- db-wg - mailman.ripe.net

New Document available: ripe-130
by RIPE NCC Document Annoucement Service 29 Aug '95

29 Aug '95

New/Revised RIPE Document Announcement -------------------------------------- A revised/new document is available from the RIPE document store. Ref: ripe-130 Title: The advisory attribute Author: David Kessens, RIPE NCC Date: 1 August 1995 Format: TXT=3230 bytes Obsoletes: Obsoleted by: Updates: ripe-181 Updated by: Old: Short content description ------------------------- This document describes the advisory attribute of the route object. FTP Access ---------- All RIPE documents and Internet RFC`s are available via anonymous FTP from host ftp.ripe.net. Type "ftp ftp.ripe.net". Login with username "anonymous" supplying your email address as the password. After logging in, type "cd ripe/docs/" followed by the command "get filename". The relevant filenames for this document are: ripe-130.txt for the ASCII version ripe-130.ps for the PostScript version Electronic Mail Retrieval of Documents -------------------------------------- Documents can also be retrieved from the RIPE document store using a mail server program. For more information on how to use the program, send email to: mail-server(a)ripe.net with "send HELP" in the body text. RIPE NCC Interactive Information Server --------------------------------------- Type "telnet info.ripe.net". This is a menu driven service allows the document store to be browsed. After reading documents you are prompted as to whether you would like to receive an email copy of the document you have just read. If you would, you simply enter your email address and the document will be mailed to you. Below are details of alternative methods of access. Gopher Access ------------- The same documents are available via a "gopher" server at "gopher gopher.ripe.net". WAIS Access ----------- There is also a "WAIS" server at wais.ripe.net, where there is a WAIS index for RIPE documents "ripe-docs.src" WWW Access ---------- For those who wish to add this home page at the RIPE NCC to their own customized home pages, it can be accessed as: http://www.ripe.net MIME Mail Reader ---------------- Below is the data which will enable a MIME compliant Mail Reader implementation to automatically retrieve the RIPE document by FTP or mail server. SEND ripe/docs/ripe-130.txt

1 0

RIPE automatic inaddr-arpa checking tool available
by RIPE NCC IN-ADDR. ARPA Role Account 21 Jul '95

21 Jul '95

Dear all, After many requests I have published the inaddr-arpa checking tool I developed at the RIPE NCC. We use it now at RIPE NCC quite for some time and it really saves us a lot of time, although the program is not perfect and still needs some polishing. Beware of changing/adapting the tool too much since I expect to make some big changes in the output format to facilitate further automatic processing. Furthermore, I want to split it in some smaller files and a config file for better maintainability. Of course comments and bug reports are welcome. Please read the included README file for more details. Kind regards, David Kessens RIPE NCC PS I am on vacation during the next two weeks, but I will certainly deal with any comments/bug reports when I return! -------- README for the inaddrtool v0.1 Date: 950719 Author: David Kessens, RIPE NCC NOTE: THE TOOL HAS BEEN MADE PUBLICLY AVAILABLE BECAUSE OF THE LARGE NUMBER OF REQUESTS OF OUR CUSTOMERS TO DO SO. THE TOOL ITSELF HAS PROVEN IT'S USEFULNESS, BUT NOTE THE FACT THAT I EXPECT TO MAKE SOME BIG CHANGES BEFORE RELEASING A FINAL VERSION. ALSO SOME ADD-ON PROGRAMS THAT WILL MAKE IT POSSIBLE TO ADD THE REVERSE DELEGATION CHANGES/REQUESTS AUTOMATICALLY TO (Y)OUR ZONEFILES ARE STILL MISSING. THE PROGRAM IS DESIGNED AS SITE INDEPENT AS POSSIBLE. PLEASE USE THE NORMAL PROCEDURE AS DESCRIBED IN RIPE-105 IF YOU WANT TO DO A REVERSE DELEGATION REQUEST FOR A REVERSE DOMAIN MANAGED BY THE RIPE NCC, BUT SEND YOUR REQUEST TO <AUTO-INADDR(a)RIPE.NET> INSTEAD OF <HOSTMASTER(a)RIPE.NET> Reverse delegation tool (Alpha version!) ---------------------------------------- As of today the RIPE NCC offers an automated method for the submission of reverse zone delegations in 193.in-addr.arpa and 194.in-addr.arpa. The reverse delegation requests and the zone files on all nameservers will be checked automatically. The diagnostics generated by these checks will be returned to you automatically too. This will make you aware of any problems very quickly, so that you can correct them and re-submit your request. The most recent version of the tool is now publicly available at: ftp://ftp.ripe.net/tools/inaddrtool0.1.tar.gz The tool uses some other external programs for gathering the information it needs for checking your zone files: ftp://ftp.ripe.net/tools/ping.tar.Z ftp://ftp.ripe.net/tools/dns/host.tar.Z ftp://ftp.ripe.net/pride/tools/prtraceroute-2.0beta3.shar.gz Installing the software: - uncompress/unzip and untar the tool and the external programs - edit the variables in the source code (if needed): $TESTMODE=1 for testing, 0 for normal use $UPDLOGDIR="Directory for logging the incoming requests"; $ACKLOGDIR="Directory for logging the outgoing acknowledgements"; $FWLOGDIR="Directory for logging the outgoing approved requests"; $MSGQUEUEDIR="Directory for temporarily storing the requests"; $NSNAME="The name of your nameserver"; $NAMESERVERCHECK=; see for details the source code $MAILCMD=; see for details the source code $NICECMD="Your nice program if you want" else use ""; $HUMANMAIL="The E-mail address of the human processing the approved requests and answering questions. When $TESTMODE=1, all mail will be send to this address"; $AUTOMAIL="The E-mail address of the mail box that will auto process incoming requests"; - Put something like: "|/home/user/bin/inaddrtool 2>/dev/null" in the .forward file of user $AUTOMAIL Note: there is *NO* queuing mechanism yet, so beware of overloading your machine with a large number of requests. The input: The tool expects to read an E-mail message from standard input although there is no problem when using it stand-alone. The E-mail message should contain a valid RIPE database object as described in the ripe-105 (ftp://ftp.ripe.net/ripe/docs/ripe-105) procedure. When the automated procedure does not detect any errors, the request is forwarded to the $HUMANMAIL role account person for some additional manual checks and the processing of the delegation itself. An acknowledgement of this fact is also sent to the people mentioned in the From:/Reply-To: and Cc: field in the E-mail message. The tool will return an error report if errors are found. If $TESTMODE=1 all mail will be send to $HUMANMAIL. You can use some keywords in the 'Subject:' line of your E-mail to control the checking process. The use of the LONGACK keyword is very recommended. HELP - will send you a (patched) ripe-105 document CHANGE - is needed if you want to change an existing reverse delegation LONGACK - will give you the most verbose output as possible TEST - do the checks, but sent only a report back to the user even if no errors are found You also might want to use the special variable NSNAME that's documented in the source code itself (for experts only). RIPE document ripe-105 requires you to send in a RIPE database 'inetnum' object with a 'rev-srv' attribute for each nameserver for single/multiple C's reverse delegation requests and for whole blocks 'domain' objects with 'nserver' attributes for each nameserver. I am neither a DNS expert or native English writer ;-) so all your comments are welcome! Please send them together with complaints, bug reports or special requests to <inaddr(a)ripe.net>.

1 0

TEST database
by RIPE Database Manager 20 Jul '95

20 Jul '95

Dear all, Last week, I have installed a test database on test-whois.ripe.net. This database is intended for people who want to play around with some test database objects and to learn how the RIPE database works. Updates should be send to: <testdb(a)ripe.net> Do queries with: whois -h test-whois.ripe.net SearchString The creation of maintainers is allowed for everybody for your (and my) convenience but the software will warn you that maintainer creation is normally done by human intervention. It is possible to update two different databases with source names: source: TEST OR source: TEST2 Of course, I might use this database for some tests I do myself with the database software so don't be surprised to see some new features that are not present in the production database, Kind regards, David Kessens RIPE NCC Database maintainer --------

