so, who might constitute an appropriate design team?

Documents relevant to RPKI:

https://tools.ietf.org/html/rfc6382
6382 Unique Origin Autonomous System Numbers (ASNs) per Node for
     Globally Anycasted Services. D. McPherson, R. Donnelly, F. Scalzo.
     October 2011. (Format: TXT=25224 bytes) (Also BCP0169) (Status: BEST
     CURRENT PRACTICE)

https://tools.ietf.org/html/rfc6472
6472 Recommendation for Not Using AS_SET and AS_CONFED_SET in BGP. W.
     Kumari, K. Sriram. December 2011. (Format: TXT=10673 bytes) (Also
     BCP0172) (Status: BEST CURRENT PRACTICE)

https://tools.ietf.org/html/rfc6480
6480 An Infrastructure to Support Secure Internet Routing. M.
     Lepinski, S. Kent. February 2012. (Format: TXT=62127 bytes) (Status:
     INFORMATIONAL)

https://tools.ietf.org/html/rfc6481
6481 A Profile for Resource Certificate Repository Structure. G.
     Huston, R. Loomans, G. Michaelson. February 2012. (Format: TXT=36117
     bytes) (Status: PROPOSED STANDARD)

https://tools.ietf.org/html/rfc6482
6482 A Profile for Route Origin Authorizations (ROAs). M. Lepinski, S.
     Kent, D. Kong. February 2012. (Format: TXT=15745 bytes) (Status:
     PROPOSED STANDARD)

https://tools.ietf.org/html/rfc6483
6483 Validation of Route Origination Using the Resource Certificate
     Public Key Infrastructure (PKI) and Route Origin Authorizations
     (ROAs). G. Huston, G. Michaelson. February 2012. (Format: TXT=19811
     bytes) (Status: INFORMATIONAL)

https://tools.ietf.org/html/rfc6484
6484 Certificate Policy (CP) for the Resource Public Key
     Infrastructure (RPKI). S. Kent, D. Kong, K. Seo, R. Watro. February
     2012. (Format: TXT=77855 bytes) (Also BCP0173) (Status: BEST CURRENT
     PRACTICE)

https://tools.ietf.org/html/rfc6485
6485 The Profile for Algorithms and Key Sizes for Use in the Resource
     Public Key Infrastructure (RPKI). G. Huston. February 2012. (Format:
     TXT=11377 bytes) (Status: PROPOSED STANDARD)

https://tools.ietf.org/html/rfc6486
6486 Manifests for the Resource Public Key Infrastructure (RPKI). R.
     Austein, G. Huston, S. Kent, M. Lepinski. February 2012. (Format:
     TXT=42913 bytes) (Status: PROPOSED STANDARD)

https://tools.ietf.org/html/rfc6487
6487 A Profile for X.509 PKIX Resource Certificates. G. Huston, G.
     Michaelson, R. Loomans. February 2012. (Format: TXT=69150 bytes)
     (Status: PROPOSED STANDARD)

https://tools.ietf.org/html/rfc6488
6488 Signed Object Template for the Resource Public Key Infrastructure
     (RPKI). M. Lepinski, A. Chi, S. Kent. February 2012. (Format:
     TXT=25130 bytes) (Status: PROPOSED STANDARD)

https://tools.ietf.org/html/rfc6489
6489 Certification Authority (CA) Key Rollover in the Resource Public
     Key Infrastructure (RPKI). G. Huston, G. Michaelson, S. Kent.
     February 2012. (Format: TXT=23060 bytes) (Also BCP0174) (Status: BEST
     CURRENT PRACTICE)

https://tools.ietf.org/html/rfc6490
6490 Resource Public Key Infrastructure (RPKI) Trust Anchor Locator.
     G. Huston, S. Weiler, G. Michaelson, S. Kent. February 2012. (Format:
     TXT=15004 bytes) (Status: PROPOSED STANDARD)

