- db-wg - mailman.ripe.net

Hierarchical authorization proposal
by David.Kessens＠ripe.net 26 Jan '96

26 Jan '96

Dear all, We are already talking for quite some time about a hierarchical authorization scheme for objects in the RIPE database that need protection against creating objects in somebody else's address/domain space. Hereby, I want to describe the requirements for such a new feature and two possible solutions. Problem description: Currently, we see more and more problems with objects that are (usually by accident) created in another registries address space or problems with domain objects where people think that a domain is delegated to them when they have send a domain object to the RIPE database. It seems that, since we are using to much time for this kind of issues, the time has arrived that we need to solve the problem. Requirements: Objects that are directly located in a predefined hierarchy under a certain object need an extra authorization step before they can be created. The authorization step should be defined by the object that is located in the hierarchy directly above the object. The authorization step will be done on all objects that are located directly above the object if we have more then one object directly above the object (this should generally not be the case). The hierarchical authorization step seems not to be needed (yet) for updating/deleting an object in the hierarchy. However, the design should be able to be extended in such a way that this feature can be added in the future if the need arises. Currently we are dealing with three hierarchies: 1) Domain space hierarchy The definition of the domain hierarchy is straight forward: A domain consists of text strings concatenated with dots An domain is 'above' another domain when all text strings match with the other domain from the right and they are not the same. An domain is 'directly above' another domain when it is above the other domain and differs only with one text string. The definition for '(directly) below' another domain follows from the definition for above: An domain is '(directly) below' another domain when the other domain is above the domain. Example: 'x1.office.ripe.net' is below 'ripe.net' 'x1.office.ripe.net' is directly below 'office.ripe.net' 'ripe.net' is above 'x1.office.ripe.net' 'office.ripe.net' is directly above 'x1.office.ripe.net' 2) IP address space range hierarchy for 'inetnum:' objects An IP address space range is a little bit more complicated since we can have overlapping ranges: A range is 'above' another range when the range is larger then the other range and it overlaps it completely. A range is 'directly above' another range when it is the smallest possible range that is still above the object. The definition for '(directly) below' another range follows from the definition for above: A range is '(directly) below' another range when the other range is above the range. People might consider that there exists a problem when we are dealing with partially overlapping ranges (not possible with prefix notation ranges but are possible with normal IP address space range notation). However, the definition handles this problem gracefully: a range can only below or above another range when they overlap each other *completely*. Example: In IP address space range notation: '194.0.0.0 - 194.255.255.255' is 'above' '194.5.20.0 - 194.5.20.255' '194.5.20.0 - 194.5.23.255' is only 'directly above' '194.5.20.0 - 194.5.20.255' when there are no other ranges that are bigger and also 'above' '194.5.20.0 - 194.5.20.255'. '194.5.20.0 - 194.5.20.255' is 'below' '194.0.0.0 - 194.255.255.255' '194.5.20.0 - 194.5.20.255' is only 'directly below' '194.5.20.0 - 194.5.23.255' when there are no other ranges that are 'above' '194.5.20.0 - 194.5.20.255' and 'below' '194.5.20.0 - 194.5.23.255'. In prefix notation ranges: '194/8' is 'above' '194.5.20/24' '194.5.20/22' is only 'directly above' '194.5.20/24' when there are no other ranges that are bigger and also 'above' '194.5.20/24'. '194.5.20/24' is 'below' '194/8' '194.5.20/24' is only 'directly below' '194.5.20/22' when there are no other ranges that are 'above' '194.5.20/24' and 'below' '194.5.20/22'. 3) Route object hierarchy At first sight a 'route:' object has the same hierarchy as for 'inetnum:' objects. However, a 'route:' object has in fact a two level hierarchy: The origin AS object is always the object directly above a certain 'route:' object. An all route objects with a given origin are always directly below the origin AS object. Proposed solutions: 1) New attribute for hierarchical organized objects: Add an optional multiple line attribute to hierarchical organized objects that points to the maintainer object which authorization scheme will be used when an object will be created 'directly below' the object. mnt-lower: MAINTAINER [ ( CREATE & CHANGE & DELETE ) ] MAINTAINER - The maintainer that defines the authorization scheme to be used when an object 'directly below' in the hierarchy from the object, that has defined this attribute, will be created in addition to the authorization schemes that are defined in the to be created object itself. The maintainer will optionally be followed by a specification upon which events the authorization needs to be used: CREATE - perform the authorization step when an object is created 'directly below' the object. CHANGE - perform the authorization step when an object is changed 'directly below' the object. DELETE - perform the authorization step when an object is deleted 'directly below' the object. When no events are