April 2015 - db-wg - mailman.ripe.net

<auto-dbm@ripe.net> is slow this afternoon.
by RIPE Database Administration 17 May '18

17 May '18

Dear Colleagues, Because of a very high level of use this afternoon, the response time of <auto-dbm(a)ripe.net> is longer than normal. I have made contact with those who are responsible and I expect the situation to improve as the machine works through the queue. Please be patient. Obviously we at the RIPE NCC Database Group are continuously working to make the performance of the database as good as possible. However, we cannot make improvements in zero time. We thank you for your co-operation up to now and we ask for your continued co-operation so that everyone receives the best possible service. If you have anymore questions, please contact <ripe-dbm(a)ripe.net>. Regards, Ambrose Magee ____________________________ RIPE Database Administration.

2 2

Proposal about personalised authorisation
by Tim Bruijnzeels 12 Aug '15

12 Aug '15

The RIPE NCC has discussed the concept of personalised authorisation on various occasions, most recently at the DB WG session at RIPE 69. Following discussions and input from the working group we would now like to propose the following additions to the RIPE Database: = Extend the person object template with "auth:" as an optional, multiple attribute, with all current authentication methods. = Extend the mntner object "auth:" attribute with a new method that allows a reference to a person object that has at least one "auth:" attribute. There is no requirement to use these extensions, but users that choose to do so can benefit from the following advantages: = Currently it is is not always clear who uses the credentials in each "auth:" attribute on a mntner. There are two main problems with this. First of all this can result in authorisation being given to the wrong users, and second this makes it difficult to keep these objects up to date. For example it is not easy to remove the password for a specific user from a mntner without knowing, or deducing, which password hash is theirs. Having explicit references to person objects will make this clear. = Users who are authorised for multiple mntners will be able to maintain their own credentials in one place. = Audit logging can be improved. It will become possible to show to authorised users of the database which person made which change to their object. = The security of regaining lost access to a maintainer can be improved by letting users of the database reset the credentials on their own person object, rather than on a maintainer. Especially when the person object is linked with a Single Sign-On account. Allowing "auth:" attributes on person objects also allows us to make it easier for users to manage their person object in the RIPE Database in combination with their Single Sign-On (SSO) account on RIPE NCC Access as a single identity. To facilitate this we propose the following: = Being they are part of the same identity, person objects can only be associated with one SSO account, and vice versa. = Associated person objects and SSO accounts are automatically kept in sync. = SSO accounts can associated with new person objects, or existing person objects, provided that the user has access to both the SSO account and at least one maintainer of the person object. = Users will be able to decouple their own SSO account and person object.

4 4

History lost ...
by Erik Bais 21 May '15

21 May '15

Hi, With the IP transfers going in full swing, it is quite common these days that the larger prefix size is broken up in to multiple smaller prefixes.. As the original prefix is split up, the IPRAs remove the original prefix from the database .. and with it .. the history Is there a way to preserve that data to be able to still lookup the data using list-versions or show-version # Regards, Erik Bais

13 24

Database release 1.79 deployed to RC environment
by Tim Bruijnzeels 07 May '15

07 May '15

Dear colleagues, The RIPE NCC is pleased to announce the deployment of RIPE Database software release 1.79 to the Release Candidate (RC) environment: https://www.ripe.net/data-tools/db/release-notes/rc-release-candidate-envir… <https://www.ripe.net/data-tools/db/release-notes/rc-release-candidate-envir…> This release introduces the new attributes "created:" and "last-modified:" as part of the first phase of the deprecating the changed attribute in the RIPE Database. You can find more information about the three phases of this effort here: https://labs.ripe.net/Members/tim/deprecating-the-changed-attribute-in-the-… <https://labs.ripe.net/Members/tim/deprecating-the-changed-attribute-in-the-…> It should be noted however that: = The new attributes will only be enabled in output this Thursday 2 April (because updating all objects with initial values takes a long time) = We have found that we needed to use the 1970-01-01T00:00:00Z instead of 0000-00-00T00:00:00Z (because it's invalid, and we observed inconsistencies in dealing with year 0 AD different libraries) We will update the referenced article shortly to reflect these changes. This release also changes attribute "referral-by" from mandatory to optional. This attribute is part of a mntner object for historical reasons and will be deprecated. Detailed release notes are published here: https://www.ripe.net/data-tools/db/release-notes/ripe-database-release-1.79 <https://www.ripe.net/data-tools/db/release-notes/ripe-database-release-1.79> Documentation for this release is published here: https://www.ripe.net/data-tools/support/documentation/ripe-database-documen… <https://www.ripe.net/data-tools/support/documentation/ripe-database-documen…> Please let us know if you find any issues with this release. We plan to deploy this release to the production environment on Tuesday 28 April, and we plan to enable the new "created:" and "last-modified:" attributes the following Monday 4 May - after the initial values have been added for all objects. Please let us know if you have any questions or comments. Kind regards, Tim Bruijnzeels Assistant Manager Software Engineering RIPE NCC

