- db-wg - mailman.ripe.net

Solving the issue of rogue ROUTE objects in the RIPE Database
by denis 14 Nov '15

14 Nov '15

Hi All I raised an idea before the last RIPE Meeting but it did not generate a lot of interest at that time. I brought it up again yesterday on the Anti Abuse WG list and it seemed to get quite a bit of support. So I will bring it back to the DB WG as it is a DB issue. I have CC'ed both AA WG and Routing WG for information. But it may be useful to keep the discussion now on the DB WG list. I don't claim this will solve all the problems of the universe, but it does satisfy an immediate goal to have all ROUTE objects in the RIPE Database created with the knowledge and approval of the related resource holders. And I believe it could be implemented in a relatively short space of time giving immediate benefits. cheers denis STEP 1 Any ROUTE object submitted for creation in the RIPE Database involving an out of region resource (address space and/or ASN) where that out of region resource does not exist in the authoritative RIR database (has not been allocated or assigned), reject the creation. The RIPE NCC mirrors the operational data from all the other 4 RIRs. These mirrors are updated daily as well as the RIRs daily stats. It is easy to determine if a resource is registered in the authoritative database. STEP 2 For those ROUTE objects from STEP 1 where the out of region resource does exist, hold the object creation as pending. The mechanism for doing this already exists in the RIPE Database software as it is used for multiple authentications. Lookup the out of region resource(s) in the authoritative database(s) and find the contacts for that resource. Send a notification to those contacts informing them of the pending ROUTE object creation in the RIPE Database. The notification mechanism already exists in the RIPE Database software. If they don't approve, do nothing and the creation request will time out after a week and the object will not be created. If they do approve, respond in some way (many technical options for doing this that the RIPE NCC can choose from). If appropriate approval(s) are received within a week, create the ROUTE object. STEP 3 On a daily basis, for each ROUTE object in the RIPE Database that relates to an out of region resource, check for the continued existence of that resource in the appropriate RIR database. If it no longer exists, delete the ROUTE object from the RIPE Database. STEP 4 This is a one off cleanup of existing ROUTE objects. For all ROUTE objects currently in the RIPE Database that relate to an out of region, existing resource, send the appropriate notifications. For any that no response is received, delete the ROUTE object from the RIPE Database. We can be a bit more generous on the timing for this step and even send multiple reminder notifications to be sure. (Possible) STEP 5 If a delete request is sent to the RIPE Database for a ROUTE object related to out of region address space without the proper authorisation, send a notification to the contacts for the authoritative address space holder. If an appropriate response is received back, delete the ROUTE object. This would simulate the reclaim functionality for RIPE address space holders. AUT-NUM copies Another byproduct of implementing this is that we no longer need to hold copies of AUT-NUM objects in the RIPE Database. The out of region ASN auth requirement is satisfied by the appropriate response to the notification. So all 'foreign' AUT-NUM objects could be immediately deleted. (Or after allowing time for these ASN holders to make sure their routing policy is actually up to date in the authoritative AUT-NUM object.)

10 25

RIPE 71 DB-WG agenda V3
by Piotr Strzyzewski 13 Nov '15

13 Nov '15

Dear DB-WG Members This is the 3rd draft of an agenda for the DB-WG Meeting at RIPE71 at the JW Marriott Bucharest Grand Hotel in Bucharest, Romania. The DB-WG Meeting is scheduled as usual for Thursday, Nov 19th, starting at 14:00 local time, after the lunch break. The length of our timeslot is 90 minutes. For the overall RIPE 71 meeting plan please refer to its most up-to-date version at https://ripe71.ripe.net/programme/meeting-plan/ Although the agenda is fully packed right now, please feel free to comment agenda items or propose additional topics to be discussed both on the mailing list or direct to the WG Chairs at db-wg-chairs(a)ripe.net Looking forward to see you all in Bucharest. All the best, Job, Nigel & Piotr ________________________________________________________________________ A. Administrative Matters [~5 min] . Welcome . select scribe (thanks to Nigel for volunteering again!) . finalise agenda . approval of minutes from previous WG meeting(s) . review of action list (Nigel Titley) B. DB Operational Update (Tim Bruijnzeels, RIPE NCC) [~10 min] C. New and revised DB-Software functionality (Tim Bruijnzeels, RIPE NCC) [~10 min] (proposed, test, deployment) . "changed:" deprecation . Implementation proposal descr line . restrict usage of RIPE-NCC-RPSL-MNT . other aspects D. Personalised authentication update (Tim Bruijnzeels, RIPE NCC) [~10 min] E. Updated Database documentation (Alex Band, RIPE NCC) [~10 min] F. Routing policies vs. reality in BGP (Tomas Hlavacek) [~15 min] G. Afrinic IRR homing project update (Job Snijders/Tim Bruijnzeels, RIPE NCC) [~10 min] Afrinic IRR (Michel Odou) [~10 min] H. ROUTE object authorisation update (Job Snijders) [~5 min] I. Control over associating objects for number blocks (William Sylvester) [~5 min] X. Heads up about recent discussions at db-wg mailing list Y. Input from other Working Groups and/or Task Forces Z. AOB __________________________________________ -- gucio -> Piotr Strzyżewski E-mail: Piotr.Strzyzewski(a)polsl.pl

1 0

Re: [db-wg] Solving the issue of rogue ROUTE objects in
by Sascha Luck [ml] 06 Nov '15