specified, the default behavior will be used, that is: perform the authorization only upon creation of objects directly below the object. This attribute is optional for objects that have a hierarchy defined. Currently, there is a hierarchy defined for: 'domain', 'route' and 'inetnum' objects. Multiple attributes may be defined and will mean that at least one of the authorization methods as mentioned in the referenced maintainers should allow the database update. Example: RIPE can have the following object: inetnum: 194.0.0.0 - 194.255.255.255 descr: RIPE - ALLOCATED BLOCK mnt-by: RIPE-NCC-MNT mnt-lower: RIPE-NCC-MNT (CREATE | DELETE) RIPE can allocate address space to a local registry and hand over the authority for the address space below. Note that the registry can not delete or create it's allocated address space object but may change it's contents. inetnum: 194.10.0.0 - 194.10.255.255 descr: ALLOCATED BLOCK to LOCAL REGISTRY mnt-by: LOCAL-REGISTRY-MNT mnt-lower: LOCAL-REGISTRY-MNT (CREATE | DELETE) Then the registry can register it's customers as follows: inetnum: 194.10.3.0 - 194.10.3.255 descr: CUSTOMER of local registry The customer may change their object but cannot create/delete it: 2) New attribute for maintainer object: Another solution would be to add an optional multiple line 'scope:' attribute to the maintainer object that will specify that the authorization scheme should be used when objects are created, changed or deleted 'directly below' the object that references the maintainer. At first glance, this solution looks attractive but will not allow for hand-over of authority as can be done in the first proposal. scope: WORKINGAREA [ ( CREATE & CHANGE & DELETE ) ] WORKINGAREA - Can be LOCAL or LOWER. LOCAL is the default behavior and is the same as the 'maintainer' object currently works. LOWER would do the authorization step when objects are created, changed or deleted directly below the hierarchical object that references the maintainer. CREATE, CHANGE, DELETE will work as specified in the previous proposal. Note that it will also extend the possibilities for the maintainers when used in LOCAL mode (the way maintainers work now): 'LOCAL (CREATE & CHANGE & DELETE)' matches the current maintainer behavior. The attribute is optional for maintainer objects. We could decide to allow the use of this attribute also for the hierarchical organized objects. It will then override the default behavior as specified in the maintainer object. The attribute can be used twice: one time for the LOCAL scope and one time for the hierarchical authorization method (LOWER). Example: RIPE can have the following object: inetnum: 194.0.0.0 - 194.255.255.255 descr: RIPE - ALLOCATED BLOCK mnt-by: RIPE-NCC-MNT mntner: RIPE-NCC-MNT scope: LOCAL (CREATE & CHANGE & DELETE) scope: LOWER (CREATE & DELETE) RIPE can allocate address space to a local registry and hand over the authority for the address space as below. Note that the registry can not delete or create it's allocated address space object but may change it's contents. inetnum: 194.10.0.0 - 194.10.255.255 descr: ALLOCATED BLOCK to LOCAL REGISTRY mnt-by: LOCAL-REGISTRY-MNT mntner: LOCAL-REGISTRY-MNT scope: LOCAL (CREATE & CHANGE & DELETE) scope: LOWER (CREATE & DELETE) Then the registry can register it's customers as follows: inetnum: 194.10.3.0 - 194.10.3.255 descr: CUSTOMER of LOCAL registry The customer may change their object but cannot create/delete it: Discussion: Both proposals solve the problem. Both proposals will have the same implementation complexity. But there of course also some differences: Proposal 1: This solution is probably clearest and easiest to the user by using a special attribute in the objects in the hierarchy itself instead of hiding it in the maintainer object. Of course this is also the weakness: a maintainer object that looks the same may behave differently depending on the context in which it is used. Also, when we introduce the new scheme many objects need an update (this might be an advantage or an disadvantage depending on how you view things...). Furthermore, most objects will again get an extra attribute defined. Proposal 2: The mechanism is hidden for the user and therefore might be less clear. The maintainer object will be the only object that defines authorization policies. We can introduce the mechanism rapidly by just adding an attribute to the maintainer object (In RIPE's case: we only need to add an attribute to our maintainer object to protect the whole RIPE database against unauthorized allocations/assignments in our space). We don't get extra attributes defined for the normal objects. Note that we think that we should choose the best mechanism, even if introducing might be somewhat more complex. The extra workload for proposal one seems not that much more. Expected implementation problems: Implementation for the IP address space notation ranges that are used in 'inetnum' objects will not be trivial due to the internal workings of the database for 'classless' lookups. You probably don't know the details but for the people that are interested: The IP address space ranges are internally converted to prefix notation. When, they don't fit in one prefix, more prefixes are generated. In that case we can get in trouble with overlapping objects that might be found as directly above instead of the correct object. I think it is possible to solve but it will needs some more work then expected at first sight. Please let us know if there exist better solutions or that changes are needed, or just make your choice! David Kessens RIPE NCC