5 12

Proposal regarding Orphaned Objects
by William Sylvester 01 May '15

01 May '15

Dear Database Working Group Members, There are many old records that have become orphaned. Examples of orphaned objects might include a routing or reverse dns object that exist in the database but are not currently maintained by an active maintainer. Many of these records have not been updated in a very long time. This proposal intends to enable number block holders to have a greater ability to manage their own resources. Currently, when a number block holder wishes to update their number block they are unable to do so directly. They must contact the maintainer of the old object. Many of the older maintainers do not have current contact or have been acquired by another company and left in an unknown orphaned status. These maintainers can be difficult or impossible to contact. RIPE NCC then must be engaged to make the change to an object the number block holder should have had online access to manage directly in the first place. I propose that the maintainer of a number block shall have full control over the contacts, routing, and reverse dns entries related to the number block held. In the event an object currently has a maintainer different than the holder of the number block the maintainer of the number block will be provided an upper maintainer status with rights to manage or delete associated blocks. The number block maintainer will have an ability to delete a related object through the LIR Portal, Webupdates, and related systems. At the inception of this policy the database should be updated to identify objects without a maintainer chain to the number block holder. Any identified objects should have the maintainer of the number block added as an upper maintainer to the related blocks. When a maintainer is removed from the number block, this maintainer should also be removed as an upper maintainer of the object this should work in a similar fashion when a maintainer is added to the number block. The upper maintainer will have an ability to remove the relationship between a number block and associated contacts, routing, and reverse dns objects. Open items to discuss; 1) What is the best mechanism to enable the association of existing objects and does it make sense to have the inetnum object be the central object? 2) What objects should be included? Should any be excluded? 3) What is the right hierarchy for the objects? 4) What is a reasonable schedule for announcements and implementation? Thank you for your consideration and I look forward to your comments. Billy William Sylvester william.sylvester(a)addrex.net <mailto:william.sylvester@addrex.net>

2 2

RIPE 70 DB-WG agenda V2
by Piotr Strzyzewski 29 Apr '15

29 Apr '15

Dear DB-WG Members This is the 2nd draft of an agenda for the DB-WG Meeting at RIPE70 at the Hotel Okura in Amsterdam, Netherlands. This version include new proposal made by William Sylvester. The DB-WG Meeting is scheduled as usual for Thursday, May 14th, starting at 16:00 local time, after the coffee break. The length of our timeslot is 90 minutes. For the overall RIPE 70 meeting plan please refer to its most up-to-date version at https://ripe70.ripe.net/programme/meeting-plan/ Please feel free to comment agenda items or propose additional topics to be discussed both on the mailing list or direct to the WG Chairs at db-wg-chairs(a)ripe.net Looking forward to see you all in Amsterdam. All the best, Job, Nigel & Piotr ________________________________________________________________________ A. Administrative Matters [~5 min] . Welcome . select scribe (thanks to Nigel for volunteering again!) . finalise agenda . approval of minutes from previous WG meeting(s) . review of action list (Nigel Titley) B. Data Base Operational Update (Tim Bruijnzeels, RIPE NCC) [~10 min] C. New DB-Software functionality (Tim Bruijnzeels, RIPE NCC) [~20 min] (proposed, test, deployment) . referral-by deprecation - where are we now? - what are next steps (timeline) . from "changed:" to "last-modified:" / "created:" - where are we now? - what are next steps (timeline) . RIPE NCC to stop enforcing accurate organisation names in "descr:" attribute . restrict usage of RIPE-NCC-RPSL-MNT . new MNTNER - RIPE-NCC-LEGACY-MNT . other aspects D. Personalised authentication (Tim Bruijnzeels, RIPE NCC) [~10 min] E. New proposals (Piotr Strzyżewski) [~10 min] . UTF-8 in the DB . same INET(6)NUM objects with different status . cleanup some hacks with status values . make phone number optional in person objects F. Orphaned Objects (William Sylvester) [~5 min] G. Using RPKI for signing RPSL objects (Robert Kisteleki, RIPE NCC) [~5 min] H. "source: field for non RIPE address space" (Job Snijders) [~10 min] I. continue promotion of the the new Afrinic RR (Job Snijders) [~5 min] Y. Input from other Working Groups and/or Task Forces . Cross-registry Authentication for IRR Data BoF (Job Snijders) [~10 min] Z. AOB __________________________________________ -- gucio -> Piotr Strzyżewski E-mail: Piotr.Strzyzewski(a)polsl.pl

