- db-wg - mailman.ripe.net

Solving the issue of rogue ROUTE objects in the RIPE Database
by denis 14 Nov '15

14 Nov '15

Hi All I raised an idea before the last RIPE Meeting but it did not generate a lot of interest at that time. I brought it up again yesterday on the Anti Abuse WG list and it seemed to get quite a bit of support. So I will bring it back to the DB WG as it is a DB issue. I have CC'ed both AA WG and Routing WG for information. But it may be useful to keep the discussion now on the DB WG list. I don't claim this will solve all the problems of the universe, but it does satisfy an immediate goal to have all ROUTE objects in the RIPE Database created with the knowledge and approval of the related resource holders. And I believe it could be implemented in a relatively short space of time giving immediate benefits. cheers denis STEP 1 Any ROUTE object submitted for creation in the RIPE Database involving an out of region resource (address space and/or ASN) where that out of region resource does not exist in the authoritative RIR database (has not been allocated or assigned), reject the creation. The RIPE NCC mirrors the operational data from all the other 4 RIRs. These mirrors are updated daily as well as the RIRs daily stats. It is easy to determine if a resource is registered in the authoritative database. STEP 2 For those ROUTE objects from STEP 1 where the out of region resource does exist, hold the object creation as pending. The mechanism for doing this already exists in the RIPE Database software as it is used for multiple authentications. Lookup the out of region resource(s) in the authoritative database(s) and find the contacts for that resource. Send a notification to those contacts informing them of the pending ROUTE object creation in the RIPE Database. The notification mechanism already exists in the RIPE Database software. If they don't approve, do nothing and the creation request will time out after a week and the object will not be created. If they do approve, respond in some way (many technical options for doing this that the RIPE NCC can choose from). If appropriate approval(s) are received within a week, create the ROUTE object. STEP 3 On a daily basis, for each ROUTE object in the RIPE Database that relates to an out of region resource, check for the continued existence of that resource in the appropriate RIR database. If it no longer exists, delete the ROUTE object from the RIPE Database. STEP 4 This is a one off cleanup of existing ROUTE objects. For all ROUTE objects currently in the RIPE Database that relate to an out of region, existing resource, send the appropriate notifications. For any that no response is received, delete the ROUTE object from the RIPE Database. We can be a bit more generous on the timing for this step and even send multiple reminder notifications to be sure. (Possible) STEP 5 If a delete request is sent to the RIPE Database for a ROUTE object related to out of region address space without the proper authorisation, send a notification to the contacts for the authoritative address space holder. If an appropriate response is received back, delete the ROUTE object. This would simulate the reclaim functionality for RIPE address space holders. AUT-NUM copies Another byproduct of implementing this is that we no longer need to hold copies of AUT-NUM objects in the RIPE Database. The out of region ASN auth requirement is satisfied by the appropriate response to the notification. So all 'foreign' AUT-NUM objects could be immediately deleted. (Or after allowing time for these ASN holders to make sure their routing policy is actually up to date in the authoritative AUT-NUM object.)

10 25

RIPE 71 DB-WG agenda V3
by Piotr Strzyzewski 13 Nov '15

13 Nov '15

Dear DB-WG Members This is the 3rd draft of an agenda for the DB-WG Meeting at RIPE71 at the JW Marriott Bucharest Grand Hotel in Bucharest, Romania. The DB-WG Meeting is scheduled as usual for Thursday, Nov 19th, starting at 14:00 local time, after the lunch break. The length of our timeslot is 90 minutes. For the overall RIPE 71 meeting plan please refer to its most up-to-date version at https://ripe71.ripe.net/programme/meeting-plan/ Although the agenda is fully packed right now, please feel free to comment agenda items or propose additional topics to be discussed both on the mailing list or direct to the WG Chairs at db-wg-chairs(a)ripe.net Looking forward to see you all in Bucharest. All the best, Job, Nigel & Piotr ________________________________________________________________________ A. Administrative Matters [~5 min] . Welcome . select scribe (thanks to Nigel for volunteering again!) . finalise agenda . approval of minutes from previous WG meeting(s) . review of action list (Nigel Titley) B. DB Operational Update (Tim Bruijnzeels, RIPE NCC) [~10 min] C. New and revised DB-Software functionality (Tim Bruijnzeels, RIPE NCC) [~10 min] (proposed, test, deployment) . "changed:" deprecation . Implementation proposal descr line . restrict usage of RIPE-NCC-RPSL-MNT . other aspects D. Personalised authentication update (Tim Bruijnzeels, RIPE NCC) [~10 min] E. Updated Database documentation (Alex Band, RIPE NCC) [~10 min] F. Routing policies vs. reality in BGP (Tomas Hlavacek) [~15 min] G. Afrinic IRR homing project update (Job Snijders/Tim Bruijnzeels, RIPE NCC) [~10 min] Afrinic IRR (Michel Odou) [~10 min] H. ROUTE object authorisation update (Job Snijders) [~5 min] I. Control over associating objects for number blocks (William Sylvester) [~5 min] X. Heads up about recent discussions at db-wg mailing list Y. Input from other Working Groups and/or Task Forces Z. AOB __________________________________________ -- gucio -> Piotr Strzyżewski E-mail: Piotr.Strzyzewski(a)polsl.pl