1 0

RIPE Action 21.9: Fwd: E-J B: Draft doc m.cast router in routing reg.
by Wilfried Woeber, UniVie/ACOnet 25 Jan '96

25 Jan '96

FYI, this is the original proposal as circulated by Erik-Jan Bos. -Wilfried. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Subject: Draft document multicast router in routing registry From: Erik-Jan Bos <erik-jan.bos(a)surfnet.nl> Date: Sun, 07 May 1995 11:49:46 +0200 Mbone-EU, please find below a first version of a document describing a multicast router in a routing registry. I would like to have your comments and we can discuss it at the next Mbone WG meeting. I realize some of you might not have a chance to read it before the meeting. Well... here it is, I'll try to bring copies to the meeting. See you in Rome. --- Start of document A Multicast Router in the Routing Registry Erik-Jan Bos Document ID: ripe-nnn May, 1995 **** DRAFT ** WORK IN PROGRESS ** DRAFT **** ABSTRACT This document describes an addition to ripe-122 (Specifying an "Internet Router" in the Routing Registry) in which it is possible to define a multicast capable Internet routing within a routing registry. 1. Introduction With the growing of the Mbone worldwide, managing the Mbone becomes a complex task. The multicast-bone is starting to suffer from problems that used to be present in the unicast-bone several years ago, such as routing coordination. Today, registries are available for administering policies and routes and routers [1]. Tools are availble [2,3] for checking and analyzing the real world against what is registered. The Mbone could and should benefit from these technologies coming from the unicast world. The features of the specification described in this document will be usable e.g. in the RIPE Data Base, after review by the RIPE Data Base WG. After implementation tools could be developed for mapping and analyzing the Mbone. Furthermore, administrative details (such as contact person) are easily administered by well known procedures and easily retrievable. 2. Multicast routers versus unicast routers An "Internet Router" or a "gateway" in the current version of IP (IPv4) can be defined as follows [4]: "Gateways in the Internet form a cooperative, interconnected structure. Datagrams pass from gateway to gateway until they reach a gateway that can deliver the datagram directly." This definition can be applied to both unicast and multicast routers. Since both a unicast and multicast router are fulfilling the "Internet Router" function for different natures of traffic, there is no need for a special routing registry data base object. Moreover, both functions could be present in the same box. 3. Multicast router specification Since an Internet Router can perform both types of routing, this fact should be registerable in the routing registry. Each router is uniquely defined by by its object name, also known as the fully qualified domain name. Below is an example of a internet router object, specifying a multicast router: inet-rtr: broodjeham.surfnet.nl localas: AS1103 ifaddr: 192.87.106.102 255.255.255.0 ifaddr: 192.87.4.99 255.255.255.0 mpeer: 192.87.108.13 16 1 admin-c: Erik-Jan Bos tech-c: Henk Steenman notify: netmaster(a)surfnet.nl remarks: SURFnet Multicast router