July 2020 - db-wg - mailman.ripe.net

mntner with misleading primary key
by Tom Hill 08 Sep '20

08 Sep '20

Hello db-wg, A simple query to the RIPEDB ('whois -h whois.ripe.net -r AS2856') returns the aut-num AS2856 that you would expect, but it also returns a mntner with the same primary key: % Information related to 'as2856' mntner: as2856 admin-c: JA6431-RIPE auth: SSO # Filtered mnt-by: as2856 created: 2018-08-23T15:46:37Z last-modified: 2018-08-23T15:46:37Z source: RIPE # Filtered This has caused some concern, and while we (2856) have already determined how that mnter came to be in the database - and that there isn't any immediate risk - it isn't in any way affiliated with the AS2856 network, or any part of the parent company. One can imagine that given the quality of NOCs & their understanding of database objects the world over, that one of them might be convinced that the person associated with this mntner was indeed associated with the network AS2856, and they might also be convinced to announce prefixes that they otherwise should not. It is obvious that speaking to the owner of the mntner and politely asking them to switch to a new mntner would be pertinent, but as far as I'm aware they're under no obligation to do so. Yet, it feels that AS2856 (or any network in the RIPE region) remains potentially at some risk should a bad actor combine such a mntner, with some questionable verification of their credentials, and socially engineer their way toward a route hijack. Should it be possible to create mntners (or other objects) that infer a relationship and/or authority to a given aut-num (or organisation?) Might there be negative side-effects in restricting the primary key of mntners from impersonating other objects? I'm unable to construct a query to the RIPEDB that looks for mntner objects beginning with 'as', in order to gauge how common this is. I suspect that's because the phrase is too short, but if it is possible please do enlighten me! :) Regards, -- Tom

12 22

RPSL parser nits
by Lutz Donnerhacke 18 Aug '20

18 Aug '20

Hello, I try to be a bit more expressive in the aut-num of ASN199284, but fail to get accepted at least the valid parts by the RPSL parser. Of course, there are invalid expressions in my terms for the sake of expressiveness, i.e. - next-hop is only valid for static routes - communities must not contain the PeerAS pattern But the other parts should be accepted, i.e. - protocol OSPF - rtr-sets in router expression part It would be a cool idea to keep the formatting, or better have smart pretty printing of the RSPLng structures. Currently only the "syncupdate" Interface is able to keep the line warps, which is pretty annoying. Where can I found the currently running code and do you accept patches in this regard? Many thanks in advance Lutz Donnerhacke

6 10

NWI-11 Internationalised Domain Names
by ripedenis＠yahoo.co.uk 06 Aug '20

06 Aug '20

Hi Ed The chairs see there is a consensus to move forward with implementing Punycode. Can you present an impact analysis explaining what changes you propose, what effect those changes will have on updates and queries (by all the different methods), if anyone needs to modify their software interacting with the database. cheersdenis co-chair DB-WG

4 9

NWI-11 Internationalised Domain Names
by ripedenis＠yahoo.co.uk 13 Jul '20

13 Jul '20

Colleagues There has been some discussion recently and many times over the years about addressing this issue. The chairs believe there has been enough support shown to move forward with this. We would therefore like to present this as 'NWI-11 Internationalised Domain Names'. We propose a problem statement based on the text provided recently by Leo Vegoda, as shown below. The RIPE NCC has a proposal for a solution to this problem using punycode. We would like to ask the RIPE NCC to present this proposal to the working group. If anyone has any other proposals for a solution, we welcome a discussion on this matter. cheersdenis co-chair DB-WG Problem Statement The RIPE NCC service region includes countries whose language is not written using Latin script. Many of the languages used in the RIPE NCC service region are written in Latin script but use diacritical marks that fall outside the US-ASCII character set. Internationalized Domain Names (IDNs) support the use of these scripts in DNS. ICANN began delegating IDN Top-Level Domains as part of a test program in 2007 and the IETF updated the IDNA protocol in 2008 and as of mid 2020, there were over 160 IDN TLDs in the root zone. The IETF published eight standards track RFCs on using IDNs in e-mail in 2012 and 2013. It is reasonable that organizations communicating with people whose preferred script is not Latin-based would want to use an IDN domain for e-mail as well as a web presence. It is also likely that the registry for an IDN TLD would want to use that TLD for its e-mail addresses. RFC 3912 explicitly notes that the WHOIS protocol has not been internationalized while recognizing that some servers attempt to do so. RDAP has been deployed by the RIPE NCC and explicitly supports internationalization by UTF-8 encoding all queries and responses. The RIPE community could decide to ignore EAI by trying to require organizations to deploy a secondary e-mail address for use in the RIPE Database. This would reduce the effectiveness of the RIPE Database as the secondary address is less likely to be monitored and used, and so be ineffective.

