[address-policy-wg] Update on ALLOCATED PI/UNSPECIFIED

Hi,

On Thu, Aug 04, 2016 at 08:59:07PM +0900, Randy Bush wrote:
> > Right now, there are two different shades of "PI colour" - "real PI"
> > and "not really real PI".
> is there a list of all the colors and what they mean?

I used to assume there is "ALLOCATED PA", "ASSIGNED PA" and "ASSIGNED PI",
and those are well-defined.  Add "Legacy" to it (outside RIR framework).

We have learned that there are more interesting shades, namely
"ALLOCATED PI", "ALLOCATED UNSPECIFIED" and "ASSIGNED PI (not really)" -
these are not seen often, and their meaning is not all that clear.


[..]
> i have this feeling you are trying to say something here.  i.e. if i am
> the LIR, can i move "not really real PI" between customers and no one
> knows?

Maybe.  "not really real PI" is happening outside the RIPE policy
framework - namely, no 2007-01 contracts, the NCC has no idea who
the "real" address holder is, and the holder cannot complain to the
NCC if all of a sudden "his" address space is registered to someone
else...

There seems to be "old stuff that happened 15+ years ago" and "new
stuff that is still ongoing", so there won't be "one solution" either.


> > Also, it might lead to deaggs (Markus' case) where a /14 that was
> > originally "in one LIR" would be "3x /16, plus some smaller fragments
> > in the LIR" and "lots of /24 PI managed by the NCC" now - so the /14
> > won't get a ROA, and he'll have to announce more-specifics.
> 
> lemme see if i get this.  to have the owner registration correct, some
> address space will have to be broken up and owned by multiple IRs, thus
> fragmenting routing?  i like correct registration, but the commons has
> become pretty polluted.

I leave the definite answer to Ingrid to answer.

My understanding of "normal" NCC<->LIR stockkeeping is that PI is never
living inside blocks that "belong" to a given LIR.  So, the LIR would
never be able to get a ROA covering PI space.

For some of these "old" blocks, there is a /16 which covers regular
LIR/PA space, and "not real PI" space, and the LIR can get a ROA that
covers their PA space, and also these "not real PI" blocks (because
according to the NCC records, the /16 "belongs" to the LIR).

From an aggregation PoV, this is ok-ish - but from a routing security
PoV, I wonder if that's what we want (the "not real PI" block might
be routed totally elsewhere now).


> > So, to answer your question: for those "swampy PI", it would alter
> > their rights (contracts according to 2007-01), costs (50 EUR/year)
> 
> whoops.  that's gonna cause unhappiness.

Dunno.  We (the RIPE community and the NCC) rolled out 2007-01 to all the 
other PI holders, and the amount of unhappiness was not very big.  

Those cases that I was involved with my "LIR admin-c" hat on, PI holders 
seemed to be happy to have a clear contract with a known entity (us), and 
the assurance that this would ensure that nobody else could make claims 
to their address space.

Gert Doering
        -- assorted hats
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (0)89/32356-444           USt-IdNr.: DE813185279
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: </ripe/mail/archives/address-policy-wg/attachments/20160804/b239865c/attachment.sig>