1 0

Towards a better distributed database model..
by Cengiz Alaettinoglu 16 Jul '95

16 Jul '95

Hi, Here is a draft David and I put together. Comments/suggestios are welcome. Thanks. Cengiz -- Cengiz Alaettinoglu Information Sciences Institute (310) 822-1511 University of Southern California http://www.isi.edu/div7/people/cengiz.home ================================================== Draft: 4 Working Title: Towards a better distributed database model.. Date: 950707 Authors: David Kessens Cengiz Alaettinoglu Introduction: ------------- This document describes the new proposed synchronization and distribution model. Note that we state here distribution model, not distributed model. This builds further on the proposed synchronized database model for the short term. For convenience this model is also briefly discussed below. Current model: -------------- Internet Routing Registry (IRR) consists of several registries. Each registry maintains a separate and distinct database. Each database contains a set of objects (e.g. route objects, aut-num objects [Ripe-181]) which are identified by a key. Each object in a database also has a "source" attribute which is not a part of the object's key and identifies the registry whose database contains this object. Same object may occur in multiple databases (of different registries) with conflicts. However, the two objects when presented to a user (e.g. upon a whois query) will have different source attributes, and the user can determine which registry's data to trust more. Unfortunately, with the current model, the databases contain a lot of inconsistent objects. Hence, the current model has proven to be inadequate. The databases maintained by each registry are not distributed in any form. Registries keep a mirror copy of the databases of other registries and search for objects in all of the databases when replying to user queries. The mirroring is done by ftping the databases once in a predetermined interval (currently once a day). The following short term solution for getting a more synchronized database mirroring is currently being implemented at RIPE by the first author and is described below. However, we believe that this solution is not sufficient for the long term needs. Every registry makes once in a predetermined interval its full database available at a well known ftp site. In addition, it maintains and makes available a differences file (described below) which records the updates to its database since the last ftp-copy of its database was made available. When an update request is received by a registry, the database is updated if the object is syntactically correct and the registry is the registry specified in the source attribute. If the registry is not the registry specified in the source attribute, the update is forwarded to the correct registry or refused and returned to the user. Once the update is processed, a transaction is written to the differences file(s). It is possible to immediately forward the transactions to the other registries to keep the mirror copies up-to-date. Or once in a predefined interval, the registries may check the differences files of other registries and resynchronize if necessary. The full database copies (ftped periodically) and differences files enable one to access the states of the databases at a user specified time. This feature is often desired for configuring routers. Towards the long term solution: ------------------------------- For a long term solution the following preconditions are set: Transparency: We expect the number of registries to grow significantly. This means that it will be increasingly more difficult for users to keep track of every registry. Therefore, it should be possible for users to interact only with one registry while accessing and registering data and transparently getting the information from all different registries (this may involve a referral mechanism in the client programs and protocols) or transparently registering data in the database of the authoritative registry. Scalability: The current (synchronized short term) database/registry model requires each registry to obtain each other's databases and differences file(s) by some mechanism such as ftp. This requires NxN ftp (or other protocol) peering, where N is the number of registries, which does not scale. The current model has no hierarchy or other methods for scaling. Reliability/robustness: The model should be as reliable and as robust as possible. Since the system will run in an in principle evil and unreliable network, special measures for security should be built in from the start. Update and access speed: Updates should propagate as fast as possible. Users access and update the data interactively and do not accept that the updates take more then few seconds (and will not tolerate if the updates are slower in the new system than the current system). However, it may be acceptable to take more time to update the mirror copies, or it may be acceptable to take more time to update certain object which are not updated frequently (e.g. maintainer objects). Since several programs that use the system now need a (nearly) real-time access, we cannot sacrifice any performance. Distribution versus distributed: The IRR data is used for configuring routers. To be able to do this, two requirements are important: First, at least the maintainer of a database should be able to access the database in the current state but also at other time and date instances specified by her/him (earlier, but may be even later in time with delayed updates). Second, all data should be retrievable at each state, not just part of it. These requirements speak clearly against aggressive distribution of the data since there will always be problems with connectivity with some remote hosts and we need to be able to gather all data without any exceptions. Synchronization: It is desirable to have the databases and their mirrors as synchronized as possible. However, if this requirement slows the update speeds considerably, it can be compromised. The proposed model: ------------------- Why not DNS: Several people have suggested to use DNS. However, there are several problems with using the DNS: DNS is a very complex system and difficult to maintain. It does not support the needed ability to get the state of the database at a certain point in time. It does not support searches on arbitrary attributes such as locating all routes with community HEPNET or finding the person objects with name 'David Kessens' within a reasonable amount of resources and nearly real-time response. Furthermore, tools like prtraceroute have their good performance by accessing all the data from one nearby registry. Since DNS has no easy way of collecting all (without anything missing) the data from all the hosts on the Internet, tool performances would degrade. Furthermore, DNS security problems are not solved. Of course DNS is a working system in the real world, and we will benefit from it in designing our registry/database architecture. Distribution Topology: Full mesh ftp (or other protocol) peering of current model does not scale. A hierarchical peering topology where each registry only receives and passes data to and from its children and parent would scale to the large number of registries. However, a hierarchical peering topology has robustness problems since a down registry would make the complete subtree beneath it disconnected. These considerations led us to a non-hierarchical graph peering of registries. In this graph, each node represents a registry, and a link represents an ftp (or other protocol) peering. There are no roots. A registry can become neighbors with any other registry provided that the graph remains connected (perhaps bi-connected). Each registry only communicates with its neighbor registries. The neighboring registries exchange all data from all known registries. This makes it very easy to add new registries to the IRR: just become a neighbor of an existing registry. Consistency: ------------ Current model allows registering an object with the same key in two registries with conflicts. The consistency of the information is very important since this data is being used to configure operational routers and to diagnose operational routing problems. Currently, conflicts are being resolved by manual inspection which is very slow and tedious. One way to achieve consistency is to have a true distributed database with atomicity and synchronization. However, this solution does not meet our preconditions listed above (for example updates would be very slow, perhaps at the order of days, when there are network partitions). In the new model, we are debating between two solutions that should be able to avoid this conflicts. The first solution is based on multi-valued source attributes. The second solution is based on removing the source attribute altogether. Registries and multi-valued source attributes: Registries will store a new object which describes the registry. The registry description may contain information on which type of objects that are stored locally. If a request comes for information that might be stored in another registry, the requester will be referred to that registry. The client programs should cache this referral information (not the actual data returned!). The source attribute of an object now contains a list of registry names. An object can only be updated if all the registries mentioned in this attribute authorize that. The source attribute has no other semantics. This may require a two phase commit protocol run between the registries mentioned in the source attribute. A special case of this is when the source attribute contains only one registry which is identical to the current model. There can be other implicit semantics in the source attribute. Some registries might require to be one of the sources for certain objects. Also the type of object might require (as defined in the object definition) that object updates should be approved by some additional source(s) (the authoritative sources). Updating: The update process will be controlled by a modified two phase commit protocol. The user will send an update request to one of the registries. The registry will send the request to all the registries specified in the object's source attribute and to additional registries if required by the definition of the object's type. After the registries determine whether to accept the object, the first registry will acknowledge this to the user. After this, all the involved registries (including the one that received the request) will update their local database(s), and flood the update (with serial&timestamp of first source&signature) to the other registries. No source attributes: This approach views the whole IRR data as being one database (though it may still be maintained in pieces) with certain registries authoritative on certain parts of it. Since it is one database, there is no need for the source attribute to identify which database, and no two objects with the same key and conflicting information can be registered (i.e. one of them will overwrite the other one). Our solution is as follows: Maintainer objects are globally unique and are created if all (or an authoritative subset) registries approve it. This can be achieved by a two phase commit protocol. Note that the creation of the maintainer objects will be slow (and is slow currently since it is done manually). However, this is tolerable since maintainer objects are not created very often. Each maintainer object specifies a registry which is authoritative for the objects that are maintained by itself. When a user sends an update to a registry, that registry will forward it to the registry which is authoritative for the object. The authoritative registry updates its local copy of the database and invokes the flooding protocol for other registries to pick up this change. Note that, if an object is registered in the database with maintainer X who authorizes registry Y, all updates will be performed by registry Y. This will ensure consistency within Y's copy of the database. If someone tries to register the same object with a different maintainer than X, Y (or any other registry) will deny the update with a maintainer failure error. There is one problem with this approach. If the mirroring takes a long time, within that period, one can create two objects with the same key, different maintainers which authorize different registries (and possibly with conflicts) in the local databases of two registries. Hence, it is essential to keep the mirroring as synchronized as possible. In this case, when the next mirroring is done and the conflict is detected, the copy which is created later is removed and returned to the user. We think that the probability of this case happening will be small.

3 3

Re: Towards a better distributed database model..
by martin＠terena.nl 14 Jul '95

14 Jul '95

Maybe I'm barking up the wrong tree, (please let me know!), but seems to me that one could use WHOIS++ for this sort of distribution. (Yes, I _know_ it is distributed rather than distribution model). Bunyip have recently released 'digger' a WHOIS++ implementation: http://services.bunyip.com:8000/products/digger/digger.html Rgds, John

1 0

Draft Minutes RIPE21, Database-WG
by Wilfried Woeber, UniVie/ACOnet 02 Jun '95

02 Jun '95

This is the draft minutes for the DB-WG meeting at RIPE 21 in Rome. They are quite belated (and probably full of typos), but unfortunately nobody volunteered this time to act as a scribe... Comments, corrections, additions -as always- very welcome. Wilfried. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Draft Minutes: RIPE 21, Database-WG Rome, 8.5.1995 Chair: Wilfried Woeber, Scribe: Wilfried Woeber ------------------------------------------------------ 0. Administrative stuff Unfortunately nobody volunteered to take the minutes. I had to guide the discussions and to take the notes at the same time. Thus these minutes are probably not as comprehensive as we are used to. Apologies. The agenda was accepted as proposed, without changes. 1. DB-SW review David Kessens, RIPE NCC, reported on the current state of the database software and the environment at the NCC for providing maintenance and doing development work. Activities since RIPE 20 (as Marten and Tony having left the NCC/PRIDE Project) centered on becoming familiar with the software, performing bug fixes and implementing minor extensions, like the "network update" feature whois -U and whois -tv (for template verbose). Other aspects worth mentioning: . reverse lookup technology . hierarchical authorization (initially for domains) . referrals are being researched and estimates for the necessary implementation efforts are obtained. David confirmed that the official distributioin kit available (anonymous FTP) at the NCC always contains the most recent fixes issued and additions. For more details please refer to the slides supporting David's presentation which are available from the RIPE NCC FTP Server in the presentations directory ftp://ftp.ripe.net/ripe/presentations/ripe-m21-david-DB-REPORT.ps.Z Merit is also working on the databse software and has produced some tools. These things are available from: ftp://ftp.ra.net/routing.arbiter/tools/RAToolSet 2. Security While there was no concern regarding the functionality and usefulness of the authorisation methods already implemented (mail-from:, crypt-pw:) there is a need for even stronger authentication of updates. PGP seems the way to go, although there is still quite a bunch of open questions and a need for logistic (e.g. key distribution) development. It is not clear at the moment whether this should be integrated (DB, RIPE NCC) or be provided by mechanisms outside the scope of RIPE. SURFnet reported it's intent to use the RIPE-DB for routing configuration as soon as PGP would be available to provide the data reliability necessary. Others expressed strong interest, as well. Merit (LJ) did part of the work already to provide PGP authorisation for the email addresses in updates. Comments from the group stressed that it is essential to *not* mix the concepts of authentication and of encryption. Encryption is a logistic and/or legal problem in some regions. The group is requested to persue this aspect on the relevant mailing lists. *Action on David Kessens and Wilfried Woeber: Investigate the deployment of PGP for the RIPE Database and to draft a proposal. 3. Review of beta test for RIPE-Handles The method for generating RIPE-Handles was discussed once again, there are still open issues when trying to fully automate handle assignement because this would require both a DB-commit function as well as require the modification of submitted objects on-the-fly. The group did not resolve this issues, thus the current procedure (finger) remains in place. It was noted that the scripts involved should be made available to all interested parties. 4. External interfaces There is an on-going discussion (in the light of more than one organisation using the RIPE DB-SW now) on how to keep the various databases in synch. One of the ideas is to accept updates for each and every database on all interfaces, to analyze the "source:" attribute and then to automatically forward the update to the database as indicated by "source:". While this is probably quite interesting, it might not always be what the users intend. The alternative is to reject updates when submitted for the "wrong" "source:". This is the safe way. To meet the need of regularly transferring updates from one database to (an)other(s), a method using FTP and providing "deltas" is investigated. 5. Input for and review of objects Due to the scheduling of the working groups, there was no input at the DB-WG meeting. A proposal to expand the internet-router object to describe Mbone routing was circulated after the meeting, as drafted by the Mbone WG. 6. AOB None. Thus the meeting was closed. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ WW. 2.6.95

