[db-wg] Issue with authorization in hierarchical as-sets

Hi Cynthia,

> On 19 Nov 2022, at 18:24, Cynthia Revström via db-wg <db-wg at ripe.net> wrote:
> 
> Hi DB-WG,
> 
> While looking into the discussion about requiring hierarchical as-sets
> I wanted to see if all current hierarchical as-sets were authorized by
> the ASN holders and I found two separate issues (in my opinion).
> 
> I could find at least two cases of hierarchical as-sets that were
> likely created before RIPE and RIPE-NONAUTH split.
> They are using APNIC ASNs and there are aut-num objects for both of
> them in RIPE-NONAUTH, but the as-sets are still in RIPE.
> I am not sure of the scope of this issue or if others consider it an
> issue, but it seems like that should possibly get cleaned up, or at
> least get checked out.
> 

Using the latest RIPE delegated stats and as-set split file, I found:

- A total of 23,758 as-set objects
- A total of 3,250 hierarchical as-sets
- A total of 264 hierarchical as-sets referencing an out of RIPE region AS number

I'll send you the complete list directly for comparison.

> Something that could be an issue is the cleanup, what happens with an
> hierarchical as-set when the relevant ASN is de-registered?
> Maybe someone on the DB team could clarify?
> 

When an "assigned" aut-num is de-registered, we email the maintainers of all references to that aut-num (including references from as-set's), asking them to review the reference and remove it if appropriate. 

We don't (currently) automatically delete any referencing as-set objects.

Regards
Ed


> -Cynthia
> 
> -- 
> 
> To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://mailman.ripe.net/