1 0

Re: [db-wg] Proposal to allow UTF8
by George Michaelson 23 Apr '15

23 Apr '15

its only my opinion, but I believe one of the primary uses of whois these days is Law Enforcement Agencies (LEA), and since overwhelmingly this is done by MLAP processes, the primary path is the ->local<- law enforcement people. (MLAP is when the overseas LEA asks the national LEA in question to do something on their behalf. its MultiLateral Legal Assistance Programme) Whilst in local language is a barrier to entry for outsiders, I think for the effective and real maintenance of current information, it would possibly be a huge win. -For this community at least. Other consumers of the WHOIS could feel differently about it. -George On 23 April 2015 at 15:27, Tim Bruijnzeels <tim(a)ripe.net> wrote: > Hi WG, > > >> On 17 Apr 2015, at 12:18, Piotr Strzyzewski <Piotr.Strzyzewski(a)polsl.pl> wrote: >> >> Dear DB-WG Members >> >> Proposal: >> >> I propose to allow UTF8 in all free text attributes of all DB objects >> except in primary keys. >> >> Description: >> >> RIPE NCC service region covers Europe, the Middle East and parts of >> Central Asia. Moreover we have users from outside of this region. This >> means that WHOIS DB stores data for people and organizations from number >> of different countries using number of different alphabets. >> >> At this moment, all data in the RIPE WHOIS DB have to be stored using >> 7-bit plain US ASCII character set. >> >> [As a side note: It is technically possible to store some UTF8 content >> in some attributes, but the answer to whois query (both terminal and web >> based) returns "?" character in this case.] > > Technically it's Latin-1 at the moment, so it's a bit more than US ASCII, but does not include e.g. cyrillic. > >> >> Lack of the full support for national character sets leads to some >> problems which includes, but is not limited to: >> >> 1. Mistakes in person/organization names due to national->english and >> english->national (based mostly on guess) conversion. >> 2. Mistakes in person/organization address due to national->english and >> english->national (based mostly on guess) conversion. >> 3. Conflict of converted words with other correct words (most visible in >> latin-based character sets). >> 4. Possible offensive word formation due to national->english >> conversion of names and/or addresses of person/organization. >> >> [As a side note to points no 1-3: This could lead to some problems when >> LEA tries to find out precisely who should be contacted in case of >> abuse.] >> >> On the other side, community members needs to know who is responsible >> for certain resource without the necessity of understanding all the >> others character sets. Moreover, some objects are filled with data that >> has to be provided in ASCII character set due to business rules (like >> ORGANISATION object details for LIRs). RIPE NCC has a policy to insist >> on latin based names for organisation objects that it verifies >> (allocated, and sponsored end-user space). >> >> Taking this into accout I propose to allow UTF8 in all free text >> attributes of all DB objects except in primary keys. >> >> Some possible issues to be addressed: >> >> 1. When this proposal will be supported by the DB-WG, then it has to be >> discussed at least with AA-WG and AP-WG. > >> >> Lack of the full support for national character sets leads to some >> problems which includes, but is not limited to: >> >> 1. Mistakes in person/organization names due to national->english and >> english->national (based mostly on guess) conversion. >> 2. Mistakes in person/organization address due to national->english and >> english->national (based mostly on guess) conversion. >> 3. Conflict of converted words with other correct words (most visible in >> latin-based character sets). >> 4. Possible offensive word formation due to national->english >> conversion of names and/or addresses of person/organization. >> >> [As a side note to points no 1-3: This could lead to some problems when >> LEA tries to find out precisely who should be contacted in case of >> abuse.] >> >> On the other side, community members needs to know who is responsible >> for certain resource without the necessity of understanding all the >> others character sets. Moreover, some objects are filled with data that >> has to be provided in ASCII character set due to business rules (like >> ORGANISATION object details for LIRs). RIPE NCC has a policy to insist >> on latin based names for organisation objects that it verifies >> (allocated, and sponsored end-user space). >> >> Taking this into accout I propose to allow UTF8 in all free text >> attributes of all DB objects except in primary keys. >> >> Some possible issues to be addressed: >> >> 1. When this proposal will be supported by the DB-WG, then it has to be >> discussed at least with AA-WG and AP-WG. > > Yes, also from RIPE NCC's perspective it's important that this is done before any final technical decision is made here. > > >> 2. UTF8 may cause problems for client code. >> >> Comment: The proper implementation plan and announcements schedule >> should be prepared. > > Ack. We will probably get a number of support requests because of this, but provided that we have a clear mandate from the community (including AA-WG and AP-WG), we can address this with an implementation plan, announcements and RC. > >> >> 3. UTF8 may result in contact addresses and names that are not readable >> by a large part of the community. > > This is why the AA-WG and AP-WG should be in the loop. The main concern is what users expect from the content of the registry with regards to abuse or contact related information for resources. > > Arguments can be made for both cases (accurate representation of names vs a representation that is more easily recognisable by most users). As far as we are concerned we are impartial in this, but need a clear community mandate on the way forward. > >> Comment: Primary keys (mostly names) still have to be in ASCII character >> set. Moreover, LIRs data are also in ASCII character set due to business >> rules. > > At least with regards to resources allocated or assigned through the RIPE NCC (possibly through a sponsoring LIR) our current interpretation of related policies is that latin-1 is expected. I.e. people can deal with some variations on basic ascii, but nothing too exotic. Another concern is that it is not feasible for us to accurately verify names in all possible non-latin character sets, and of course it's very important to our function as a registry that this is done properly. > > That said we can also apply this to the specific information that is verified by the RIPE NCC, such as names and addresses for organisations, even if the database technically allows UTF-8 in other places: e.g. person names or names for organisations not associated with resources that the RIPE NCC allocated or assigned. > > >> 4. At this moment there are no major technical issues blocking UTF8 >> support in the RIPE DB back-end. However thorough checks have to be >> done. > > Agreed. There is no technical showstopper from our perspective. > > Kind regards, > > Tim Bruijnzeels > > Assistant Manager Software Engineering > RIPE NCC > >> >> Looking for your comments. >> >> Piotr >> >> -- >> gucio -> Piotr Strzyżewski >> E-mail: Piotr.Strzyzewski(a)polsl.pl >> > >