7 19

Puny code or UTF-8 (or both)?
by ripedenis＠yahoo.co.uk 13 Jul '20

13 Jul '20

Colleagues After the recent discussion it seems their is support for the idea of UTF-8, whilst there is also support for Puny code as an interim step. To implement UTF-8 in the RIPE Database requires much more detailed discussions, including non technical aspects of the change. This is not likely to happen quickly. There has been support shown to introduce Puny code as a first step towards internationalisation of the data, which can be done quickly by the RIPE NCC. Do we therefore have support to introduce Puny code now and then consider how to move forward with UTF-8? cheersdenis co-chair DB-WG

8 7

Re: [db-wg] NWI-11 Internationalised Domain Names
by Elad Cohen 07 Jul '20

07 Jul '20

Hello, I would like to suggest an improvement: In the whois database backend, each textual attribute (last name, etc) can have an additional column and in that column the punycode-representation of the attribute value can be written. The punycode-representation can be added in the related column only if there was at least a single non-ascii character in the textual value that was inputted by the user, otherwise it will be empty. The punycode-representation can be in the format of [FIELD-NAME]--[punycode-ascii-characters] instead of xn--[punycode-ascii-characters], in order to avoid duplication with textual strings that starts with "xn--". There shouldn't be "punycode representation" columns in the database for email-related fields, nor for object-reference fields. Using the above, old protocols will still be able to interact with the database as they are now, no ground up development of the whole backend will be needed to support internationalization, the new "punycode-representation" columns encoding is similar to the encoding of the current columns, end-users will be able to use their internationalized names and other internationalized textual strings, RIPE NCC will be able to display internationalized strings online and through supported-services. Regards, Elad ________________________________ From: db-wg on behalf of Edward Shryane via db-wg Sent: Friday, June 26, 2020 5:55 PM To: db-wg Cc: ripedenis(a)yahoo.co.uk Subject: Re: [db-wg] NWI-11 Internationalised Domain Names Dear Working Group, I'd like to propose the following Solution Definition for NWI-11. Introduction Currently, the RIPE database supports email addresses encoded in the Latin-1 character set. However an email address can have an Internationalised Domain Name (IDN), with characters outside Latin-1 (i.e. Unicode). This causes interoperability problems as non-ASCII characters in an email address may not be accepted by a mail server, and only a small subset of Unicode characters can be encoded as Latin-1. Solution Definition In order to support Internationalised Domain Names (IDN) in an email address in the RIPE database, I propose to automatically encode email addresses in the Punycode format. Punycode (as defined in RFC 3492) is a way to encode strings containing Unicode characters, such as internationalised domain name (IDN) domains, into ASCII. When updating the RIPE database, it is already possible to submit a Punycode encoded value (i.e. with ASCII encoding) for an email address value, but this change automates the conversion of any non-ASCII encoded email address to Punycode. This change will only affect attributes with an email address syntax (i.e. abuse-mailbox, e-mail, irt-nfy, mnt-nfy, notify, ref-nfy, upd-to). Automatic Punycode encoding will only be applied to the domain part of the email address. The local part of the address must only contain ASCII characters. If non-ASCII characters are found in the local part, the address is rejected as invalid. When querying the RIPE database, any Punycode encoded email address is returned in Punycode (i.e it is not decoded). I welcome feedback from the community on this proposal. Regards Ed Shryane RIPE NCC On 22 Jun 2020, at 22:49, ripedenis--- via db-wg <db-wg(a)ripe.net<mailto:db-wg@ripe.net>> wrote: Colleagues There has been some discussion recently and many times over the years about addressing this issue. The chairs believe there has been enough support shown to move forward with this. We would therefore like to present this as 'NWI-11 Internationalised Domain Names'. We propose a problem statement based on the text provided recently by Leo Vegoda, as shown below. The RIPE NCC has a proposal for a solution to this problem using punycode. We would like to ask the RIPE NCC to present this proposal to the working group. If anyone has any other proposals for a solution, we welcome a discussion on this matter. cheers denis co-chair DB-WG Problem Statement The RIPE NCC service region includes countries whose language is not written using Latin script. Many of the languages used in the RIPE NCC service region are written in Latin script but use diacritical marks that fall outside the US-ASCII character set. Internationalized Domain Names (IDNs) support the use of these scripts in DNS. ICANN began delegating IDN Top-Level Domains as part of a test program in 2007 and the IETF updated the IDNA protocol in 2008 and as of mid 2020, there were over 160 IDN TLDs in the root zone. The IETF published eight standards track RFCs on using IDNs in e-mail in 2012 and 2013. It is reasonable that organizations communicating with people whose preferred script is not Latin-based would want to use an IDN domain for e-mail as well as a web presence. It is also likely that the registry for an IDN TLD would want to use that TLD for its e-mail addresses. RFC 3912 explicitly notes that the WHOIS protocol has not been internationalized while recognizing that some servers attempt to do so. RDAP has been deployed by the RIPE NCC and explicitly supports internationalization by UTF-8 encoding all queries and responses. The RIPE community could decide to ignore EAI by trying to require organizations to deploy a secondary e-mail address for use in the RIPE Database. This would reduce the effectiveness of the RIPE Database as the secondary address is less likely to be monitored and used, and so be ineffective.