1 0

Re: [db-wg] Solving the issue of rogue ROUTE objects in
by Sascha Luck [ml] 06 Nov '15

06 Nov '15

the RIPE Database Reply-To: In-Reply-To: <563CC2EB.2040509(a)inex.ie> X-Operating-System: FreeBSD 10.1-RELEASE On Fri, Nov 06, 2015 at 03:10:35PM +0000, Nick Hilliard wrote: >On 06/11/2015 14:00, Sascha Luck [ml] wrote: >personal information is not exported for route: objects, >therefore this does not apply: That's the point Nick, for "verification" of out-of-area contacts, this information would *have* to be exported. In this scheme from other RIRs to the NCC but it would, if the others implemented similar schemes, also be exported from the NCC to other RIRs. rgds, Sascha Luck > >> remarks: **************************** remarks: * >> THIS OBJECT IS MODIFIED remarks: * Please note that all >> data that is generally regarded as personal remarks: * >> data has been removed from this object. remarks: * To >> view the original object, please query the RIPE Database at: >> remarks: * http://www.ripe.net/whois remarks: >> **************************** > >Nick >

1 0

RIPE 71 DB-WG agenda V2
by Piotr Strzyzewski 05 Nov '15

05 Nov '15

Dear DB-WG Members This is the 2nd draft of an agenda for the DB-WG Meeting at RIPE71 at the JW Marriott Bucharest Grand Hotel in Bucharest, Romania. The DB-WG Meeting is scheduled as usual for Thursday, Nov 19th, starting at 14:00 local time, after the lunch break. The length of our timeslot is 90 minutes. For the overall RIPE 71 meeting plan please refer to its most up-to-date version at https://ripe71.ripe.net/programme/meeting-plan/ Although the agenda is fully packed right now, please feel free to comment agenda items or propose additional topics to be discussed both on the mailing list or direct to the WG Chairs at db-wg-chairs(a)ripe.net Looking forward to see you all in Bucharest. All the best, Job, Nigel & Piotr ________________________________________________________________________ A. Administrative Matters [~5 min] . Welcome . select scribe (thanks to Nigel for volunteering again!) . finalise agenda . approval of minutes from previous WG meeting(s) . review of action list (Nigel Titley) B. DB Operational Update (Tim Bruijnzeels, RIPE NCC) [~10 min] C. New and revised DB-Software functionality (Tim Bruijnzeels, RIPE NCC) [~10 min] (proposed, test, deployment) . "changed:" deprecation . Implementation proposal descr line . restrict usage of RIPE-NCC-RPSL-MNT . other aspects D. Personalised authentication update (Tim Bruijnzeels, RIPE NCC) [~20 min] E. Updated Database documentation (Alex Band, RIPE NCC) [~10 min] F. Routing policies vs. reality in BGP (Tomas Hlavacek) [~15 min] G. Afrinic IRR homing project update (Job Snijders/Tim Bruijnzeels, RIPE NCC) [~10 min] H. ROUTE object authorisation update (Job Snijders) [~5 min] I. Control over associating objects for number blocks (William Sylvester) [~5 min] Y. Input from other Working Groups and/or Task Forces Z. AOB __________________________________________ -- gucio -> Piotr Strzyżewski E-mail: Piotr.Strzyzewski(a)polsl.pl