2 1

Proposal to allow UTF8
by Piotr Strzyzewski 23 Apr '15

23 Apr '15

Dear DB-WG Members Proposal: I propose to allow UTF8 in all free text attributes of all DB objects except in primary keys. Description: RIPE NCC service region covers Europe, the Middle East and parts of Central Asia. Moreover we have users from outside of this region. This means that WHOIS DB stores data for people and organizations from number of different countries using number of different alphabets. At this moment, all data in the RIPE WHOIS DB have to be stored using 7-bit plain US ASCII character set. [As a side note: It is technically possible to store some UTF8 content in some attributes, but the answer to whois query (both terminal and web based) returns "?" character in this case.] Lack of the full support for national character sets leads to some problems which includes, but is not limited to: 1. Mistakes in person/organization names due to national->english and english->national (based mostly on guess) conversion. 2. Mistakes in person/organization address due to national->english and english->national (based mostly on guess) conversion. 3. Conflict of converted words with other correct words (most visible in latin-based character sets). 4. Possible offensive word formation due to national->english conversion of names and/or addresses of person/organization. [As a side note to points no 1-3: This could lead to some problems when LEA tries to find out precisely who should be contacted in case of abuse.] On the other side, community members needs to know who is responsible for certain resource without the necessity of understanding all the others character sets. Moreover, some objects are filled with data that has to be provided in ASCII character set due to business rules (like ORGANISATION object details for LIRs). RIPE NCC has a policy to insist on latin based names for organisation objects that it verifies (allocated, and sponsored end-user space). Taking this into accout I propose to allow UTF8 in all free text attributes of all DB objects except in primary keys. Some possible issues to be addressed: 1. When this proposal will be supported by the DB-WG, then it has to be discussed at least with AA-WG and AP-WG. 2. UTF8 may cause problems for client code. Comment: The proper implementation plan and announcements schedule should be prepared. 3. UTF8 may result in contact addresses and names that are not readable by a large part of the community. Comment: Primary keys (mostly names) still have to be in ASCII character set. Moreover, LIRs data are also in ASCII character set due to business rules. 4. At this moment there are no major technical issues blocking UTF8 support in the RIPE DB back-end. However thorough checks have to be done. Looking for your comments. Piotr -- gucio -> Piotr Strzyżewski E-mail: Piotr.Strzyzewski(a)polsl.pl