1 0

Regarding non-ASCII org-name
by Cynthia Revström 07 Jul '20

07 Jul '20

Hiya DB-WG, As you may be aware, the org-name attribute in the organisation object doesn't support non-ASCII characters such as "ö" (umlaut). This presents an issue as for certain entities where that is part of the legal name and thus not being able to represent the legally registered name. I would like to ask the working group if this is something we consider a real problem or just a thing that will stay like this. I have 2 proposed solutions, either use Latin-1 for the org-name which would fix my issue but not all issues, however may be the only possible solution currently as the database uses Latin-1, alternative just use UTF-8. My personal example is my name being represented as "Revstrom" instead of "Revström" in the database, this makes it so you might not be able to search for the name registered in the database in government registers etc. - Cynthia

1 0

Whois Release 1.97.2
by Edward Shryane 06 Jul '20

06 Jul '20

Dear Working Group, RIPE Database release 1.97.2 has been deployed to the Release Candidate environment. We plan to deploy to production on Monday 6th July. This release includes the following changes: • Improved inetnum status validation to align with RIPE policy • ASSIGNED PA status will no longer be allowed under ALLOCATED UNSPECIFIED. • ASSIGNED PI status will no longer be allowed under ASSIGNED PI. • Removed obsolete inetnum status values • EARLY-REGISTRATION • NOT-SET • ALLOCATED PI • LIR-PARTITIONED PI In addition to small improvements and bug fixes. The release notes are on the website: https://www.ripe.net/manage-ips-and-asns/db/release-notes/ripe-database-rel… More information on the Release Candidate environment can be found on our website: https://www.ripe.net/manage-ips-and-asns/db/release-notes/rc-release-candid… Please let us know if you find any issues with this release in the RC environment. Regards Ed Shryane RIPE NCC

1 1

Re: [db-wg] mntner with misleading primary key
by Matthias Merkel 01 Jul '20

01 Jul '20

Hi, if we consider this issue tho we should consider completely disallowing objects with names of existing objects. I'm personally not a big fan of mandatory -MNT because there seems to be a larger amount of people using other formats. Matthias Merkel Vice President Staclar, Inc. [https://cdn2.hubspot.net/hubfs/53/tools/email-signature-generator/icons/pho…] +1-302-291-1141 | +49 15678 585608 [https://cdn2.hubspot.net/hubfs/53/tools/email-signature-generator/icons/ema…] matthias.merkel(a)staclar.com<mailto:matthias.merkel@staclar.com> [https://cdn2.hubspot.net/hubfs/53/tools/email-signature-generator/icons/lin…] staclar.com<https://staclar.com/> [https://cdn2.hubspot.net/hubfs/53/tools/email-signature-generator/icons/add…] Munich, Germany [https://staclar.com/images/logo.png] [linkedin]<https://www.linkedin.com/in/matthias-merkel/> ________________________________ From: db-wg on behalf of Gert Doering via db-wg Sent: Wednesday, July 1, 2020 8:52 PM To: Cynthia Revström Cc: DB-WG Subject: Re: [db-wg] mntner with misleading primary key Hi, On Wed, Jul 01, 2020 at 07:36:53PM +0200, Cynthia Revström via db-wg wrote: > I am not sure how feasible the mandatory "-mnt" would be at this point tbh. > I can easily think of at least 2 maintainers that are actually used that I > see quite often that wouldn't fit that pattern. It would annoy me a bit, because all our stuff is under SPACENET-N and SPACENET-P ("networks and person objects"). And all tools. Of course it is doable, but... why? Convince me :-) Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

1 0

Re: [db-wg] mntner with misleading primary key
by Matthias Merkel 01 Jul '20

01 Jul '20

An alternative approach might be to make an authentication check (user has to have access to a maintainer of the ASN), however given the small amount of maintainers actually being named this way this would likely not be justifiable. Matthias Merkel Vice President Staclar, Inc. [https://cdn2.hubspot.net/hubfs/53/tools/email-signature-generator/icons/pho…] +1-302-291-1141 | +49 15678 585608 [https://cdn2.hubspot.net/hubfs/53/tools/email-signature-generator/icons/ema…] matthias.merkel(a)staclar.com<mailto:matthias.merkel@staclar.com> [https://cdn2.hubspot.net/hubfs/53/tools/email-signature-generator/icons/lin…] staclar.com<https://staclar.com/> [https://cdn2.hubspot.net/hubfs/53/tools/email-signature-generator/icons/add…] Munich, Germany [https://staclar.com/images/logo.png] [linkedin]<https://www.linkedin.com/in/matthias-merkel/> ________________________________ From: db-wg on behalf of Gert Doering via db-wg Sent: Wednesday, July 1, 2020 8:52 PM To: Cynthia Revström Cc: DB-WG Subject: Re: [db-wg] mntner with misleading primary key Hi, On Wed, Jul 01, 2020 at 07:36:53PM +0200, Cynthia Revström via db-wg wrote: > I am not sure how feasible the mandatory "-mnt" would be at this point tbh. > I can easily think of at least 2 maintainers that are actually used that I > see quite often that wouldn't fit that pattern. It would annoy me a bit, because all our stuff is under SPACENET-N and SPACENET-P ("networks and person objects"). And all tools. Of course it is doable, but... why? Convince me :-) Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

1 0