Summary

  • In a March 2021 Routing Working Group message, Nathalie Trenaman asked whether RIPE NCC should reject RPKI-invalid routes on AS3333, the network carrying the LIR Portal and much of ripe.net. A member with a mismatched ROA might then lose access to the portal used to repair it.
  • RIPE NCC enabled reject-invalid on 19 April. It warned and contacted affected organisations, but did not make a hidden portal exception or alter their ROAs for them.

The door is also the repair shop

An RPKI-invalid announcement can be a hijack. It can also be a typo in a resource holder's ROA: the wrong origin number, prefix or maximum length. A network filtering invalid routes cannot see intent in that mismatch. For RIPE NCC, the choice had a sharper edge than a routine filtering change. AS3333 served the member-facing LIR Portal. An operator that published a bad ROA could be refused a route to the place where it manages that ROA.

Trenaman put the dilemma to the Routing Working Group on 18 March. Some upstreams already filtered invalids, while others did not. A member with a bad ROA might fail to reach RIPE NCC through the first group; a hijacked member had reportedly failed through the second. Her February check found 511 member or End User announcements that could be affected. The question was not whether a valid route should win. It was how the registry would treat people whose own record had trapped them.

By 7 April, her RIPE Labs account counted 697 invalid routes from 215 organisations. Staff contacted them and added a dashboard warning before a user published a mismatching ROA. Operations watched the cutover. A later RIPE 82 update described a separate prelaunch check of 597 routes linked to the same 215 organisations. The two counts are dated snapshots, not competing totals.

Trenaman refused the tempting shortcut. RIPE NCC would build no back door to my.ripe.net and would not rewrite a member's ROA. The stated route back was another network whose announcement was valid or unknown. The service notice set 19 April; her May update confirms the filter went live that day and says only a handful of member questions followed, mostly about creating ROAs. K-Root, on AS25152, sat outside this AS3333 change.

The registry made its security rule real on its own network. Its harder act was to make the cost legible before a mistake could cut a member off from the repair desk.

Sources: Routing WG question; RIPE Labs account; service notice; RIPE 82 update.