7 6

RIPE 70 DB-WG agenda V1
by Piotr Strzyzewski 21 Apr '15

21 Apr '15

Dear DB-WG Members This is the 1st draft of an agenda for the DB-WG Meeting at RIPE70 at the Hotel Okura in Amsterdam, Netherlands. The DB-WG Meeting is scheduled as usual for Thursday, May 14th, starting at 16:00 local time, after the coffee break. The length of our timeslot is 90 minutes. For the overall RIPE 70 meeting plan please refer to its most up-to-date version at https://ripe70.ripe.net/programme/meeting-plan/ Please feel free to comment agenda items or propose additional topics to be discussed both on the mailing list or direct to the WG Chairs at db-wg-chairs(a)ripe.net Looking forward to see you all in Amsterdam. All the best, Job, Nigel & Piotr ________________________________________________________________________ A. Administrative Matters [~5 min] . Welcome . select scribe (thanks to Nigel for volunteering again!) . finalise agenda . approval of minutes from previous WG meeting(s) . review of action list (Nigel Titley) B. Data Base Operational Update (Tim Bruijnzeels, RIPE NCC) [~10 min] C. New DB-Software functionality (Tim Bruijnzeels, RIPE NCC) [~25 min] (proposed, test, deployment) . referral-by deprecation - where are we now? - what are next steps (timeline) . from "changed:" to "last-modified:" / "created:" - where are we now? - what are next steps (timeline) . RIPE NCC to stop enforcing accurate organisation names in "descr:" attribute . restrict usage of RIPE-NCC-RPSL-MNT . new MNTNER - RIPE-NCC-LEGACY-MNT . other aspects D. Personalised authentication (Tim Bruijnzeels, RIPE NCC) [~10 min] E. New proposals (Piotr Strzyżewski) [~10 min] . UTF-8 in the DB . same INET(6)NUM objects with different status . cleanup some hacks with status values . make phone number optional in person objects F. Using RPKI for signing RPSL objects (Robert Kisteleki, RIPE NCC) [~5 min] G. "source: field for non RIPE address space" (Job Snijders) [~10 min] H. continue promotion of the the new Afrinic RR (Job Snijders) [~5 min] Y. Input from other Working Groups and/or Task Forces . Cross-registry Authentication for IRR Data BoF (Job Snijders) [~10 min] Z. AOB __________________________________________ -- gucio -> Piotr Strzyżewski E-mail: Piotr.Strzyzewski(a)polsl.pl

1 0

Proposal to accept same INET(6)NUM objects with different status
by Piotr Strzyzewski 19 Apr '15

19 Apr '15

Dear DB-WG Members Proposal: I propose to allow two INET(6)NUM objects with the same value of inet(6)num attribute and different status to be put into the DB. Problem description: According to current DB/business rules it is impossible to put into the database two INET(6)NUM objects with the same value of inet(6)num attribute and different status. This situation is quite problematic when an LIR which receive /22 from the last /8 cannot put this exact /22 with "ASSIGNED PA" status into the DB (this will result with en error). The current practice is way from being ideal - one have to divide this /22 to at least two smaller assignments. This problem is more relevant but not limited to the new LIRs which receive their initial and only allocation and assign it as one single block to themselves. Some possible problems to be addressed: 1. Should this be limited to certain top/bottom status pairs (like ALLOCATED PA->ASSIGNED PA). IMHO yes. 2. Shoud DB return both INET(6)NUM object matching the query? I'm open to both options (special query flag could be introduced if necessary). 3. How to delete/modify correct INET(6)NUM object. While deleting, exact copy must match. While modifying, status line select the one to be modified. Looking for your comments. Piotr -- gucio -> Piotr Strzyżewski E-mail: Piotr.Strzyzewski(a)polsl.pl

2 1