https://tools.ietf.org/html/rfc6491
6491 Resource Public Key Infrastructure (RPKI) Objects Issued by IANA.
     T. Manderson, L. Vegoda, S. Kent. February 2012. (Format: TXT=23662
     bytes) (Status: PROPOSED STANDARD)

https://tools.ietf.org/html/rfc6492
6492 A Protocol for Provisioning Resource Certificates. G. Huston, R.
     Loomans, B. Ellacott, R. Austein. February 2012. (Format: TXT=65896
     bytes) (Status: PROPOSED STANDARD)

https://tools.ietf.org/html/rfc6493
6493 The Resource Public Key Infrastructure (RPKI) Ghostbusters
     Record. R. Bush. February 2012. (Format: TXT=15491 bytes) (Status:
     PROPOSED STANDARD)

https://tools.ietf.org/html/rfc6494
6494 Certificate Profile and Certificate Management for SEcure
     Neighbor Discovery (SEND). R. Gagliano, S. Krishnan, A. Kukec.
     February 2012. (Format: TXT=26425 bytes) (Updates RFC3971) (Status:
     PROPOSED STANDARD)


http://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-ltamgmt
http://tools.ietf.org/html/draft-ietf-sidr-rpki-ltamgmt
  "Local Trust Anchor Management for the Resource Public Key
  Infrastructure", Stephen Kent, Mark Reynolds, 9-Jul-12

http://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-rtr
http://tools.ietf.org/html/draft-ietf-sidr-rpki-rtr
  "The RPKI/Router Protocol", Randy Bush, Rob Austein, 2-Feb-12

  "Definitions of Managed Objects for the RPKI-Router Protocol", Randy
  Bush, Bert Wijnen, Keyur Patel, Michael Baer, 26-Mar-12

  "RPKI Router Implementation Report", Randy Bush, Rob Austein, Keyur
  Patel, Hannes Gredler, Matthias Waehlisch, 27-Mar-12

http://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-rtr
http://tools.ietf.org/html/draft-ietf-sidr-rpki-rtr
  "The RPKI/Router Protocol", Randy Bush, Rob Austein, 2-Feb-12

  "Definitions of Managed Objects for the RPKI-Router Protocol", Randy
  Bush, Bert Wijnen, Keyur Patel, Michael Baer, 26-Mar-12

  "RPKI Router Implementation Report", Randy Bush, Rob Austein, Keyur
  Patel, Hannes Gredler, Matthias Waehlisch, 27-Mar-12

http://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-rtr-impl
http://tools.ietf.org/html/draft-ietf-sidr-rpki-rtr-impl
  "RPKI Router Implementation Report", Randy Bush, Rob Austein, Keyur
  Patel, Hannes Gredler, Matthias Waehlisch, 27-Mar-12

http://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-rtr-impl
http://tools.ietf.org/html/draft-ietf-sidr-rpki-rtr-impl
  "RPKI Router Implementation Report", Randy Bush, Rob Austein, Keyur
  Patel, Hannes Gredler, Matthias Waehlisch, 27-Mar-12

http://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-rtr-protocol-mib
http://tools.ietf.org/html/draft-ietf-sidr-rpki-rtr-protocol-mib
  "Definitions of Managed Objects for the RPKI-Router Protocol", Randy
  Bush, Bert Wijnen, Keyur Patel, Michael Baer, 26-Mar-12

http://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-rtr-protocol-mib
http://tools.ietf.org/html/draft-ietf-sidr-rpki-rtr-protocol-mib
  "Definitions of Managed Objects for the RPKI-Router Protocol", Randy
  Bush, Bert Wijnen, Keyur Patel, Michael Baer, 26-Mar-12

http://datatracker.ietf.org/doc/draft-ymbk-rpki-grandparenting
http://tools.ietf.org/html/draft-ymbk-rpki-grandparenting
  "Responsible Grandparenting in the RPKI", Randy Bush, 29-Jun-12