1 0

Re: Delete syntax (again)
by David.Kessens＠ripe.net 18 May '95

18 May '95

Hi Dale, > Dale S. Johnson writes : > > Sorry; I think I asked this once but lost the answer: > > Where in RIPE documentation does anything describe how to use the "delete:" > attribute? (Both for us, so we know what it really wants, and even more > for the users who keep asking us). >From the source code (Probably most definitive ;-)): "delete attribute must contain email address and reason for delete" I cannot find any document describing it. May be anybody else knows documentation ? Marten/Tony ? I proposed the RIPE community a new whois flag combination. We now have : $ whois -t aut-num aut-num: [mandatory] [single] as-name: [optional] [single] descr: [mandatory] [multiple] as-in: [optional] [multiple] [..] I proposed to the RIPE database working group the new (verbose) combination : $ whois -tv aut-num aut-num: [mandatory] [single] The 'aut-num' objects describes the ... Syntax: as-name: [optional] [single] The 'as-name' attributes describes the ... Syntax: ... I think most people liked this idea and it should solve this never ending story about 'what is this object/attribute for ???' When I have time I will start implementing this. Kind regards, David Kessens RIPE NCC Database maintainer

1 0

Re: just an FYI - don't panic
by Dale S. Johnson 16 May '95

16 May '95

David, AAAAAARRRRRRRRRRRRGGGGGGGGGGGHHHHHHHHHHH!!!! THAT SIMPLE!!! Thanks extremely for the extra set of eyes. (sigh). --Dale > The inet-rtr support is there, although it is not very visible since it > uses only generic attributes as admin-c and others. Please note that you > forgot a colon after the admin-c attribute in your previous mail. After > adding that the inet-rtr object was properly updated : > > ------------------------------------------------------------------------ > Update OK: [inet-rtr] nss11.ans.net > > Delete OK: [inet-rtr] nss11.ans.net > ------------------------------------------------------------------------

1 0

Re: just an FYI - don't panic
by RIPE NCC Staff 16 May '95

16 May '95

Dear Dale, * "Dale S. Johnson" <dsj(a)merit.edu> writes: * Steve, * * > Who will act as coordinator to get this stuff distributed? I assume * > that the RA in the U.S. can take the lead in this role if we were to * > provide source. * * The only thing close to an official answer to this question at the moment * is that RIPE is the home and custodian of the official distribution * source. * * At the RA, we've been trying rather hard to minimize any modifications to * RIPE code, if only to simplify importing further revisions of their code. Thank you ! * (But not making modifications is getting harder, as we get user pressure * to make email address parsing case-insensitive, add PGP, [add inet-rtr * support, if we aren't just looking for it in the wrong places today], * etc). I think that most of things you mention here are exactly the same as the wishlist of the RIPE community so for that there is no need for a divergence ;-) The inet-rtr support is there, although it is not very visible since it uses only generic attributes as admin-c and others. Please note that you forgot a colon after the admin-c attribute in your previous mail. After adding that the inet-rtr object was properly updated : ------------------------------------------------------------------------ Update OK: [inet-rtr] nss11.ans.net Delete OK: [inet-rtr] nss11.ans.net ------------------------------------------------------------------------ * The RA does post the radbserver (rpslserver) and RtConfig tookkit * distributions, which are separable packages from the RIPE distribution. * If we were to package and post our own "RIPE-181-modified by the RA" * distribution today, there might be some considerable confusion. * * The RA is generally willing to install Curtis' changes in our * implementation, though this needs discussion with the list since * our accepting such non-181 syntax would probably break implementations * and/or tools of other registries (such as RIPE itself) which import * that data and make it available to their tools (like prtraceroute). (Syntax) changes (not the implementation details!) are normally discussed in the RIPE database working group. After we reach consensus the changes will be implemented. I would strongly ask you all to join the discussion on the <db-wg(a)ripe.net> as that is probably the most appropriate platform to discuss these issues. For example the case-sensitive E-mail parsing could be changed if our contributors and you all ask for it ! * Clearly this all needs sorting out. (Maybe starting in the halls at * NANOG?) But for the moment, the answer is that RIPE is the custodian. I hope to see you all in the halls ;-), Kind regards, David Kessens RIPE NCC Database maintainer ----------- * ============ From: Steve Heimlich * * > From heimlich(a)ans.net Mon May 15 21:21:43 1995 * > To: "Dale S. Johnson" <dsj(a)merit.edu> * > Cc: cengiz(a)isi.edu, curtis(a)ans.net, Tony.Bates(a)ns.mci.net, rr-impl(a)ripe.ne * t, * > selina(a)ans.net * > Subject: Re: just an FYI - don't panic * > Date: Mon, 15 May 1995 21:20:44 -0400 * > * > Dale, * > * > Who will act as coordinator to get this stuff distributed? I assume * > that the RA in the U.S. can take the lead in this role if we were to * > provide source. * > * > Thanks, * > Steve * > * > > > Is it OK if I added about 4 lines of code in enparse.pl to do Unix * > > > style backslash at the end of the line continuation? * > > * > > This is a great idea; I think it should be done. But... * > > * > > in order for this idea to be completely implemented, the change has to * > > be installed in Amsterdam, Reston, and Toronto as well as Ann Arbor; * > > and probably several places (ESNet, DSI, NASA, APNIC) that we aren't * > > sure of yet. * > > * > > Also, is enparse.pl part of any of the tools? Then it needs to be * > > changed in all the copies of those tools that anyone has FTP'd as * > > well.

1 0

Number of domain objects in RIPE database
by RIPE NCC Staff 04 May '95

04 May '95

Action: 20.11 RIPE NCC To investigate (as time permits) distribution of the domain information in the RIPE database and to investigate a "private" approach for referrals. Dear working group members, Relating to Action Item 20.11 from the previous RIPE meeting I have been asked to produce and send out some statistics about the number of domain objects in the RIPE database. You will find them below. I hope they are self-explanatory. Regards, Roderik Muit RIPE NCC AT : 132 objects, 25 different second-level domains BE : 481 objects, 458 different second-level domains BG : 28 objects, 28 different second-level domains CH : 709 objects, 709 different second-level domains COM : 5 objects, 5 different second-level domains CS : 4 objects, 4 different second-level domains CZ : 276 objects, 276 different second-level domains DE : 1512 objects, 1510 different second-level domains DK : 219 objects, 219 different second-level domains EE : 5 objects, 3 different second-level domains ES : 1 objects, 1 different second-level domains FI : 166 objects, 165 different second-level domains FO : 13 objects, 13 different second-level domains FR : 878 objects, 869 different second-level domains GA : 2 objects, 2 different second-level domains GL : 2 objects, 2 different second-level domains GR : 6 objects, 6 different second-level domains HU : 260 objects, 259 different second-level domains IE : 10 objects, 10 different second-level domains IL : 270 objects, 7 different second-level domains IS : 63 objects, 52 different second-level domains IT : 713 objects, 487 different second-level domains LI : 5 objects, 5 different second-level domains LT : 60 objects, 60 different second-level domains LU : 6 objects, 6 different second-level domains LV : 2 objects, 2 different second-level domains NET : 13 objects, 12 different second-level domains NL : 1559 objects, 1558 different second-level domains NO : 936 objects, 771 different second-level domains PL : 7 objects, 4 different second-level domains PT : 105 objects, 105 different second-level domains RO : 1 objects, 1 different second-level domains RU : 1 objects, 1 different second-level domains SE : 7 objects, 7 different second-level domains SK : 165 objects, 165 different second-level domains SU : 4 objects, 4 different second-level domains TN : 3 objects, 3 different second-level domains TR : 6 objects, 3 different second-level domains UA : 3 objects, 2 different second-level domains UK : 20 objects, 3 different second-level domains YU : 7 objects, 7 different second-level domains 164: 1 reverse delegations 192: 22 reverse delegations 193: 297 reverse delegations 194: 105 reverse delegations

1 0

Draft agenda DB WG meeting at RIPE 21, Rome
by Wilfried Woeber, UniVie/ACOnet 03 May '95

03 May '95

The *draft* agenda for the DB-WG at RIPE 21 in Rome. As always, additons, comments, etc. welcome! Apologies if I missed something obvious... Wilfried. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Draft Agenda: Database-WG, RIPE 21, Rome, IT ------------------------------------------------------ 0. Administrative stuff . who's taking the minutes? . WG-agenda 1. DB-SW review . new or proposed functionality . time-stamps . reverse links (for persons, at least) . distribution kit and integrating modifications . any loose ends? 2. Security . experiences with mail-from:, crypt-pw: . stronger authentication of updates (PGP?) 3. Review of beta test for RIPE-Handles . status 4. External interfaces . DB-exchange . first steps towards distributing the database 5. Input for and Review of objects . extensions for the router object (input from Mbone WG?) 6. AOB WW, 3.5.95 -------------------------------------------------------------------------- Wilfried Woeber : e-mail: Woeber(a)CC.UniVie.ac.at Computer Center - ACOnet : Vienna University : Tel: +43 1 4065822 355 Universitaetsstrasse 7 : Fax: +43 1 4065822 170 A-1010 Vienna, Austria, Europe : NIC: WW144 --------------------------------------------------------------------------

