August 2023 - db-wg - mailman.ripe.net

Using the RIPE Database for IPAM
by denis walker 04 Oct '23

04 Oct '23

Colleagues Do you use the RIPE Database as your IPAM solution? If so, read on.... The RIPE NCC has done a brief review of the recommendations made by the DB Task Force (DBTF). You can find it here: https://www.ripe.net/participate/ripe/tf/rdb-requirements-tf/initial-analys… There is one point in the summary that I disagree with: One recommendation can be implemented immediately by the RIPE NCC: - 3. Using the RIPE Database as an IPAM solution The recommendation from the DBTF was: "The task force recommends limiting and discouraging the use of the RIPE Database as an enterprise IPAM solution." This has not yet been discussed by the community and there is no consensus on this recommendation. So the RIPE NCC should not be doing anything to implement this recommendation. There are a number of points relating to this. The first BoF held by the DBTF had 46 participants. They had some polls about IPAM: Where do you hold your canonical IP address assignment details? (13 answers) Internal database or IPAM system (5 - 38%) RIPE Database (5 - 38%) Internal database for detailed assignments and RIPE database for allocations (3 - 23%) What should we do about the IPAM use of the RIPE Database? (12 answers) We should discourage it (3-25%) We should tolerate it but provide restrictions and best practices (5-42%) We should promote it and facilitate it (4-33%) During the BoF some comments were also made on this: Shane's comment "IPAM seems to be an important thing" Nathalie said about 50% of people attending training courses over a number of years said they use the RIPE DB for IPAM. Also trainees said open source IPAM solutions often pull data out of the RIPE DB but have no functionality to push data to the RIPE DB. During the presentation by the DBTF in the DB-WG session at RIPE 83 Shane said (on IPAM): "if you had very light requirements for IPAM then maybe it is OK, but it's not really what it's for" "unable to find out if this [response] was based on misunderstanding of the question" "we think there are probably good ways to go forward with that, for example making hooks so that external IPAM solutions can hook into it...that makes sense, there are certainly many commercial vendors that make IPAM products who would be happy to use hooks, there are many ways that third parties could use this but probably not a requirement" So it looks like there are very mixed views on the use of the RIPE Database for IPAM. Some people also expressed surprise that so many people use the database for IPAM. It is clear that we don't actually understand who, how and why people use the database for IPAM. We need a better understanding of the how and why and the number of users doing this before we can make any decision about discouraging or encouraging this use of the database. Even to consider if IPAM should be defined as a purpose of the database. As we are talking about it, maybe now is the time to start this discussion. If you use the RIPE Database as your IPAM solution maybe you can offer some more details. cheers denis co-chair DB-WG

5 5

Geofeed purpose
by denis walker 07 Aug '23

07 Aug '23

Colleagues The conversation on deploying geofeed died shortly after RIPE 85. The last comment was from myself asking if anyone was willing to propose some wording for a new purpose covering the use of the RIPE Database for geolocation information. No one proposed any wording. So below I have made a proposal for a new purpose. Your comments are appreciated. cheers denis co-chair DB-WG The RIPE Database contains information for the following purposes: Ensuring the uniqueness of Internet number resource usage through registration of information related to the resources and Registrants Publishing routing policies by network operators (IRR) Facilitating coordination between network operators (network problem resolution, outage notification etc.) Provisioning of Reverse Domain Name System (DNS) and ENUM delegations Providing information about the Registrant and Maintainer of Internet number resources when the resources are suspected of being used for unlawful activities, to parties who are authorised under the law to receive such information. Scientific research into network operations and topology Providing information to parties involved in disputes over Internet number resource registrations to parties who are authorised under the law to receive such information. Providing information about the geolocation usage of Internet number resources.

6 15

Entry Deduplication
by Peter Potvin 04 Aug '23

04 Aug '23

Hey there DB-WG, Apologies in advance if this is the wrong mailing list for this. I noticed that the RIPE DB Query UI automatically deduplicates entries (i.e. multiple instances of an ASN in an AS-SET only appears once) through the webUI, however when queried through whois on any modem operating system the entry shows the raw data including the duplicates within it. I'm a bit curious as to how this is done, and whether it's possible/planned to have the same functionality implemented in the WHOIS back-end that RIPE uses. Regards, Peter Potvin | Executive Director ------------------------------------------------------------------------------ *Accuris Technologies Ltd.* 56A Mill St E, Unit #470, Acton, ON L7J 1H3 Canada Email: peter.potvin(a)accuristechnologies.ca Office: +1 (877) 352-6105 Network Operations Center: +1 (877) 321-1662

