- db-wg - mailman.ripe.net

Implementation plan and dates for NWI5 - Out-of-region ROUTE(6) objects and removal of ASN authorisation for ROUTE(6) object creation.
by Nathalie Trenaman 24 Jul '18

24 Jul '18

Dear colleagues, In February 2018, the RIPE Database Working Group reached consensus on NWI-5 - creating out of region ROUTE(6) objects in the RIPE Database. We will soon be making changes to the way out-of-region objects are handled in the RIPE Database. It's important that database users are aware of these changes and what they mean: 1. The RIPE Routing Registry will no longer support the creation of out-of-region ROUTE(6) and AUT-NUM objects 2. Existing out-of-region objects will have their "source:” attribute changed to "RIPE-NONAUTH” 3. The creation of ROUTE(6) objects will no longer need authorisation from the ASN holder We will implement these changes in the Release Candidate environment on Thursday, 2 August and go to full production on Tuesday, 4 September. Our implementation plan can be found at: https://www.ripe.net/manage-ips-and-asns/db/impact-analysis-for-nwi-5-imple… <https://www.ripe.net/manage-ips-and-asns/db/impact-analysis-for-nwi-5-imple…> The RIPE Database Working Group chairs also wrote a RIPE Labs article that describes the background of NWI-5: https://labs.ripe.net/Members/denis/out-of-region-route-6-and-aut-num-objec… <https://labs.ripe.net/Members/denis/out-of-region-route-6-and-aut-num-objec…> <https://labs.ripe.net/Members/denis/out-of-region-route-6-and-aut-num-objec… <https://labs.ripe.net/Members/denis/out-of-region-route-6-and-aut-num-objec…>> Please contact ,ripe-dbm(a)ripe.net <mailto:ripe-dbm@ripe.net>. if you still have questions after reading the implementation plan. Best regards, Nathalie Trenaman Product Manager RIPE NCC

6 7

Source GRS vs RIPE
by Aftab Siddiqui 18 Jul '18

18 Jul '18

Hi, I would like to understand the difference between these 2 results for the same prefix. Source: GRS https://apps.db.ripe.net/db-web-ui/#/query?bflag=true&source=GRS&searchtext… Source: RIPE https://apps.db.ripe.net/db-web-ui/#/query?bflag&searchtext=188.64.224.0%2F…

7 17

stat.ripe.net down?
by Ronald F. Guilmette 20 Jun '18

20 Jun '18

I've come to rely on the services provided by the stat.ripe.net WHOIS service. Thus it is rather disappointing to find that today, it's down, as least if one is an ordinary sort of bloke like me who is confined to IPv4. % telnet stat.ripe.net whois Trying 193.0.6.150... telnet: connect to address 193.0.6.150: Connection refused Trying 2001:67c:2e8:22::c100:696... telnet: connect to address 2001:67c:2e8:22::c100:696: No route to host telnet: Unable to connect to remote host Did I just miss the memo? Has the stat.ripe.net IPv4 service been taken down deliberately, or is this just a transient sort of outtage? More to the point, what email address should I be writing to in order to make further inquiries about this apparent outtage?

3 2

IRRd re-write
by denis walker 19 Jun '18

19 Jun '18

Colleagues During the current discussion on out-of-region ROUTE objects, Job announced that IRRd is being re-written and will have some 'potentially' fantastic features including 'possibly' authentication against the RIRs number registries. The alternative/commercial IRRs have also been heavily promoted at many points in this discussion as 'the answer' to the current problems. I personally, and some others, have some issues with this. So I thought it appropriate to open a discussion on this issue as it does impact on, or is influenced by, the operation of the RIPE Database. Firstly it is unfortunate that all the RIRs that operate an IRR may not be in a position to accomodate all routing requirements that are currently provided for by the designed security hole in the RIPE Database at the time this security hole will be closed. To push operators to switch to commercial services as the answer simply monetarises routing which, as Randy pointed out, may affect smaller operators more, as perhaps the IPv4 market has done. I looked at the github details of this new IRRd. I get the feeling that this is simply trying to re-invent the RIPE Database software in yet another language. This is being done without the decades of experience, knowledge and understanding that has gone into developing the RIPE Database software on which all 4 IRRs are based that are operated by the RIRs. Job also pointed out that "One of the possible (and desired) extensions is an authorisation link to the authoritative RIR." This suggests some form of cross registry authorisation with/between the RIRs. During the years of debate about these out of region ROUTE objects this has been discussed and virtually dismissed on several occasions. If the RIRs, and certainly the RIPE NCC, are going to devote time, effort and members money to develop some form of authorisation system for a remote IRR to connect to each of the 5 RIR number registries to authorise ROUTE creation, then I personally would prefer to see the development of a single, global IRR operated by the RIRs. This cross registry authorisation is probably the main element of having a single IRR. Currently 4 of the 5 RIRs operate an IRR and they are all based on a version of the RIPE Database software. So we already have a common IRR database format. Add in this cross registry authorisation and we have a global IRR. I don't see the point of putting in the effort to develop a multitude of alternative/commercial IRRs when we can go the other way and have a single, authoritative, free IRR service. We have one internet, one DNS, why not one IRR? I know the first comment is probably going to be, "we already have this with RPKI". But for whatever reason, not all operators use, or want to use, RPKI. That is a reality, just as much as everyone switching to IPv6...not. Since RPKI is not the complete answer, we still need an IRR where the ROUTE objects are validated and trusted. I think the RIRs are in the best position to each develop a trusted IRR linked to their own number registry, then take the leap to create a single IRR. I personally think this is the better way to go than develop secure authorisation modules for IRRd. cheers denis co-chair DB-WG