1 0

DNS vs. RIPE DB checking tool
by Havard Eidnes 12 Mar '95

12 Mar '95

Hi, as promised at the last RIPE meeting, please find below a copy of the perl script I have which checks for the consistency between what is registered in the RIPE database for the domains and what is registered in the DNS. Do note, this script does nothing more than report what it thinks is inconsistencies, you still need to sift through the error reports this script produces and fix any inconsistencies yourselves. This script relies on a number of conventions and is a bit picky about what needs to be in the RIPE database if it is to not complain too much. First, the script has to know which domains it should check. It performs this decision by "traversing" the domain objects in the RIPE database starting from the object for the top-level domain. If the object in question has at least one sub-dom: attbibute, my script assumes that all names registered in this domain should be registered in the RIPE database with it's own domain object. This way, you use the "sub-dom" attbiutes to span out a subset of the DNS hierarchy under a given top-level domain where administrative registration in the RIPE database is required for DNS registration. The script subsequently does zone transfers for the DNS domains corresponding to the domains which should be checked as decided above. When querying the RIPE database, the set of name server records for each domain is recorded, so that the script can compare these with what is registered in the DNS. This is one point where my script deviates slightly from or is slightly more strict than the RIPE-49 document, in that it 1) does not permit IP addresses in the nserver: attribute (since you do not delegate to an IP address in the DNS, this makes sense) 2) does not permit more than one word in each nserver: attribute This makes registration such as: nserver: aun.uninett.no / 129.241.1.99 illegal, and nserver: aun.uninett.no nserver: 129.241.1.99 would also be flagged as an error when compared to the DNS output. It is my beleif that the RIPE database does not adequatly support the registration of glue records (I do not think it needs to either), and putting the glue record information in together in the nserver: attribute is bad when seen from the database normalization and maintenance side. If a domain is registerd in the DNS with only MX information, my script demands that the corresponding registration in the RIPE database should contain the string "MX-only" in one of the remarks: attributes of the domain. Subsequently, what has been harvested via the RIPE database and what has been fetched from the DNS is compared, and any inconsistencies are reported. These are: 1) Check for domains registered in the RIPE database but not in the DNS, report these as errors 2) Check for domains registered in the DNS but not in the RIPE database, report these as errors 3) For delegated domains, report any inconsistencies between the set of nserver: attribute values and the NS records in the DNS 4) Check for domains with both MX and NS records in the DNS, report these as errors 5) Check that only domains marked in the RIPE database as "MX-only" really have an MX-only registration in the DNS. Lastly, this script depends on dig version 2.0 (forget the one which comes with BIND 4.9.3 -- the external interface changed for the worse, IMHO) and on a whois client which uses getopt() to parse it's arguments (so that I can use the '--' construct to separate the options and the arguments). If you have another version of whois than this, the fix should be trivial (at the top of "get_ripe_data". Note: the script creates a "cache file" with name cc.ripe-cache in the current directory containing all the domain objects without sub-dom attributes, so that multiple runs in quick succession can be a little faster (do however remember to remove any objects you sent in updates for, or remove the cache after substantial modifications). Well, other than this, read the script -- it's some 450 lines of simple straight-forward Perl code. - Håvard #!/local/bin/perl # $Id: domain-check.pl,v 1.7 1995/03/12 18:37:22 he Exp $ # # Perl script to check the consistency between what is registered in the # RIPE database and what is registered in the DNS for the domain objects # under a given domain. Missing pieces (i.e. inconsistencies) for either # registration is reported. # Pull in data for a given domain from the DNS using dig sub get_dns_data { local($domain) = @_; local($ns, $label, $zoneok); local($wildcard_label); $zoneok = 0; $ns = &get_primary_ns($domain); if (!defined($ns)) { &err("Could not get SOA for $domain\n"); return undef; } $digcmd = "dig @$ns $domain axfr +nodefname +pfset=0xa024"; $digcmd = $digcmd . " | tr '[A-Z]' '[a-z]' |"; open(dig, $digcmd) || return undef; while(<dig>) { chop; split; if ( $_[1] eq "in" ) { chop($_[0]); $label = $_[0]; $wildcard_label = 0; if ($label =~ /^\*\./) { $label = substr($label, 2); $wildcard_label = 1; } } else { if (( $_[1] eq "matching" && $_[0] eq ";" ) || ( $_[1] eq "received" && $_[0] eq ";;" && $_[3] eq "records" )) { $zoneok = 1; } next; } if ( $_[2] eq "a" ) { $dns_glued{$label} = 1; } elsif ( $_[2] eq "ns" ) { chop($_[3]); $dns_ns{$label} = $dns_ns{$label} . ":" . $_[3]; $dns_delegated{$label} = 1; $in_dns{$label} = 1; } elsif ( $_[2] eq "mx" ) { $dns_mx_domain{$label} = 1; if ($wildcard_label) { $dns_mx_wildcard{$label} = 1; } $in_dns{$label} = 1; } elsif ( $_[2] eq "cname" ) { $dns_cname{$label} = 1; } elsif ( $_[2] eq "soa" ) { # nothing to do, ignore } elsif ( $_[2] eq "hinfo" ) { # nothing to do, ignore } elsif ( $_[2] eq "wks" ) { # nothing to do, ignore } else { printf stderr "spurious data: $_\n"; } } close(dig); if ($zoneok) { return 1; } else { &err("No matching SOA record found from $ns\n"); return undef; } } sub get_primary_ns { local($domain) = @_; local($ns, $digcmd); $digcmd = "dig $domain soa +nodefname +aa +pfset=0xa020"; $digcmd = $digcmd . " | tr '[A-Z]' '[a-z]' |"; open(dig, $digcmd) || return undef; while(<dig>) { chop; split; if ( $_[1] eq "soa" ) { close(dig); return $_[2]; } } close(dig); return undef; } # Pull in any cached data from the RIPE database previously saved to disk # by get_ripe_data sub get_ripe_cached_data { local($domain) = @_; local($tag); open(cache, $ripe_cache_name) || return undef; while (<cache>) { tr/A-Z/a-z/; chop; split; chop($_[0]); $tag = $_[0]; if ( $tag eq "nserver" ) { $ripe_ns{$domain} = $ripe_ns{$domain} . ":" . $_[1]; if ( $#_ > 1 ) { &err("RIPE: more than one nserver on a line for $domain\n"); } } if ( $tag eq "domain" ) { $domain = $_[1]; $in_ripe_db{$domain} = 1; } if ( $tag eq "sub-dom" ) { shift; while ($subdom = shift) { $fqdn = $subdom . "." . $domain; push(domains_to_check, $fqdn); if ( ! $has_subdom{$domain} ) { $has_subdom{$domain} = 1; push(needs_dns_xfer, $domain); } } } if ( $tag eq "remarks" ) { if ( /mx-only/ ) { $ripe_mx_only{$domain} = 1; } } } close(cache); return 1; } # Pull in data for a given domain from the RIPE database using whois # Put received data in "ripe-cache" (append it). The assumption is that # get_ripe_data will not be called unless data isn't found in the cache. sub get_ripe_data { local($domain) = @_; local($tag, $subdom, $fqdn); local($do_cache) = 1; local(@entry, $s); $whoiscmd = "whois -h whois.ripe.net -- '-r '$domain |"; open(whois, $whoiscmd) || return undef; open(cache, ">>$ripe_cache_name") || undef $do_cache; while(<whois>) { if ( /No entries found for the selected source/ ) { close(whois); return undef; } if ($do_cache) { push(@entry, $_); } tr/A-Z/a-z/; chop; split; chop($_[0]); $tag = $_[0]; if ( $tag eq "nserver" ) { $ripe_ns{$domain} = $ripe_ns{$domain} . ":" . $_[1]; if ( $#_ > 1 ) { &err("RIPE: more than one nserver on a line for $domain\n"); } } if ( $tag eq "domain" ) { $in_ripe_db{$domain} = 1; } if ( $tag eq "sub-dom" ) { if ($do_cache) { close(cache); } undef $do_cache; # Do not cache entries with sub-dom entries shift; while ($subdom = shift) { $fqdn = $subdom . "." . $domain; push(domains_to_check, $fqdn); if ( ! $has_subdom{$domain} ) { $has_subdom{$domain} = 1; push(needs_dns_xfer, $domain); } } } if ( $tag eq "remarks" ) { if ( /mx-only/ ) { $ripe_mx_only{$domain} = 1; } } } close(whois); if ($do_cache) { while($s = shift(@entry)) { print cache $s; } close(cache); } return 1; } # Check existence of data in RIPE database for a given domain # (independent of sub-dom tree). Might as well use code above # which pulls in data from RIPE database entry (if it exists). sub in_ripe_db { local($domain) = @_; return &get_ripe_data($domain); } # Get all RIPE data (decending recursively through sub-dom) # for a given domain, noting registered sub-doms that do not have # their own entry in the RIPE database sub get_all_ripe_data { local($domain) = @_; local(@domains_to_check) = @_; &notify("Getting cached RIPE data for domain $domain:"); $ripe_cache_name = $domain . "." . "ripe-cache"; &get_ripe_cached_data($domain); &notify("\nGetting all RIPE DB data: "); while ($domain = shift(domains_to_check)) { if (! $in_ripe_db{$domain} ) { # Not already seen in cache &notify_progress(); if ( ! &get_ripe_data($domain) ) { &err("RIPE database entry missing for $domain\n"); } } } } # Pull inn all relevant data for doing a check. Decend through sub-dom # entries in the RIPE database and pull in data for the relevant DNS zones # as well. sub pull_in_data { local($domain) = @_; &get_all_ripe_data($domain); &notify("Getting corresponding DNS data\n"); while ( $domain = shift(needs_dns_xfer) ) { &notify("Getting zone data for $domain\n"); if (! &get_dns_data($domain) ) { &err("Zone transfer of $domain failed\n"); } } } # Perform an extensive consistency check between the data fetched from DNS # and those fetched from the RIPE database. In particular, check: # # 1) Check that all entries in the RIPE database are in the DNS and # vice versa; report inconsistencies. # # 2) Where entries exist in both RIPE and the DNS, check: # # a) for delegated domains, the set of NS records in DNS and those # registered in the RIPE nserver entries match up # # b) for domains with both NS and MX records in the DNS, report # this as an inconsistency # # c) for MX-only domains (in the DNS), check that the corresponding # entry in the RIPE database contains the remark "MX-only". sub do_consistency_check { &report_missing_ripe(); &report_missing_dns(); &report_ns_inconsistencies(); &report_inconsistent_domains(); &report_mx_comments(); } # Report entries in the DNS which do not exist in the RIPE database sub report_missing_ripe { local($domain); foreach $domain (keys %in_dns) { if ( ! $in_ripe_db{$domain} ) { if ( &in_ripe_db($domain) ) { &err("Missing as sub-dom in parent object: $domain\n"); } else { &err("Missing in RIPE db: $domain\n"); } $ignore{$domain} = 1; } } } # Report entries in the RIPE database missing in the DNS sub report_missing_dns { local($domain); foreach $domain (keys %in_ripe_db) { if ( ! $in_dns{$domain} ) { if ( ! $dns_cname{$domain} ) { &err("Missing in DNS: $domain\n"); $ignore{$domain} = 1; } } } } sub split_ns_list { local($ns_str) = @_; local(%array, @tmp, $elt); $ns_str =~ s/^://; @tmp = split(/[:]+/, $ns_str); while ($elt = shift(@tmp)) { $array{$elt} = 1; } return %array; } # Report inconsistencies between registered name servers DNS/RIPE sub report_ns_inconsistencies { local(%dns_nses, %ripe_nses); local($heading_written) = 0; local($domain, $ns); foreach $domain (keys %in_dns) { if ( ! $ignore{$domain} ) { %dns_nses = &split_ns_list($dns_ns{$domain}); %ripe_nses = &split_ns_list($ripe_ns{$domain}); foreach $ns (keys %dns_nses) { if ( ! $ripe_nses{$ns} ) { &err("Missing NS in RIPE for $domain: $ns\n"); } } foreach $ns (keys %ripe_nses) { if ( ! $dns_nses{$ns} ) { &err("Missing NS in DNS for $domain: $ns\n"); } } } } } # Report domains with both NS and MX records in the DNS # and domains in RIPE database with both nserver and remark: MX-only. sub report_inconsistent_domains { local($domain); foreach $domain (keys %in_dns) { if (defined($dns_ns{$domain}) && defined($dns_mx_domain{$domain})) { &err("Both MX and NS records for $domain in DNS\n"); } } foreach $domain (keys %in_ripe_db) { if (defined($ripe_mx_only{$domain}) && defined($ripe_ns{$domain})) { &err("Both nserver and remark: MX-only in RIPE db for $domain\n"); } } } # Report MX-only domains where RIPE entry doesn't contain remark "MX-only" # and MX-only domains in RIPE database which are fully delegated in DNS sub report_mx_comments { local($domain); foreach $domain (keys %in_dns) { if ($in_ripe_db{$domain}) { if ($dns_mx_domain{$domain}) { if (! $ripe_mx_only{$domain}) { &err("MX-domain in DNS, RIPE db not marked for $domain\n"); } } } } foreach $domain (keys %in_dns) { if ($dns_delegated{$domain}) { if ($ripe_mx_only{$domain}) { &err("MX-domain in RIPE, DNS fully delegated for $domain\n"); } } } } sub err { local(@args) = @_; if ($dot_written) { $dot_written = 0; printf stderr "\n"; } printf stderr @args; } sub notify { local(@args) = @_; if ($dot_written) { $dot_written = 0; printf stderr "\n"; } printf stderr @args; } sub notify_progress { printf stderr "."; $dot_written = 1; } $arg = $ARGV[0]; if (defined($arg) && ($arg =~ /^..$/)) { &pull_in_data($arg); &do_consistency_check(); } else { &err("usage: domain-check.pl cc\n"); &err("\twhere cc is a two-letter country code\n"); }