changed: Erik-Jan.Bos(a)surfnet.nl 950505 source: RIPE Several pieces of important information are present in this object. First of all there is the FQDN of the router, acting as object name. The Home Autonomous System Number is shown, which for a multicast router is merely for identification purposes only. Furthermore, the ifaddr:-lines show that this router has two interfaces, in two different networks. Finally, the DVMRP peers are shown with IP address, treshold and metric. All other attributes are common to other objects already defined for a routing registry [1]. For exact syntax definition see next chapter. 4. Multicast router Syntax Definition The multicast capable router object is defined here. Each of the possible attributes are shown, on a single line. The second column defined whether the attribute must be present [mandatory] of could be present [optional]. The third column defines whether exactly one line is allowed [single] or that more than one line of the same attribute is allowed [multiple]. In case an attribute has more lines than one, the name of the attribute must be repeated on each line. inet-rtr: [mandatory] [single] localas: [mandatory] [single] ifaddr: [mandatory] [multiple] mpeer: [mandatory] [multiple] admin-c: [mandatory] [multiple] tech-c: [mandatory] [multiple] notify: [optional] [multiple] remarks: [optional] [multiple] changed: [mandatory] [multiple] source: [mandatory] [single] Each attribute has the following syntax: inet-rtr: The fully qualified domain name of the router. localas: The Autonomous System to which the router belongs. ifaddr: An interface IPv4 address of the router. mpeer: A multicast peering of the router. Format: <mpeer address> <mpeer treshold> <mpeer metric> Example: mpeer: 192.87.108.13 16 1 Status: mandatory, multiple instances allowed. admin-c: Full name or uniquely assigned NIC-handle of a contact person for administrative matters. tech-c: Full name or uniquely assigned NIC-handle of a contact person for technical matters. notify: An e-mail address to which notifications of changes to this object should be send. remarks: Remarks or comments, for clarification purposes only. changed: The e-mail address and date of a change. source: Source of the information. 5. Acknowledgements This specification, being an addition to ripe-122, leans on the specification done by the author of ripe-122. Credits go to Tony Bates. Furthermore, the RIPE Mbone WG has done reviewing of this document and they receive credits as well. 6. Security considerations Security is not considered in this document. 7. References [1] Bates, Tony, "Specifying an Internet Router in the Routing Registry", ripe-122, October 1994. On-line at URL: ftp://ftp.ripe.net/ripe/docs/ripe-122.txt [2] PRIDE Tools Release 1. On-line at URL: ftp://ftp.ripe.net/pride/tools/pride-tools-1.tar.Z [3] Merit Inc. RRDB Tools. On-line at URL: ftp://rrdb.merit.edu/pub/meritrr [4] Douglas Comer, "Internetworking with TCP/IP", Prentice-Hall, 1988. ISBN: 0-13-470188-7. --- End of document __ Erik-Jan. --------------------------------------------------------------------------------

1 0

RIPE Action 21.9: proposal for an ext. of inet-rtr (Mbone R.)
by Wilfried Woeber, UniVie/ACOnet 25 Jan '96