1 0

Re: [db-wg] Database release 1.83 deployed to RC environment
by Alexander Stranzky 02 Nov '15

02 Nov '15

Am 02.11.15 um 12:00 schrieb db-wg-request(a)ripe.net: > Dear colleagues, > > We are happy to announce the deployment of RIPE Database software release 1.83 to the Release Candidate (RC) environment, which has gone live on Friday 30 October. > > - When deleting a person object, you will be prompted to also delete the associated maintainer if it has no other dependencies Does this affect REST API calls in any way? > - When trying to delete an object that is still referenced, you will get a list of blocking objects How does the REST API implement that? Does it send the objects along the error message(s) or can either part be omitted? Best regards, Alexander Stranzky -- velia.net Internetdienste GmbH * Hessen-Homburg-Platz 1 * D-63452 Hanau Geschäftsführer: Franz G. Köhler, Arek Akilli * AG Hanau * HRB 7588 Tel: +49 6181-1898119 * Fax: +49 6181-1898117 * http://www.velia.net Follow us on twitter: https://twitter.com/velia_net

2 1

RIPE 71 DB-WG agenda V1
by snash 28 Oct '15

28 Oct '15

Can we please consider whether there is consensus on the response to Job's presentation in RIPE70, regarding authority to permit an AS to originate a route. This has been discussed in the "Temporary Origins" thread. Regards Steve Nash ------------------------------ Date: Tue, 27 Oct 2015 14:58:57 +0100 From: Piotr Strzyzewski <Piotr.Strzyzewski(a)polsl.pl> To: db-wg(a)ripe.net Subject: [db-wg] RIPE 71 DB-WG agenda V1 Message-ID: <20151027135857.GE21621(a)hydra.ck.polsl.pl> Content-Type: text/plain; charset=utf-8 Dear DB-WG Members This is the 1st draft of an agenda for the DB-WG Meeting at RIPE71 at the JW Marriott Bucharest Grand Hotel in Bucharest, Romania. The DB-WG Meeting is scheduled as usual for Thursday, Nov 19th, starting at 14:00 local time, after the lunch break. The length of our timeslot is 90 minutes. For the overall RIPE 71 meeting plan please refer to its most up-to-date version at https://ripe71.ripe.net/programme/meeting-plan/ Please feel free to comment agenda items or propose additional topics to be discussed both on the mailing list or direct to the WG Chairs at db-wg-chairs(a)ripe.net Looking forward to see you all in Bucharest. All the best, Job, Nigel & Piotr ________________________________________________________________________ A. Administrative Matters [~5 min] . Welcome . select scribe (thanks to Nigel for volunteering again!) . finalise agenda . approval of minutes from previous WG meeting(s) . review of action list (Nigel Titley) B. Database Operational Update (Tim Bruijnzeels, RIPE NCC) [~10 min] C. New and revised DB-Software functionality (Tim Bruijnzeels, RIPE NCC) [~30 min] (proposed, test, deployment) D. Personalised authentication update (Tim Bruijnzeels, RIPE NCC) [~10 min] E. Updated Database documentation (Alex Band, RIPE NCC) [~10 min] F. Routing policies vs. reality in BGP (Tomas Hlavacek) [~15 min] G. Afrinic IRR homing project update (Job Snijders/Tim Bruijnzeels, RIPE NCC) [~10 min] Y. Input from other Working Groups and/or Task Forces Z. AOB __________________________________________ -- gucio -> Piotr Strzy?ewski E-mail: Piotr.Strzyzewski(a)polsl.pl ------------------------------