1 0

draft minutes, DB-WG, RIPE #20
by Wilfried Woeber, UniVie/ACOnet 07 Feb '95

07 Feb '95

Dear DB-WG and David! This is the draft of the minutes for the Database WG. Again many thanks to Andreas Knocke for providing me with the meeting notes in due time. David, I'd be grateful if you could do a spelling and sanity check on the text below. I'm writing too many minutes in a hurry these days :-( As always, any comments welcome. Best regards, Wilfried. PS: I'm off-line from 9.2.95 until 3.3.95, thus I'll be unable to respond to comments during the next 3 weeks. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Draft Minutes: RIPE #20, Database WG 1. Administrative stuff The agenda was agreed upon as proposed. Andreas Knocke (DE-NIC) volunteered to act as scribe for the meeting. 2. The "new" database software: review, future Report by Marten Terpstra: The new software had been announced at the RIPE 19 meeting in Lisboa. After being available for external testing it was put into production in October 1994. Since then some bugs were fixed and some (small) syntax checking features were added, users of the database should not have noticed the change - mostly. Recently the database was moved to a decicated (new) machine (Sparc/5, whois.ripe.net). As a general remark - Marten urged everybody to use the generic names for accessing the individual RIPE NCC services because a number of services (ftp, whois, www) have already been moved to different machines. Renumbering the RIPE network also required to renumber the machines. Documentation and future development of the software package shall be done by Daniel Karrenberg and David Kessens - due to the fact that Marten is leaving the RIPE NCC right after this meeting. Finally the official release will be available from ftp://ftp.ripe.net/ripe/dbase/software/ripe-dbase-1.00.tar.gz Other aspects of general interest: Time stamps (as requested by Merit and agreed upon in Lisbon) have not yet been added. Maybe Merit is going to add that functionality. Still there should only be one common version of the software. Hashed comments (# starting after white space) are allowed in any object submitted to the database although comments are *not* stored in the databse itself. While there was some discussion of allowing "end-of-line comments" this was dropped to avoid breaking scripts. Still an empty line (only white-space) is required to separate objects from each other. 3. RIPE Handles RIPE Handles are necessary to uniquely identify person objects with identical names and are required for the exchange of information with other databases, e.g. the InterNIC. Handles created for use in the RIPE environment database are very similar to the well-known NIC-Handles but have the string "-RIPE" appended to make them unique amongst different registries. Given the more distributed model of operation, the APNIC is going to append the relevant ISO 3166 country codes for the same purpose. Unique RIPE Handles can be obtained by fingering whois.ripe.net: finger handle.XY(a)whois.ripe.net where XY is the initials of the person's name to have a handle assigned. E.g. to request a handle for a given John Doe just do: finger handle.jd(a)whois.ripe.net which returns something similar to: First free handle: JD5-RIPE Using this (interim) method of obtaining unique handles introduces a possible race condition. This is yet to be solved. There are still some loose ends when a person object is updated to get a handle field. Occasionally there may be duplicate person objects created. In this situation the out-dated object can be simply deleted. RIPE Handles are currently considered to be in field test. On a more general level it was proposed to investigate the legal aspects of storing person-related information in a publicly accessible database. 4. External interfaces The SWIP (Shared Whois Project) for exchanging information amongst the (Regional) Registries requires unique handles. The rwhois project (see RFC 1714) - Mark Kosters of InterNIC briefly reported on the resources available (he is working on it in his spare time). A final beta version might be available at the end of Q1 1995. 5. Review of objects and links Inverse lookups: Inverse lookup is very desirable easily to find out where all the references to a given object (persons, but maybe inetnum objects as well) are coming from. Action 20.DB1: on the RIPE NCC, to do an implementation analysis. "status:" attribute Geert Jan de Groot explained that this attribute was indeed required for keeping track of address assignments. Marten had agreed to implement it on the fly to support a new tool for NCC internal use. As implemented, the acceptable values for this attribute are "Delegated" "Assigned" (and "Reserved"). The little sketch below depicts the model: total delegated delegated assigned address to RIPE to local-IR to customer space 193/7 19?.*/16 I I I / I / I I / I / I / I I/ I/ I/ I I\ I\ I\ I I \ I \ I \ I I \ I \ I I I 6. Meta objects Contrary to the current recommendation the person object is "mis-"used by a couple of entities to describe role accounts and similar things. Daniel Karrenberg agreed that this can indeed be useful, even if he opposed this use in the past. However "admin-c" for an object still has to point to a real person object. Action 20.DB2: on HAvard Eidnes to write up a proposal with input from the Local-IR WG and the EOF (European Operators Forum) 7. Input fromt the DNS-WG: domain object In addition to a brief report on the decisions within the DNS-WG, Piet Beertema elaborated on the information scheme for keeping track of domains domains under the TLD ".nl" w2hich has been implemented. Piet intends to remove all objects other than the one for .nl itself. This proposal calls for a forwarding pointer in the RIPE-DB that links to the machine where the data is actually available (the name server for .nl). Questions discussed and issues arising from this proposal: - How can compatible schemas be maintained? With the updated domain object this can be achieved, although the representation for persons are different - tools have to "keep this in mind". - The referral mechanism . The rwhois package is not yet ready for production use and has to be extended for CIDRization (whois++ the same), . The RIPE DB software currently lacks the concept of forwarding queries (comparable to proxy forwarding in BIND) for forwarding to other whois servers. There was a general consensus that the domain object is a very good candidate for starting a pilot to distribute information to the environment where it is maintained. With regard to person objects, the allocation registry and the routing registry, the RIPE database should not be modified right now (production use and automatic configurations!). Action 20.DB3: on the RIPE NCC to investigate (as time permits) distribution of the domain information and to investigate a "private" approach for referrals. Havard Eidnes reported on a tool to check the primary zone file for .no against the registered domain objects. Action 20.DB4: on Havard Eidnes to publish this tool for the benefit of other top level registrars 8. AOB - any other business None, thus the WG meeting was closed. Z. Report on an out of band discussion for the minutes "An additional, informal BOF happened just before the lunch break - inheritance of authorisation was proposed and discussed for hierarchical objects which would resolve a common question: the authorisation of allocations from a delegated block and of the addition of subdomains within a registered top level domain." -------------------------------------------------------------------------- Wilfried Woeber : e-mail: Woeber(a)CC.UniVie.ac.at Computer Center - ACOnet : Vienna University : Tel: +43 1 4065822 355 Universitaetsstrasse 7 : Fax: +43 1 4065822 170 A-1010 Vienna, Austria, Europe : NIC: WW144 --------------------------------------------------------------------------

1 0

test, please ignore
by Geert Jan de Groot 30 Jan '95

30 Jan '95

This is just a silly test. Please do not respond. Sit on your hands :-) Thank you! Geert Jan (trying to work out some pretty broken mailers in this world)

1 0

Draft agenda: Database-WG at RIPE 20
by Wilfried Woeber, UniVie/ACOnet 20 Jan '95

20 Jan '95

The following is the first attempt at a draft agenda for the DB-WG. Seems like there is no really "big" issue for this meeting and we even may end up spending less time in parallel sessions. Apologies if I missed something obvious, it's quite busy here at our end :-) Input very welcome. Wilfried. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Draft Agenda: Database-WG, RIPE 20, 25-27 January 1995 ------------------------------------------------------ 0. Administrative stuff . who's taking the minutes? . WG-agenda 1. Short review: new DB-SW in production use . any open issues . bug fixes and formal release . time-stamps . any loose ends? 2. RIPE-Handles . status . formal introduction? 3. External interfaces . DB-exchange . rwhois . distributed domain object queries (Piet Beertema proposal) 4. Review of objects and links . domain object (amend or obsolete, input from DNS WG) . person object (semantics) and back-links (aka inverse recursion) . extensions for the router object (input from Mbone WG?) 5. AOB -------------------------------------------------------------------------- Wilfried Woeber : e-mail: Woeber(a)CC.UniVie.ac.at Computer Center - ACOnet : Vienna University : Tel: +43 1 4065822 355 Universitaetsstrasse 7 : Fax: +43 1 4065822 170 A-1010 Vienna, Austria, Europe : NIC: WW144 --------------------------------------------------------------------------