25 Jan '96

There is a fairly old action on Eric-Jan and me to circulate a proposal on extending the definition for the RIPE Database router object inet-rtr: The original definition is documented in ripe-122. The background for the proposed extension is the discussion about documenting the routing of "overlay" networks, most prominently the Mbone. Quite a while ago Erik-Jan Bos circulated a proposal to extend inet-rtr: with an mpeer: attribute. This proposed mpeer: attribute is/was intended to specifically document Mbone DVMRP tunnels. [ I'm going to re-distribute this paper in a separate message for those of you who don't have a copy readily available ] Further discussion revealed that by rearranging and extending the definition of the *existing* peer: attribute there is a possibility to make the concept even more general and potentially covering IP over IP, STUN, whatever. At the same time we could avoid inventing just another attribute. The current use of the attribute is: peer: <Peer address> <Peer AS> <Routing Protocol> [localAS ASnumber] The generalisation would involve changing that definition to peer: <Peer address> <Peer protocol> <peer-proto-specific info> So for the good old BGP peering this might then look like: peer: 192.87.4.6 BGP4 AS2122 localAS AS2121 for an Mbone tunnel this might be peer: 192.87.4.6 DVMRP metric thresh and for an IP-over-IP even peer: 192.87.4.6 IP Unfortunately this approach would require a non-compatible change to the existing peer: attribute. How many tools would be affected? What's the expected effort to fix these tools? Your opinions and input wrt to the concept and the proposal to change the peer: definiton for BGP peerings is appreciated - before we spend too much effort on the details.... Regards Wilfried -------------------------------------------------------------------------- Wilfried Woeber : e-mail: Woeber(a)CC.UniVie.ac.at Computer Center - ACOnet : Vienna University : Tel: +43 1 4065822 355 Universitaetsstrasse 7 : Fax: +43 1 4065822 170 A-1010 Vienna, Austria, Europe : NIC: WW144 --------------------------------------------------------------------------

1 0

1st draft: proposed agenda - DB-WG at RIPE 23, Amsterdam
by Wilfried Woeber, UniVie/ACOnet 25 Jan '96

25 Jan '96

This is the 1st proposal of a draft agenda for the Database-WG at RIPE 23 in Amsterdam. **Message to the NCC WG scheduling department: If at all possible - please have the DB-WG meeting slot(s) scheduled near the end of the WG stream(s). Thank you! I'd propose to have 2 sessions, - one for the more formal items (A. - D., Y., Z.) and - another one for the more general aspects (E., F., G.). The "general aspects" session should probably precede the formal one. As always, additons, comments, etc. welcome! Apologies if I missed something obvious... See you, Wilfried. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Draft Agenda: Database-WG, RIPE 23, Amsterdam, NL ------------------------------------------------------ A. Administrative stuff - volunteering of the scribe - WG-agenda bashing B. DB-SW report - general status report - "realtime" shadowing - hierarchical authorisation for creation and update - backlink implementation - automatic handle assignment C. DB-Objects and attributes - referral mechanisms and distribution of authoritative data - stored/processed attribute (A: 19.12) - do we want/need a registry object? - mcast extensions for inet-rtr:, peer: attribute (A: ) - ROLE/NOC object, handling of lookup recursion - URL attribute? (credits for the idea to Erik-Jan Bos) D. Copyright for the RIPE-DB proposal to have every whois query return % data is copyrighted, and a pointer to the (C) definition of comment and/or meta-characters (%, #, *) ? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ E. Databases and registries interoperation brainstorming about needs, methods,... the 192 review project by B.Manning quality control of data, duplicates alert, fuzzy matching... uniqueness of names across databases (AS macros, route) references to data in a different database common update mechanism for "all" databases (multiple source: values? auto forwarding?) proposal for a coordinated development project? F. User Interfaces Tools online documentation G. Authentication and security ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Y. Input from other WGs Z. AOB Draft 1.0, 23-JAN-1996 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

2nd draft: proposed agenda - DB-WG at RIPE 23, Amsterdam
by Wilfried Woeber, UniVie/ACOnet 24 Jan '96