4 4

Fwd: [ETISALAT DOMAINS TICKET #ZZH-628-73999]: Re: IRRd re-write
by Randy Bush 18 Jun '18

18 Jun '18

could someone unsub these <bleep>s sorry for spamming the list, but the headers have no list whinee address randy

1 0

A test on AFRINIC range announcing without RIPE route object
by Lu Heng 15 Jun '18

15 Jun '18

Dear colleagues, In the past three weeks, we have done some tests on 3 AFRINIC /24 which have been announced in the US, Europe, and Asia, by an ARIN ASN, APNIC ASN, and an RIPE ASN. Test results: If it is a direct announce to NTT, Telia, GTT as a small provider and without route object, announcement will not be accepted. All of them accept RIPE route object. If you announce to one of the telecoms, and that telecom happens to accept your announcement without route object, then all the other telecoms will have to accept the announcement without route object. This is simply because big guys trust each other. In the example we tested, we first announced to NTT directly and got rejected. Then we announce to CN2(next generation enterprise network of China telecom). After this NTT accepted the announcement from China telecom without route object created. Current situation: AFRINIC accepts foreign ASN with manual verification of the ownership of the ASN holder as stated by their hostmaster in the mailing list. If you don't own the ASN, they will not create the route object. Despite this, the process is long and unpractical in daily operation. Some providers do accept RPKI. One can create an AFRINIC RPKI that go though the filter, however, not all provider accept RPKI at the moment. In conclusion, If you employ a non-Afrinic asn for announcements (which means a foreign asn), using RIPE’s route object will be the only choice for you unless you are one of those big telecoms which has the liberty to announce anything as they wish. I am not opposing to the idea of cleaning up the database, but until things get fixed, the current process will only break networks. -- -- Kind regards. Lu

11 46

Re: [db-wg] A test on AFRINIC range announcing without RIPE route object
by denis walker 15 Jun '18

15 Jun '18

Hi All The co-chairs of the DB-WG are talking in the background to the RIRs about how this change will impact the holders of their address space. We are following the points raised here and checking some issues with the appropriate RIRs. The RIPE NCC Database team is also in the loop of these talks so any relevant points can be included in their impact analysis. As some have already said consensus is not unanimity and there is a consensus to close this security hole in the RIPE Database. Even though the security hole will continue to exist in many alternative and commercial IRRs and will continue to be exploited by abusers for some considerable time. cheersdenisco-chair DB-WG

3 3

query related to Open Source wg talk on blockchain
by Sandra Murphy 19 May '18

19 May '18

(A comment about the presentation that I’m asking here because I wasn’t quick enough in typing in the chat window - I was participating remotely.) There was a question at the mike at the very end of the presentation about blockchain, about the purpose for the work. The answer was that the purpose was to protect origin authorization. That got me thinking about the blockchain model vs the RIPE model. In times past, I’ve seen RIPE reminders to their members that they are responsible for their entire allocation, even if some of it is sub-allocated. And I’ve seen training that carefully instructs the members how to use mnt-by, mat-lower, mat-routes, etc., to retain control over the sub-allocation portions of their address space, but give some control to the recipient. And warnings that lack of care may result in losing authority, which would require correction by the database staff. I did find a FAQ for Sub-allocation that says some of this, so hopefully I am not totally off-base. Is that still the RIPE model, that authority over the sub-allocation is more shared than relinquished? If I understand blockchain properly, it presumes a model where control is given up entirely when an object is transferred. No two entities can have authority over an object. Nothing says I’m right about that, either, of course. —Sandy

2 1

Weird IRR entry
by Brian Rak 18 May '18

18 May '18

Seems like this shouldn't have been allowed to be created: route6: 2001:db8::/32 origin: AS10 mnt-by: EJU created: 2018-02-18T06:45:59Z last-modified: 2018-02-18T06:45:59Z source: RIPE

3 2

comment on comment at mic: database "purpose" vs not-globally-routed prefixes
by Sandra Murphy 17 May '18

17 May '18

(Sorry about this. typed the comment into the chat window, hit submit, got “disconnected” error, reconnected, but too late to comment.) The comment at the mic was that there are many IP prefix resources in the database that are not globally routed, and that those objects were not part of the RIPE database purpose as stated. So collection of personal data for those objects could not rely on the RIPE database purpose for justification. I disagree that the lack of current global routing for an IP prefix means the RIPE database purpose of facilitating coordination does not apply. An allocated prefix can be globally announced at any time. So there’s a need to have the data, anyway. In the current state of routing security, an allocated prefix can be globally announced at any time, not necessarily by the legitimate prefix holder. We’ve seen several examples of some ISP announcing a prefix that seemed not to be in use, sometimes even registering a route object for the announcement, and using that prefix for some unfriendly purpose. So there is still a need to have contact data for a prefix even before the legitimate prefix holder decides to globally announce the prefix. —Sandy

2 1