1 0

Re: do we need a meeting of the DNS TF ?
by Wilfried Woeber, UniVie/ACOnet 18 Jan '95

18 Jan '95

Hallo Andreas! => Question is whether we want to overhaul the domain object, or just => approve the small changes discussed last week. If we just want the => small changes, I am sure we can do it in the db-wg (Wilfried?). If we => want other bigger changes, we'd probably need a dns-wg meeting. = =We probably should still do it - if possible - within the db-wg. =It's (just :-) another object and I think we should decide what's =it use and what's the future of each of its attributes. I think [ $ set /me /mode=piet.b # :-) ] I'm reluctant to drag this stuff (remaining in a state of being rare instead of well-done :-) into the DB-WG. Maybe I'm a bit too proud about the DB-folks, but I've got the impression recently that we managed to get various things and proposals discussed up to a useful point (by different means and methods) and then just put the finishing touch on top during the DB-WG meeting. Quite to the contrary, the DNS (-object stuff) is (and has been) tossed around for more than a year now, if I recall correctly. Listening to Piet's emontional announcement, I get the feeling that the DNS folks still have to make up their minds, one way or the other... If this indeed has happend, then a proposal for a changed object is welcome to be discussed withint the DB-WG. So, my proposal would be to actually convene a DNS group meeting (even with only this one agenda item) and to try to arrive at some kind of consensus or to completely dismiss this issue. Wilfried. PS: speaking as a plain USER and NOT speaking for the DB-WG, I'd rather have the DNS group dissolved than keeping it in the semi-paralysed state it is in these days :-( -------------------------------------------------------------------------- Wilfried Woeber : e-mail: Woeber(a)CC.UniVie.ac.at Computer Center - ACOnet : Vienna University : Tel: +43 1 4065822 355 Universitaetsstrasse 7 : Fax: +43 1 4065822 170 A-1010 Vienna, Austria, Europe : NIC: WW144 --------------------------------------------------------------------------

2 1

Re: Domain object template
by Havard Eidnes 17 Jan '95

17 Jan '95

> > admin-c: The admin-c attribute contains the name or the NIC > > I suggest to make mandatory that the administrative contact > should reside on the site itself. Assume that people have outsourced > the 'technical stuff' of their network, then it is likely that the > technical contact is someone belonging to another company, and > it might be difficult to get in touch with the holder of the > domain itself because the address/phone number is different. This is actually a naming policy issue, and as such this decision may eventually rest with the administrator of each top-level domain. I do however agree that adhering to this practice is a very good idea indeed, and that we should strongly reocmmend it. > => the admin contact for domains is different from the admin > contact for networks. It is explicitely an administrative > person who can answer to questions about name property, > legal problems, etc... In fact I understand your problem > but I believe the change should be done in the network > template. That the network template is broken is no excuse for not doing it right in this document... But I'm sure I misunderstood what you are saying. > > nserver: The nserver attribute contains the list of > > nameservers for of this domain, primary first. The > > format is fully qualified domain name without > > trailing "." OR IP Address(es) of the nameserver. > > Only one server should be described per line. An > > example: > > > > nserver: iraun1.IRA.UKA.DE > > > > Status: optional, multiple lines allowed > > Can we please drop the possibility of allowing IP numbers here? Yes! I'm all for it. It has one disadvantage, though, in that required glue information which has to be inserted in the zone file doing the delegation currently has no place in the domain object. Personally I do not view this as a great loss, it should however be noted. > If one of the secondaries of your domain changes IP number, then > he has the nearly impossible task of finding all these outdated > references. Bind only allows hostnames here; I think it is a good > idea to restrict the database in the same way. Indeed. > Also, we might add 'the first nserver listed is the primary for the zone' > > => "primary first" is in the text. Hmm, if I'm not totally mistaken, the concept of primaries and secondaries is a BINDism, and the concepts are likely to vanish some time in the not too distant future. Thus, I'm a little reluctant to mandate this usage. > > dom-net: The dom-net attribute contains the list of IP net- > > Can someone please explain why it is useful to record this? > Seems that this info might get outdated quickly as it isn't > related to the domain _name_. > > => there is a loose binding between names and addresses. > This attribute can be used if someone'd like to describe it. > This attribute has been made optional then you use it only > if you like. This attribute is essentially unmaintainable and quite difficult to check for as well (think about unannounced networks with no hosts registered in the "externally" viewable DNS tree). I think it should go into the dustbin. - Havard

1 0

Announcement
by Piet Beertema 17 Jan '95

17 Jan '95

I've been following the recent umpteenth (...) discussion on the domain object in the RIPE database. I haven't commented on it though, since frankly I couldn't care less anymore. As NL domain registrar I have had - and am having - increasing problems with the *lot* of extra work caused by trying to keep the RIPE database up-to-date as far as .NL (primary) subdomains are concerned. For one thing, the - perceived or real, that has never become clear in all the discussions on the domain object - need to maintain information that is completely irrelevant for maintaining a domain administration is a hassle. But it's far more a nuisance that the RIPE database has "person" objects that in itself are an absolute kludge, in that they are invisibly related to in any other sense completely unrelated things like network objects and domain objects. The mere presence of these objects in the RIPE database gives the impression that RIPE is trying to keep sort of a worldwide phone directory, but then a "gambling" one: whether or not one will find a person in it is pure luck: you'll find it if the person happens (or happened!) to be related to a network or a domain object, otherwise not. A random generator would do about as well... The person object, because of its linking to different other objects, is also a nuisance in another respect: it calls for the need of "handles", where there is no such need whatsoever if the NL domain administration would be maintained completely seperate from the [setup of the] RIPE database. >From the above it should be clear that, as NL domain registrar, I'm sick and tired of all the extra work caused by the "feed" given to the RIPE database. I want to strongly emphasize here that there in NO OBLIGATION whatsoever for any [top level] domain registrar to "feed" the RIPE database and/or to keep the administration of the domain in accordance with or modeled after the RIPE database. What I'm saying below is therefore an OFFICIAL STATEMENT, and NOT a call for discussion. Included in it is an invitation to the RIPE NCC - as maintainers of the RIPE database and of the related software - and to the DB-WG, for a change in the setup of the database and software. I probably won't be far off if I'm saying that I think that I'm not the only [top level] domain registrar having problems like the ones described. I'm willing to illustrate and discuss on the forthcoming RIPE meeting the sort of problems that the current setup of the RIPE database is posing, even though I've done the same on previous RIPE meetings (albeit in the DNS-WG then). But it should be very clear that this will *not* lead to revoking the statement below and the actions announced in it. The time of endless discussions is really over. I have to "spit in the hands and get to work", without the work being hampered by external factors and matters of taste (which for a large part dominate the whole discussion on objects in the RIPE database). Piet ********************************************************************** * The NL naming authority is planning to change the setup of the * * NL domain administration, to make it possible to keep up with * * the ever increasing number of domain registrations, without an * * unnecessary amount of work posed by "external factors". * * Such an "external factor" is the regular feed of the RIPE whois * * database with complete .NL (primary) subdomain info, calling for * * the need of maintaining in said administration information that * * is not relevant for the purpose of said administration, but only * * for the "external factors". * * Because of the above mentioned change in setup, the information * * in the NL domain administration will no longer be compatible with * * the "domain objects" and "person objects" in the RIPE database. * * Feeding the RIPE database with said information will therefore * * stop. Thereafter anyone is free to enter .NL subdomain objects * * (in fact that's the case already, since there is no protection * * against entering such objects - only against changes), but it * * should be very clear that from the viewpoint of the NL domain * * registration such entries are NOT authoritative. * * * * The NL naming authority recognises the value of a whois service. * * Therefore the NL naming authority will make sure that a whois * * service for .NL (primary) subdomains will be provided, through * * a whois server [to be] set up by the NL naming authority. * * The NL naming authority at the same time recognises that the * * RIPE whois server is known worldwide and that people have come * * to rely on it. Therefore an invitation is enclosed below to the * * RIPE NCC - and to the DB-WG - for a change in the database and * * its software to make it possible that the "RIPE whois service" * * is maintained, with automatic referral of the NL domain info * * on requests for such info. * * * * As soon as the mentioned change of setup has been completed and * * the mentioned whois server made operational, all .NL subdomain * * objects will be removed from the RIPE database, leaving only a * * "minimised" entry for the NL top level domain itself, which will * * then look as follows: * * *dn: nl * * *de: Top level domain for the Netherlands * * *rm: Information about .NL (primary) subdomains can be * * *rm: obtained with "whois -h <server_name>.nl <domain>.nl" * * * * As mentioned above, here is an invitation for a change in the * * RIPE database/software to automate the referral to NL domain * * info on queries directed to the RIPE whois server. Described in * * RIPE database format, after the change of the database/software, * * the "minimised" entry for the NL top level domain would be: * * *td: nl * * *de: Top level domain for the Netherlands * * *ws: <server_name>.nl * * The "ts" attribute would signal this entry as a top level domain * * to the db/whois software, causing forwarding of the query to the * * listed whois server for both the top level domain itself and for * * any <domain>.nl query. This shouldn't sound unfamiliar: it's an * * almost complete analogon of DNS, with the exception that RIPE is * * not "delegating" any top level domain. * * This change/addition has been proposed to the RIPE NCC a couple * * of months ago already, but has met with no reaction whatsoever. * * This announcement is therefore also meant to evoke a reaction * * from the RIPE NCC on this issue/proposal. * * It is clear that the above construction introduces a completely * * new element in the RIPE database/software: an entry for a top * * level domain (NL) implicitly standing for subdomains (*.NL) of * * it. So it might not be trivial to implement it. Still we think * * the RIPE NCC people will be able to handle it. * * * * * * Signed: NL Naming Authority <hostmaster(a)cwi.nl> * ********************************************************************** For your information, I'm adding here what the NL domain administration will look like after the changes, in "RIPE database notation": *dn: <domain name> *on: <organisation's name> *cc: <Chamber of Commerce registration number> *ad: <organisation's location address> *) *ac: <admin-contact> *ph: <phone of admin-c> **) *em: <e-mail of admin-c> *tc: <tech-contact> *ph: <phone of tech-c> **) *em: <e-mail of tech-c> *st: <status> ("MX-only" or "delegated") *dr: <date of registration> *dc: <date of last change> There can be more than one tech-c. *) P.O. Box is *not* (since 1-1-95) accepted here. **) Fax number might be added, but the value of it seems next to zero, given that some 80% of all registered NL subdomains don't list a fax number of contact persons. That's all. An entry with all the really *necessary* information for the domain administration, without irrelevant bells and whistles. Things like nameservers are not included in an entry: that's information that belongs in and is entered in DNS, i.e. the NL zone file. If people feel the need to find that information, then there are plenty of tools (dig, nslookup, host) to find it in DNS. The *st field in the administration gives an indication of what can/should be expected there. If people are too lazy to query DNS, they're not interested in the information. Period. One note: some of the fields given above will not be presented on queries to the NL whois server; *cc is one of them, probably also *dr and *dc. Other fields may be added at any time, as need arises. It should be clear that the setup eliminates any need for a "handle". Sure enough, this change will also have the effect that there will be no more automatic "notification feedback" from the RIPE database in case the data of a person change. But that happens so rarely that I can live with that. Besides, changes pertaining to an NL (primary) subdomain *must* be sent to the NL registrar, not to RIPE.