24 Jan '96

This is the 2nd proposal of a draft agenda for the Database-WG at RIPE 23 in Amsterdam. Thanks to David who identified the lack of an item on the country: attribute. For consistency reasons we propose to move the item on the use of URLs next to "referral" and to aggregate stuff that requires input from other WGs at the end. Changes are marked with the bar "|" character. I'd propose to have 2 sessions, - one for the more formal items (A. - D., Y., Z.) and - another one for the more general aspects (E., F., G.). The "general aspects" session should probably precede the formal one. As always, additons, comments, etc. welcome! See you, Wilfried. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Draft Agenda: Database-WG, RIPE 23, Amsterdam, NL ------------------------------------------------------ A. Administrative stuff - volunteering of the scribe - WG-agenda bashing B. DB-SW report - general status report - "realtime" shadowing - hierarchical authorisation for creation and update - backlink implementation - automatic handle assignment C. DB-Objects and attributes - referral mechanisms and distribution of authoritative data | - URL attribute? (credits for the idea to Erik-Jan Bos) - stored/processed attribute (A: 19.12) | - country: attribute, semantics (and syntax?) - ROLE/NOC object, handling of lookup recursion D. Copyright for the RIPE-DB proposal to have every whois query return % data is copyrighted, and a pointer to the (C) definition of comment and/or meta-characters (%, #, *) ? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ E. Databases and registries interoperation brainstorming about needs, methods,... the 192 review project by B.Manning quality control of data, duplicates alert, fuzzy matching... uniqueness of names across databases (AS macros, route) references to data in a different database common update mechanism for "all" databases (multiple source: values? auto forwarding?) proposal for a coordinated development project? F. User Interfaces Tools online documentation G. Authentication and security ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Y. Input from other WGs | - combined registry/maintainer object? (input from the Local-IR WG) | - mcast extensions for inet-rtr:, peer: attribute (A: ) Z. AOB Draft 1.1, 24-JAN-1996 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

RE: Proposal for extended syntax for the 'country:' attribute
by Christian Panigl, ACOnet/UniVie +43 1 4065822-383 20 Jan '96

20 Jan '96

>Date: Fri, 19 Jan 1996 18:59:03 MET >From: "Wilfried Woeber, UniVie/ACOnet" <Wilfried.Woeber(a)cc.univie.ac.at> > >> Anyhow, of course it should be kept if there is any use for it ! But I >> don't think that introducing an additional provider *attribute* within >> the inetnum object will need the design-work for a provider *object* to >> be finished. The only thing that should be finished is the decision >> about the provider IDs which will be used as a DB key. > > Are you really talking "provider" (ISP) or are you talking "registry"? > In many cases these happen to be the same (organisation) but this is > not required. Sorry for the mixup: "registry" (LIR) of course ! > I think that we don't need the LIR info in objects describing > *assigned* addresses because the IR that performed the assignment can > be identified by looking at the less specific object(s). Yes, nevertheless I would like it, because 1. it would simplify lookups 2. it would emphasize that the address is *assigned* to a customer but still bound to a specific LIR (if this is politically correct ?) ! >> Ok, let's finish this sidestep and find a solution for the country >> attribute. > > I agree. Really now ?-) However, we should restart the discussion after the "country" stuff has been solved. > The provider (or TLD admin) concept might become interesting again when > we start to talk about hierarchical authorization for object creation, > like route objects and domain objects :-) Oh yea. Christian --- Christian Panigl : Vienna University Computer Center - ACOnet --- --- VUCC - ACOnet : -------------------------------------------- --- --- Universitaetsstrasse 7 : Internet: Christian.Panigl(a)CC.UniVie.ac.at --- --- A-1010 Vienna / Austria : Tel: +43 1 4065822-383 (Fax: -170) ---

1 0

RE: Proposal for extended syntax for the 'country:' attribute
by Wilfried Woeber, UniVie/ACOnet 19 Jan '96