2 1

July 2023 Database Working Group update
by David Tatlisu 04 Aug '23

04 Aug '23

Hello everyone, The mailing list has been buzzing this month! This mail is intended to serve as a summary of what happened on the mailing list and behind the scenes. ####################################################################################################################### By far, one of the most active threads concerned the correct *use of the "route" and "route6" objects in a DDOS mitigation scenario. *[1] *Context:* Kaupo Ehtnurm runs a multihomed AS, and one of his upstream providers offers DDOS mitigation service. To ensure all traffic passes through the DDOS mitigation service, they announce a more specific prefix. Kaupo explains that to achieve this, they need to create ROAs and Route objects. ROAs have a max-length field, which allows Kaupo to use just one ROA for a /32 IPv6 with the max-length set to /48. As route objects do not have a max-length field, they explain that they would have to create 65536 /48 route6 objects for their /32, which is difficult to manage. They ask why route objects don't have a comparable "max-length" field.* **Related discussion:* Most of the discussion does not concern the possible reasons why a "max-length" field for route-objects does not exist, but rather discusses operational practice and the actual behavior of DDOS mitigation announcements. Job Snijders explains some of the possible reasons this field does not exist [2]. Job [2] and Nick Hilliard [3] have recommended reading BCP 185 / RFC 9319 for additional information regarding best practices. *Majority consensus:* From what I was able to determine, the following statements are the majority consensus: * Most networks will accept the more specific prefixes, even without a more-specific route object. [4] [5] [6] [7] o Networks have their own reasons for why or why not they might filter more-specifics. [7] [8] [9] o Some traffic might still take the aggregate route instead of the more-specific, this shouldn't be a problem in practice. [10] o Testing the behavior of routes using tools like RIPE Atlas might yield different results, but is said to be unlikely. [7] * Creating a route object for every /48 in a /32 is not recommended. [11] [12] o Announcing and creating route objects for slightly longer prefixes like a few /33 or /34 instead of many /48 might be an acceptable compromise. [13] ####################################################################################################################### Another very active thread was started by Denis Walker, Co-chair of this working group, and concerned*the participation of working group chairs in discussions. *[14] *Context:* Starting the discussion, Denis Walker has explained that he – following feedback from community members – has decided to reduce his community engagement temporarily to evaluate the effect on the working group. He explains that he has not seen current NWIs progress during this time, and that, in his opinion, the lack of engagement by co chairs does not work in some working groups. He states that he will return to his original level of engagement. *Majority consensus: *From what I was able to determine, the following statements are the majority consensus: * Overall, people support active working group chairs that drive discussion, but do not support working group chairs taking a side as a working group chair. [15] [16] [17] * Working group chairs can express their personal opinion when they remove themself from the working group position. [18] [19] *Related discussion:* Most of the discussion has been about co-chair neutrality in discussions. Denis referenced RIPE documents outlaying the responsibilities of a co-chair, where one co chair expressing their opinion to drive discussion is not prohibited. [20] This was followed up by Nick Hilliard, referencing information regarding non-RIPE chair responsibilities. [21] In the end, a policy proposal to clarify the rules was mentioned. [22] [23] ####################################################################################################################### *News from the NCC* * The "rev-srv:" attribute, which was deprecated in 2009, was removed on July 27th. The maintainers of about 34,711 affected objects were informed. [24] * The "NONE" authentication scheme, which was deprecated in 2004, was removed on July 27th. The maintainers of about 613 affected objects were informed. [25] * Client certificate authentication is planned for the database. The NCC has a working implementation internally and is working on getting it ready for production. * The NCC is working on impact analysis concerning a "tuple" solution for NWI-4, where the prefix and status are considered part of the primary key. This will be published soon. * Preparing for the open-source release, the web application for the RIPE Database service is being audited by an external company. This audit is planned to finish by the end of August. #######################################################################################################################* Personal note * Please do not hesitate to tell me if you think I should have included something, or I misrepresented something. I didn't want to go into too much detail, and contemplated a lot about the things to include. You are welcome to contact me if you'd like changes to the format, or you would just like to mention that you thought it was good. I appreciate all feedback. * * ####################################################################################################################### *All the links* Route objects for DDOS mitigation: [1] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007843.html [2] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007859.html [3] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007855.html [4] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007855.html [5] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007867.html [6] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007856.html [7] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007862.html [8] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007866.html [9] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007868.html [10] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007861.html [11] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007865.html [12] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007865.html [13] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007861.html The participation of working group chairs in discussions: [14] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007869.html [15]https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007873.html [16] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007880.html [17] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007891.html [18] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007872.html [19] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007875.html [20] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007883.html [21] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007886.html [22] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007889.html [23] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007890.html NCC news: [24] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007877.html [25] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007878.html

2 1

Authoritative check for domain objects seems to cache nameserver response
by Kjartan Hrafnkelsson - HI 02 Aug '23

02 Aug '23

Dear colleagues, When creating domain objects for reverse DNS delegation of a RIPE assigned inetnum or inet6num, I have observed behaviour where entering a nameserver not authoritative for the in-addr.arpa or ip6.arpa zone results in that nameserver being temporarily unable to be used for delegation. The interface keeps rejecting that particular nameserver for the reason of 'not being authoritative for <zone>', even if the nameserver's configuration has been updated accordingly. What I personally suspect is happening here is that the service on the backend of RIPE NCC's database has sent a DNS request to the specified nameserver, received a response, and cached it. I'm writing this email to ask a couple of questions: Is this intended behaviour? if it is, should it perhaps be changed? and if so, how should changes be implemented? I'm excited to hear back from you, especially as many colleagues within the networking space have expressed frustration from forgetting to configure their nameservers first or misconfiguring them and then having to wait a day or two to re-do the delegation. I had tried my best to search the db-wg list archives for a similar discussion before writing this entry but could find nothing of substance, please forgive me if this has been discussed before and perhaps decided on :) Best, -- Kjartan, AS51019 +354 784-0020 kjh14(a)hi.is

2 1