1 0

Domain object template
by Marten Terpstra 11 Jan '95

11 Jan '95

Folks, Francis has made an update to the old domain object template. A draft version of his document is attached below. Please comment on this document, it should preferably be OK'ed at the coming RIPE meeting. This document is also available as: ftp://ftp.ripe.net/ripe/drafts/ripe-domain.{txt|ps} Cheers, -Marten RIPE Database Template for Domains Francis Dupont Document ID: ripe-049-bis Obsoletes: ripe-049 ABSTRACT This paper describes the format and syntax for the representation for Internet domains and associated contact persons in the RIPE database. 1. Introduction RIPE (Reseaux IP Europeens) coordinates TCP/IP networking for the research community in Europe. One of the activities of RIPE is to maintain a database of European IP networks, DNS domains and their contact persons along with various other kinds of network management infor- mation. This database content is public information for agreed Internet operational purposes. This supports NICs/NOCs all over Europe and beyond to perform their respective tasks. This document describes the format and syntax for Internet domain information and the closely related contact person information. Top, first and sensible level domains should be registered in the RIPE database. Each object in the database describes a single entity in the real world. This basic principle means that information about that entity should only be represented in the corresponding database object and not be repeated in other objects. Objects are described by attributes value pairs, one per line. Objects are separated by empty lines. An attribute that consists of multiple lines should have the attribute name repeated on consecutive lines. The information stored about domain UKA.DE consists of five objects, one domain object and four person objects and looks like this: ripe-049-bis.txt January, 1995 - 2 - domain: UKA.DE descr: Universitaet Karlsruhe descr: Informatik Rechnerabteilung IRA descr: Am Fasanengarten 5 descr: D-7500 Karlsruhe, FRG admin-c: Werner Zorn tech-c: Michael Rotert tech-c: Klaus Becker tech-c: Arnold Nipper nserver: iraun1.IRA.UKA.DE iramu1.IRA.UKA.DE nserver: unido.Informatik.Uni-Dortmund.DE sub-dom: ira dom-net: 129.13.0.0 192.54.104.0 changed: nipper(a)ira.uka.de 910208 source: RIPE person: Werner Zorn address: Universitaet Karlsruhe address: Informatikrechnerabteilung address: Am Fasanengarten 5 address: D-7500 Karlsruhe phone: +49 721 608 3981 fax-no: +49 721 699 284 e-mail: zorn(a)ira.uka.de changed: dfk(a)cwi.nl 11-Apr-90 source: RIPE person: Michael Rotert address: Universitaet Karlsruhe address: Informatikrechnerabteilung address: Am Fasanengarten 5 address: D-7500 Karlsruhe phone: +49 721 608 4221 fax-no: +49 721 699 284 e-mail: rotert(a)ira.uka.de nic-hdl: MR78 changed: dfk(a)cwi.nl 11-Apr-90 source: RIPE person: Klaus Becker address: Universitaet Karlsruhe address: Informatikrechnerabteilung address: Am Fasanengarten 5 address: D-7500 Karlsruhe phone: +49 721 608 3973 fax-no: +49 721 699 284 e-mail: becker(a)ira.uka.de changed: dfk(a)cwi.nl 11-Apr-90 source: RIPE person: Arnold Nipper address: Universitaet Karlsruhe address: Informatikrechnerabteilung ripe-049-bis.txt January, 1995 - 3 - address: Am Fasanengarten 5 address: D-7500 Karlsruhe phone: +49 721 608 4331 fax-no: +49 721 699 284 e-mail: nipper(a)ira.uka.de nic-hdl: AN45 changed: dfk(a)cwi.nl 11-Apr-90 source: RIPE 1.1. How to access the Database ? The database is public information for agreed Internet operational purposes. It can be accessed via a whois server on host whois.ripe.net (tcp port 43). The whole database is also available via anonymous ftp from ftp.ripe.net as file ripe.db in directory ripe/dbase. There is also a compressed version of the database available in that same directory, as well as a version of the database in which the different objects have been collected in different files. This "split" version of the database can be found in the subdirectory split. 1.2. How to submit information to the database ? Database updates should be sent via electronic mail to auto-dbm(a)ripe.net Be sure to supply a person object [1] for each contact per- son mentioned in the network objects. Of course you need not supply person objects if they are already present in the database and the information is still correct. Updates sent in should only contain the objects that need to be updated. The mail is automatically parsed by software that cannot intercept any messages that may be in the mail. If an update needs human intervention, or you have general questions on the procedures, please refer to ripe- dbm(a)ripe.net. Currently no special authorisation is needed to create, modify or delete objects that describe persons or domain name space. However extensive audit trails of all changes are being kept. 2. Format and syntax of the domain object In a short summary below, the attribute column indicates the name of the attribute inside the object, the second column indicates whether this attribute is optional or mandatory, and the third column indicates whether this attribute can ripe-049-bis.txt January, 1995 - 4 - appear more than once per object: attribute optional/mandatory multiple/single domain: mandatory single descr: mandatory multiple admin-c: mandatory multiple tech-c: mandatory multiple zone-c: optional multiple nserver: optional multiple sub-dom: optional multiple dom-net: optional multiple remarks: optional multiple notify: optional multiple mnt-by: optional multiple changed: mandatory multiple source: mandatory single Below each of these attributes and their format and syntax are described in more detail, and examples are given. domain: The domain attribute contains the fully qualified domain name without trailing ".". Note that DNS names are case insensitive. An example: domain: UKA.DE Status: mandatory, only one line allowed descr: The descr attribute consists of a short description of the organization and location where this domain is used. The description can have multiple lines. It need not contain the full postal address as this is required in the contact person objects (see further in this document). Free text is allowed. An example: descr: Universitaet Karlsruhe descr: Informatik Rechnerabteilung IRA Status: mandatory, multiple lines allowed admin-c: The admin-c attribute contains the name or the NIC handle of the administrative contact person. This is someone who will be contacted about administra- tive things such as domain registration etc. A NIC handle (if known) is preferred. Please do not use formal titles like 'Dr', 'Prof' or 'Sir'. Do not add full stops between names or initials. This value should be exactly the same as the attribute in the person object (see further below). More than one administrative contact person can be specified, by simply repeating the attribute. An ripe-049-bis.txt January, 1995 - 5 - example of both the NIC handle and normal name use: admin-c: Daniel Karrenberg or (preferred) admin-c: DK58 Status: mandatory, multiple lines allowed tech-c: The tech-c attribute contains the name or the NIC handle of the technical contact person. This is someone to be contacted for technical problems such as (mis)behavior of nameservers on the net etc. The format and syntax is the same as the admin-c attribute above. Status: mandatory, multiple lines allowed zone-c: The zone-c attribute contains the name of the zone contact for the domain. This is the person listed in the SOA record for the domain when the domain is a zone too (the same argument, not every domains are zones, applies to nserver attribute). The for- mat and syntax is the same as the admin-c attribute above. Status: optional, multiple lines allowed nserver: The nserver attribute contains the list of nameservers for of this domain, primary first. The format is fully qualified domain name without trailing "." OR IP Address(es) of the nameserver. Only one server should be described per line. An example: nserver: iraun1.IRA.UKA.DE Status: optional, multiple lines allowed sub-dom: The sub-dom attribute contains the list of sub- domains of the domain. The format is relative domain name to the domain (in order to keep the list compact). An example: sub-dom: ira Status: optional, multiple lines allowed dom-net: The dom-net attribute contains the list of IP net- works in this domain. The format is dotted quad including trailing 0s, extended formats defined in [1] for range of IP address space are allowed. An example: dom-net: 129.13.0.0 192.54.104.0 ripe-049-bis.txt January, 1995 - 6 - Status: optional, multiple lines allowed remarks: The remarks attribute contains any remarks about this domain that cannot be expressed in any of the other attributes. Although multiple lines are allowed, it should be only be used if it provides extra information to users of the database, and usage should be kept to a minimum. For format is like the description attribute free text. An exam- ple: remarks: MX record only Status: optional, multiple lines allowed notify: The notify attribute contains an email address to which notifications of changes to this object should be send. This can be useful if more than one person manage the same object. A more detailed description can be found in [2]. The format is one RFC822 electronic mail address per line. Although multiple lines are allowed, usage should be kept to a minimum. An example: notify: operations(a)ripe.net Status: optional, multiple lines allowed mnt-by: The maintainer attribute contains a registered maintainer name. This attribute is used for author- isation of database update requests. It is described in more detail in [2]. The format is a registered maintainer name. An example: mnt-by: RIPE-DBM Status: optional, multiple lines allowed changed: The changed field contains information on who last changed this object, and when this change was made. The format is an RFC 822 electronic mail address of the person who made the change, and the date of change in YYMMDD format. Multiple lines are allowed and shows the update history of an object. An exam- ple: changed: marten(a)ripe.net 940328 Status: mandatory, multiple lines allowed source: The source contains a source of information. For the RIPE database, the value should always be "RIPE". This field is used to combine and exchange information between various database sources around ripe-049-bis.txt January, 1995 - 7 - the world. Fixed value: source: RIPE Status: mandatory, only one line allowed, fixed value 3. References [1] Lord, A., Terpstra, M., "RIPE Database Template for Networks and Persons", ripe-119, October 1994. [2] Karrenberg, D., Terpstra, M., "Authorisation and Notif- ication of Changes in the RIPE Database", ripe-120, October 1994. ripe-049-bis.txt January, 1995