19 Jan '96

> My idea was just because I think that it is already more important to > which registry/provider a network belongs than to which country, unless > you want to introduce Internet customs based on country borders ;-) I prefer to *not* mix things like *allocations* held by *local IRs* (this is administrative stuff) with things like networks having a particular range of addresses *assigned* and *used* in a limited number of countries and being connected to the Internet by some *ISP(s)*. Btw Christian, you probably know my position wrt borders, customs and taxes :-) > Anyhow, of course it should be kept if there is any use for it ! But I > don't think that introducing an additional provider *attribute* within > the inetnum object will need the design-work for a provider *object* to > be finished. The only thing that should be finished is the decision > about the provider IDs which will be used as a DB key. Are you really talking "provider" (ISP) or are you talking "registry"? In many cases these happen to be the same (organisation) but this is not required. I think that we don't need the LIR info in objects describing *assigned* addresses because the IR that performed the assignment can be identified by looking at the less specific object(s). > Ok, let's finish this sidestep and find a solution for the country > attribute. I agree. The provider (or TLD admin) concept might become interesting again when we start to talk about hierarchical authorization for object creation, like route objects and domain objects :-) Wilfried.

1 0

RE: Proposal for extended syntax for the 'country:' attribute
by Christian Panigl, ACOnet/UniVie +43 1 4065822-383 19 Jan '96

19 Jan '96

>Date: Fri, 19 Jan 1996 17:34:17 MET >From: "Wilfried Woeber, UniVie/ACOnet" <Wilfried.Woeber(a)cc.univie.ac.at> > > I'm reluctant to let go of the well-established use of the country: > attribute. > > I'm looking forward to the time when we might have more flexible > selection criteria for the DB, and I think loosing country information > isn't a good idea. My idea was just because I think that it is already more important to which registry/provider a network belongs than to which country, unless you want to introduce Internet customs based on country borders ;-) Anyhow, of course it should be kept if there is any use for it ! But I don't think that introducing an additional provider *attribute* within the inetnum object will need the design-work for a provider *object* to be finished. The only thing that should be finished is the decision about the provider IDs which will be used as a DB key. Ok, let's finish this sidestep and find a solution for the country attribute. Regards Christian

1 0

RE: Proposal for extended syntax for the 'country:' attribute
by Wilfried Woeber, UniVie/ACOnet 19 Jan '96

19 Jan '96

> maybe there is another solution: migrate the "country" attribute to a > "registry" attribute which should hold the responsible registry name <ripe-104++ speak> I think *allocations* should be tagged with the unique NCC RegID, *assignments* should be tagged by [multiple] country codes. </ripe-104++ speak> I'm reluctant to let go of the well-established use of the country: attribute. I'm looking forward to the time when we might have more flexible selection criteria for the DB, and I think loosing country information isn't a good idea. Wilfried. PS: I'm thinking up some pro.s and con.s later :-) -------------------------------------------------------------------------- Wilfried Woeber : e-mail: Woeber(a)CC.UniVie.ac.at Computer Center - ACOnet : Vienna University : Tel: +43 1 4065822 355 Universitaetsstrasse 7 : Fax: +43 1 4065822 170 A-1010 Vienna, Austria, Europe : NIC: WW144 --------------------------------------------------------------------------

1 0

RE: Proposal for extended syntax for the 'country:' attribute
by Christian Panigl, ACOnet/UniVie +43 1 4065822-383 19 Jan '96

19 Jan '96

Hi David, maybe there is another solution: migrate the "country" attribute to a "registry" attribute which should hold the responsible registry name Example: inetnum: 193.0.0.0 - 193.255.255.255 country: RIPE will be modified when entering the DB to inetnum: 193.0.0.0 - 193.255.255.255 registry: RIPE inetnum: 193.170.16.0 registry: at.aconet Pros: Solves the problem completely, is politically correct, easy (?) to implement Cons: will break applications which query for the "country" attribute, are there any ? Alternatively you might add the "registry" attribute and obsolte the country attribute. Regards Christian --- Christian Panigl : Vienna University Computer Center - ACOnet --- --- VUCC - ACOnet : -------------------------------------------- --- --- Universitaetsstrasse 7 : Internet: Christian.Panigl(a)CC.UniVie.ac.at --- --- A-1010 Vienna / Austria : Tel: +43 1 4065822-383 (Fax: -170) ---

2 1