[as112-ops] new prefix for AS112? (2a0b:4e04:6666::/48 in RIPE with various origins it should not have)

[Jeroen Massar]

> On 16 Oct 2024, at 08:54, tech at fedorov.net wrote:
> 
> Hello.
> 
> route6 2a0b:4e04:6666::/48 with AS112 was created on experimental purpose as we are building IRR to RPKI-cache converting software. It was never announced to DFZ and never will be. It’s deleted now.
> 
> Other listed IRRs (42, 3856 etc) never existed and I have no idea why are they mentioned

They are/where listed in IRR and thus get generated into filter sets, see for instance:

https://irrexplorer.nlnog.net/prefix/2a0b:4e04:42::/48
https://irrexplorer.nlnog.net/prefix/2a0b:4e04:3333::/48

Note that this data might be cached, but it is a good place to check.


And as ASNs (people and corporations and fun things) build their filters from there, they will show up.


With a manual un-cached check I see that the whois entries that caused these entries have been cleaned up.

Thank you so much for doing that so rapidly after notification; many corporations could learn from that! ;)


Ultimately the problem lies with the database allowing those entries to be registered, which should not be acceptable.

Fortunately, we are moving to RPKI which will address many of these cases.

Regards,
 Jeroen

--


>> On 16 Oct 2024, at 9:40, Jeroen Massar <jeroen at massar.ch> wrote:
>> 
>> Seems somebody has accidentally added it in multiple places with a variety of origin ASNs:
>> 
>> { "asn": 42, "prefix": "2a0b:4e04:6666::/48", "minLength": 48, "maxLength": 48, "ta": "irr", "expires": 1730268001 },
>> { "asn": 112, "prefix": "2a0b:4e04:6666::/48", "minLength": 48, "maxLength": 48, "ta": "irr", "expires": 1730268001 },
>> { "asn": 3856, "prefix": "2a0b:4e04:6666::/48", "minLength": 48, "maxLength": 48, "ta": "irr", "expires": 1730268001 },
>> { "asn": 8674, "prefix": "2a0b:4e04:6666::/48", "minLength": 48, "maxLength": 48, "ta": "irr", "expires": 1730268001 },
>> { "asn": 13335, "prefix": "2a0b:4e04:6666::/48", "minLength": 48, "maxLength": 48, "ta": "irr", "expires": 1730268001 },
>> { "asn": 15133, "prefix": "2a0b:4e04:6666::/48", "minLength": 48, "maxLength": 48, "ta": "irr", "expires": 1730268001 },
>> { "asn": 29169, "prefix": "2a0b:4e04:6666::/48", "minLength": 48, "maxLength": 48, "ta": "irr", "expires": 1730268001 },
>> { "asn": 199524, "prefix": "2a0b:4e04:6666::/48", "minLength": 48, "maxLength": 48, "ta": "irr", "expires": 1730268001 },
>> 
>> Fortunately, RPKI is getting closer and closer and we'll be able to abolish the RIR filters at one point.
>> 
>> Though rpki client does have these entries:
>> 
>> { "asn": 215751, "prefix": "2a0b:4e04::/48", "maxLength": 48, "ta": "ripe", "expires": 1729119651 },
>> { "asn": 215751, "prefix": "2a0b:4e04:42::/48", "maxLength": 48, "ta": "ripe", "expires": 1729119651 },
>> { "asn": 215751, "prefix": "2a0b:4e04:3333::/48", "maxLength": 48, "ta": "ripe", "expires": 1729119651 },
>> { "asn": 215751, "prefix": "2a0b:4e04:b00b::/48", "maxLength": 48, "ta": "ripe", "expires": 1729119651 },
>> { "asn": 215751, "prefix": "2a0b:4e04:beef::/48", "maxLength": 48, "ta": "ripe", "expires": 1729119651 },
>> { "asn": 215751, "prefix": "2a0b:4e04:f00d::/48", "maxLength": 48, "ta": "ripe", "expires": 1729119651 },
>> 
>> The actual 2a0b:4e04::/32 that it is all part of is nowhere to be found. The note about avoiding de-aggregation does not get far unfortunately.
>> 
>> Seems there is some doc here: https://fedorov.net/as215751/ thus CC'd in this thread so that they can quickly clean this all up.
>> 
>> Regards,
>> Jeroen
>> 
>> 
>>> On 15 Oct 2024, at 23:51, Marco d'Itri <md at Linux.IT> wrote:
>>> 
>>> On Oct 15, Pim van Pelt via as112-ops <as112-ops at dns-oarc.net> wrote:
>>> 
>>>> route6:         2a0b:4e04:6666::/48
>>>> origin:         AS112
>>>> mnt-by:         NETZR-MNT
>>> A decade ago the authorization rules for route objects were relaxed to 
>>> not require anymore authorization by the aut-num object maintainer.
>>> 
>>> Hence any random idiot with control over an inetnum object can create 
>>> a corresponding route/route6 object referencing any ASN they want:
>>> 
>>> https://www.ripe.net/media/documents/Route-Object-Creation-Flowchart.pdf
>>> 
>>> Netnod has control over the AS112 aut-num object, so they can just 
>>> delete this route6 object if they do not like it:
>>> 
>>> https://docs.db.ripe.net/Authorisation/Protection-of-Route-Object-Space/#force-deleting-blocking-route-objects
>>> 
>>> -- 
>>> ciao,
>>> Marco
>>> _______________________________________________
>>> as112-ops mailing list
>>> as112-ops at lists.dns-oarc.net
>>> https://lists.dns-oarc.net/mailman/listinfo/as112-ops
>>> as112.net administrative requests
>>> ops at as112.net
>> 
>