4 4

Re: Domain object template
by Andreas.Knocke＠nic.de 11 Jan '95

11 Jan '95

Hello, a couple of additions to the discussion: > * Can we please drop the possibility of allowing IP numbers here? > * If one of the secondaries of your domain changes IP number, then > * he has the nearly impossible task of finding all these outdated > * references. Bind only allows hostnames here; I think it is a good > * idea to restrict the database in the same way. > * > * => IP numbers were allowed in the previous template then we need > * a general agreement before dropping this possibility... > > Perhaps we should try and completely overhaul the domain object? Why > would we go for small changes when we may need major changes? I somehow agree with the positions Geert Jan and Marten gave, a complete overhaul is probably needed and especially the nserver, IP-address idea was much discussed the last time at the RIPE meeting in Amsterdam (May 1994) with the idea that there is a much more useful place to store it - BIND ! On the other hand there is maybe one useful point to IP-numbers here, for a domain abc.zz with a set of nameservers ns1.abc.zz and ns2.abc.zz which have lost connectivity - a very bad situation, I agree - it might be helpful to find there IP addresses here as well, so I would propose to use it only for nserver within the specified domain. domain: ABC.zz descr: ABC company .... nserver: ns1.abc.zz 194.205.120.3 nserver: ns2.abc.zz 194.205.120.6 nserver: ns.domain.my nserver: foo.bar.com ... Giving the primary first is probably a good idea, but what about 'hidden' primaries. It is I think a common situation for organisation behind a dial-up connection administering there own nameserver (as given in the SOA) with only a set of secondaries published as NS-RR's. This cannot be documented - if one wants to - this way, but maybe with a useful remark: > * => there is a loose binding between names and addresses. > * This attribute can be used if someone'd like to describe it. > * This attribute has been made optional then you use it only > * if you like. > > Hmm, personally I'd bin the attribute..... I think that most of the attributes made optional instead of obsolete could be seen as a compromise we can agree upon as a transitional step until the complete overhaul - if not achieveable at this meeting ? > > admin-c: The admin-c attribute contains the name or the NIC > > I suggest to make mandatory that the administrative contact > should reside on the site itself. Assume that people have outsourced > the 'technical stuff' of their network, then it is likely that the > technical contact is someone belonging to another company, and > it might be difficult to get in touch with the holder of the > domain itself because the address/phone number is different. > > => the admin contact for domains is different from the admin > contact for networks. It is explicitely an administrative > person who can answer to questions about name property, > legal problems, etc... In fact I understand your problem > but I believe the change should be done in the network > template. I totally agree with Geert Jan here, the admin-c should be from the organisation using domain and should be changed if he no longer represents this organisation. I didn't follow the discussion but heard some rumors about mtv.com but this way might be a good start. You have to have the organisation's address and at least one phone number somewhere. Another but important aspect I think would be to find a better (more up to date) example, if it should convince and educate new registries. The current one contains a number of factional errors (I'll append the correct entry at the bottom of this posting) and some discrepancy to it's own explanation for instance the format of the change dates not in format YYMMDD. Finally with the handles and names as key values for person objects 1.2 could be reformulated. Before entering or updating person objects the database should be checked for existing entries which were created as references of other objects (inetnum,...). Care should be taken to keep them up to date, without generating duplicate entries one with and one without a handle. I did it a number of times myself when I started using handles so please don't take it as an accusation to anybody. On the other hand the advent of ripe handles gives us the proper way to create different objects for one person where necessary - e.g. if he has his own domain at home and supports a number of networks or anything else at work. -------------------------------------------------------------------------- domain: uka.de descr: Universitaet Karlsruhe descr: Informatik Rechnerabteilung IRA descr: Am Fasanengarten 5, D-76128 Karlsruhe, Germany admin-c: WZ5-RIPE tech-c: KB49 tech-c: AN45 zone-c: KB49 nserver: iraun1.ira.uka.de nserver: iraux1.ira.uka.de nserver: ns.germany.eu.net nserver: ns.nic.de sub-dom: ira dom-net: 129.13.0.0 192.54.104.0 mnt-by: DE-DOM changed: nipper(a)ira.uka.de 910208 changed: knocke(a)nic.de 941121 source: RIPE person: Werner Zorn address: Universitaet Karlsruhe address: Informatikrechnerabteilung address: Am Fasanengarten 5 address: D-76128 Karlsruhe address: Germany phone: +49 721 608 3981 fax-no: +49 721 699 284 e-mail: zorn(a)IRA.UKA.DE nic-hdl: WZ5-RIPE mnt-by: DENIC-P changed: dfk(a)cwi.nl 900411 changed: rv(a)Informatik.Uni-Dortmund.DE 930704 changed: knocke(a)nic.de 941121 source: RIPE person: Klaus Becker address: Universitaet Karlsruhe address: Informatikrechnerabteilung address: Am Fasanengarten 5 address: D-76128 Karlsruhe address: Germany phone: +49 721 608 3973 fax-no: +49 721 699 284 e-mail: becker(a)ira.uka.de nic-hdl: KB49 mnt-by: DENIC-P changed: nipper(a)xlink.net 940406 changed: knocke(a)nic.de 941121 source: RIPE person: Arnold Nipper address: NTG Netzwerk und Telematic GmbH address: Geschaeftsbereich XLINK address: Vincenz-Priessnitz-Str. 3 address: D-76131 Karlsruhe address: Germany phone: +49 721 9652 0 fax-no: +49 721 9652 210 e-mail: nipper(a)xlink.net nic-hdl: AN45 changed: nipper(a)xlink.net 940616 source: RIPE

1 0

Re: Domain object template
by Dave Morton 11 Jan '95

11 Jan '95

All very good points - I agree with Geert. Dave

1 0

Re: "Dale S. Johnson": # Comment characters in templates
by Wilfried Woeber, UniVie/ACOnet 02 Dec '94

02 Dec '94

= * > which would be processed normally, ie the # lines ignored. They = * > would not end up in the database of course. = * = * > Any major showstoppers here? = * = * = * Well, no objections... this is really simple to implement, and may be = * very useful. = =It should be noted though that from that moment on "#" lines no longer =can be used to end an object. Two objects with only a "#" line between =them will be viewed as one, and will generate a syntax error. = =-Marten I agree that the proposed functionality to allow comments is useful. As to the aspect of separation of objects - well, I think with the invention of the password stuff and with the idea of grabbing the whois template output and writing scripts and the like, we should be asking whether just a blank line is the best way to separate objects... How about an "end: whatever string you like to put here" attribute to be equivalent to a blank line separating objects? Any hard feelings? Wilfried. -------------------------------------------------------------------------- Wilfried Woeber : e-mail: Woeber(a)CC.UniVie.ac.at Computer Center - ACOnet : Vienna University : Tel: +43 1 4065822 355 Universitaetsstrasse 7 : Fax: +43 1 4065822 170 A-1010 Vienna, Austria, Europe : NIC: WW144 --------------------------------------------------------------------------

1 0

"Dale S. Johnson": # Comment characters in templates
by Marten Terpstra 29 Nov '94

29 Nov '94

Folks, Dale Johnson from MERIT brings up the issue of allowing "#" style comments in objects between attributes. From an implementation point of view this is *very* simple. Any major objections? The database sw would simply ignore them. Note that they would have to be on a line by themselves, NOT inside an attribute. An example would be: person: Marten Terpstra address: RIPE Network Coordination Centre (NCC) address: PRIDE Project address: Kruislaan 409 address: NL-1098 SJ Amsterdam address: Netherlands # This is some comment phone: +31 20 592 5064 fax-no: +31 20 592 5090 e-mail: Marten.Terpstra(a)ripe.net nic-hdl: MT2 # And this as well notify: marten(a)ripe.net changed: marten(a)ripe.net 941128 source: RIPE which would be processed normally, ie the # lines ignored. They would not end up in the database of course. Any major showstoppers here? -Marten ------- Forwarded Message Date: Mon, 28 Nov 1994 14:49:50 -0500 From: "Dale S. Johnson" <dsj(a)merit.edu> To: Marten(a)ripe.net cc: Tony.Bates(a)ripe.net Subject: # Comment characters in templates Marten, What do you think of the idea of allowing #Comments in templates that are processed by auto-dbm? I bring this up privately because it seems like something that must have caused some discussion before if it isn't all ready implemented. The arguments are the same as for commenting programs: objects (especially aut-num objects) can be huge and complex now. Even if the comments aren't preserved in the storage and output formats, it would make lots of sense for people to keep comments in their original versions on their own machines, and not have to sed these out before they send them to auto-dbm. Is there all ready a history on this question? Or could it be done without discussion? Or if it needs discussion, what list would be appropriate? --Dale ------- End of Forwarded Message

3 3

Re: "Dale S. Johnson": # Comment characters in templates
by Marten Terpstra 29 Nov '94

29 Nov '94

David.Kessens(a)ripe.net writes * Hi Marten, * * I see no problems but is a '#' also allowed after a number of spaces : * * # This is a comment Yup, leading spaces are always ignored. * Do you check the attributes for '#' when sent in ? * Does this generate a warning ? Well, if there is a "#" type comment inside an attribute (ie somewhere inside the value of an attribute) this will generate a syntax error in most cases. Ie something like: person: Marten Terpstra address: ....... phone: +31 20 592 5065 # Preferred phone: +31 20 592 5064 # Backup would spefically NOT be allowed and would generate syntax errors for that attribute. Unless of course the syntax for an attribute allows # chars (I don't think there are any though). -Marten

1 0

RIPE Database Transition T2
by Marten Terpstra 17 Nov '94

17 Nov '94

Dear all, Apologies for this wide distribution but I think it is important enough. This is a reminder that coming Monday the 21st of November, the second and last step of the RIPE database transition will take place. This transition is the transition from network number objects that hold all policy information, to route objects that contain all this information. For more detailed info on what exactly will change and how, please read ripe-123 which is available as: ftp://ftp.ripe.net/ripe/docs/ripe-123.{txt|ps} Especially section 5 explains forthe various RIPE database user groups what is going to change. -Marten

1 0