2 1

RIPE 71 DB-WG agenda V1
by Piotr Strzyzewski 27 Oct '15

27 Oct '15

Dear DB-WG Members This is the 1st draft of an agenda for the DB-WG Meeting at RIPE71 at the JW Marriott Bucharest Grand Hotel in Bucharest, Romania. The DB-WG Meeting is scheduled as usual for Thursday, Nov 19th, starting at 14:00 local time, after the lunch break. The length of our timeslot is 90 minutes. For the overall RIPE 71 meeting plan please refer to its most up-to-date version at https://ripe71.ripe.net/programme/meeting-plan/ Please feel free to comment agenda items or propose additional topics to be discussed both on the mailing list or direct to the WG Chairs at db-wg-chairs(a)ripe.net Looking forward to see you all in Bucharest. All the best, Job, Nigel & Piotr ________________________________________________________________________ A. Administrative Matters [~5 min] . Welcome . select scribe (thanks to Nigel for volunteering again!) . finalise agenda . approval of minutes from previous WG meeting(s) . review of action list (Nigel Titley) B. Database Operational Update (Tim Bruijnzeels, RIPE NCC) [~10 min] C. New and revised DB-Software functionality (Tim Bruijnzeels, RIPE NCC) [~30 min] (proposed, test, deployment) D. Personalised authentication update (Tim Bruijnzeels, RIPE NCC) [~10 min] E. Updated Database documentation (Alex Band, RIPE NCC) [~10 min] F. Routing policies vs. reality in BGP (Tomas Hlavacek) [~15 min] G. Afrinic IRR homing project update (Job Snijders/Tim Bruijnzeels, RIPE NCC) [~10 min] Y. Input from other Working Groups and/or Task Forces Z. AOB __________________________________________ -- gucio -> Piotr Strzyżewski E-mail: Piotr.Strzyzewski(a)polsl.pl

1 0

Database release 1.82 deployed to RC environment
by Trudy Prins 19 Oct '15

19 Oct '15

Dear colleagues, We are happy to announce the deployment of RIPE Database software release 1.82 to the Release Candidate (RC) environment. We plan to deploy this version to production on Wednesday 14 October. This release introduces a number of features on the internal API of the RIPE Database that were needed to support the automatic updating of placeholder objects when resources are transferred into or out of the RIPE region. This release should not introduce any publicly visible changes, but we encourage all of you to test the new release in the RC environment. Note that the previous release 1.81 has not been deployed to production. While testing in the RC environment, we found a number of small issues in the User Interface (UI) that we will fix shortly. Technically the UI is not part of the core whois, but version 1.81 introduces a number of changes to the internal API in support of the new UI. Since that UI is not deployed now, there is no need to deploy 1.81 now either. And to avoid doing unnecessary upgrades of the production environment it was decided to skip this release, and deploy these changes only when 1.82 is deployed. Please let us know if you have any questions or comments. Kind regards, Trudy Prins Manager Software Engineering RIPE NCC

2 1

Feedback on updated Database documentation
by Alex Band 14 Oct '15

14 Oct '15

Dear working group, I have an ongoing project to write RIPE Database documentation that is clear and readable, focussing on achieving your goal and offer best practices. I've got a bit of a collection going now: Setting up maintainers and hierarchical authorisation: https://www.ripe.net/manage-ips-and-asns/db/support/security/maintainers The different authentication methods for the RIPE Database: https://www.ripe.net/manage-ips-and-asns/db/support/security/protecting-data Configuring Reverse DNS: https://www.ripe.net/manage-ips-and-asns/db/support/configuring-reverse-dns Managing route objects in the IRR: https://www.ripe.net/manage-ips-and-asns/db/support/managing-route-objects-… I'd really like feedback from you, the users of the RIPE Database, to understand how usable it is and what needs clarifications, diagrams, examples, corrections or additions. I'd also love to hear which topic I should cover next. Thanks, and have a good weekend! -Alex

1 1

Interruption of RIPE Database and Related Services
by Trudy Prins 05 Oct '15

05 Oct '15

Dear colleagues, Starting at approximately 14:30 UTC on 4 October 2015, RIPE Database queries and updates, the LIR Portal and other related services experienced problems. Our investigation found that the service interruptions were due to a hardware failure. The queries were restored at 16:00 UTC and other affected services were restored at around 21:00 UTC. The ability of the RIPE Database to process incoming mail-updates was restored at 12:30 UTC on 5 October 2015. Please be aware that all mail-updates sent to Whois during this outage period must be considered lost. A summary of the hardware failure is as follows: The RAID controller on the master MySQL server reinitialised all of a sudden, causing IO errors. Unfortunately, we also experienced another (unrelated) hardware problem at the same time with the external load balancers. This combination of issues significantly affected the time it took us to rectify the situation. We apologise for any inconvenience this may have caused. Kind regards, Trudy Prins Software Engineering Manager

1 0