06 Nov '15

the RIPE Database Reply-To: In-Reply-To: <563CC2EB.2040509(a)inex.ie> X-Operating-System: FreeBSD 10.1-RELEASE On Fri, Nov 06, 2015 at 03:10:35PM +0000, Nick Hilliard wrote: >On 06/11/2015 14:00, Sascha Luck [ml] wrote: >personal information is not exported for route: objects, >therefore this does not apply: That's the point Nick, for "verification" of out-of-area contacts, this information would *have* to be exported. In this scheme from other RIRs to the NCC but it would, if the others implemented similar schemes, also be exported from the NCC to other RIRs. rgds, Sascha Luck > >> remarks: **************************** remarks: * >> THIS OBJECT IS MODIFIED remarks: * Please note that all >> data that is generally regarded as personal remarks: * >> data has been removed from this object. remarks: * To >> view the original object, please query the RIPE Database at: >> remarks: * http://www.ripe.net/whois remarks: >> **************************** > >Nick >

1 0

RIPE 71 DB-WG agenda V2
by Piotr Strzyzewski 05 Nov '15

05 Nov '15

Dear DB-WG Members This is the 2nd draft of an agenda for the DB-WG Meeting at RIPE71 at the JW Marriott Bucharest Grand Hotel in Bucharest, Romania. The DB-WG Meeting is scheduled as usual for Thursday, Nov 19th, starting at 14:00 local time, after the lunch break. The length of our timeslot is 90 minutes. For the overall RIPE 71 meeting plan please refer to its most up-to-date version at https://ripe71.ripe.net/programme/meeting-plan/ Although the agenda is fully packed right now, please feel free to comment agenda items or propose additional topics to be discussed both on the mailing list or direct to the WG Chairs at db-wg-chairs(a)ripe.net Looking forward to see you all in Bucharest. All the best, Job, Nigel & Piotr ________________________________________________________________________ A. Administrative Matters [~5 min] . Welcome . select scribe (thanks to Nigel for volunteering again!) . finalise agenda . approval of minutes from previous WG meeting(s) . review of action list (Nigel Titley) B. DB Operational Update (Tim Bruijnzeels, RIPE NCC) [~10 min] C. New and revised DB-Software functionality (Tim Bruijnzeels, RIPE NCC) [~10 min] (proposed, test, deployment) . "changed:" deprecation . Implementation proposal descr line . restrict usage of RIPE-NCC-RPSL-MNT . other aspects D. Personalised authentication update (Tim Bruijnzeels, RIPE NCC) [~20 min] E. Updated Database documentation (Alex Band, RIPE NCC) [~10 min] F. Routing policies vs. reality in BGP (Tomas Hlavacek) [~15 min] G. Afrinic IRR homing project update (Job Snijders/Tim Bruijnzeels, RIPE NCC) [~10 min] H. ROUTE object authorisation update (Job Snijders) [~5 min] I. Control over associating objects for number blocks (William Sylvester) [~5 min] Y. Input from other Working Groups and/or Task Forces Z. AOB __________________________________________ -- gucio -> Piotr Strzyżewski E-mail: Piotr.Strzyzewski(a)polsl.pl

1 0

Re: [db-wg] Database release 1.83 deployed to RC environment
by Alexander Stranzky 02 Nov '15

02 Nov '15

Am 02.11.15 um 12:00 schrieb db-wg-request(a)ripe.net: > Dear colleagues, > > We are happy to announce the deployment of RIPE Database software release 1.83 to the Release Candidate (RC) environment, which has gone live on Friday 30 October. > > - When deleting a person object, you will be prompted to also delete the associated maintainer if it has no other dependencies Does this affect REST API calls in any way? > - When trying to delete an object that is still referenced, you will get a list of blocking objects How does the REST API implement that? Does it send the objects along the error message(s) or can either part be omitted? Best regards, Alexander Stranzky -- velia.net Internetdienste GmbH * Hessen-Homburg-Platz 1 * D-63452 Hanau Geschäftsführer: Franz G. Köhler, Arek Akilli * AG Hanau * HRB 7588 Tel: +49 6181-1898119 * Fax: +49 6181-1898117 * http://www.velia.net Follow us on twitter: https://twitter.com/velia_net

2 1

RIPE 71 DB-WG agenda V1
by snash 28 Oct '15

28 Oct '15

Can we please consider whether there is consensus on the response to Job's presentation in RIPE70, regarding authority to permit an AS to originate a route. This has been discussed in the "Temporary Origins" thread. Regards Steve Nash ------------------------------ Date: Tue, 27 Oct 2015 14:58:57 +0100 From: Piotr Strzyzewski <Piotr.Strzyzewski(a)polsl.pl> To: db-wg(a)ripe.net Subject: [db-wg] RIPE 71 DB-WG agenda V1 Message-ID: <20151027135857.GE21621(a)hydra.ck.polsl.pl> Content-Type: text/plain; charset=utf-8 Dear DB-WG Members This is the 1st draft of an agenda for the DB-WG Meeting at RIPE71 at the JW Marriott Bucharest Grand Hotel in Bucharest, Romania. The DB-WG Meeting is scheduled as usual for Thursday, Nov 19th, starting at 14:00 local time, after the lunch break. The length of our timeslot is 90 minutes. For the overall RIPE 71 meeting plan please refer to its most up-to-date version at https://ripe71.ripe.net/programme/meeting-plan/ Please feel free to comment agenda items or propose additional topics to be discussed both on the mailing list or direct to the WG Chairs at db-wg-chairs(a)ripe.net Looking forward to see you all in Bucharest. All the best, Job, Nigel & Piotr ________________________________________________________________________ A. Administrative Matters [~5 min] . Welcome . select scribe (thanks to Nigel for volunteering again!) . finalise agenda . approval of minutes from previous WG meeting(s) . review of action list (Nigel Titley) B. Database Operational Update (Tim Bruijnzeels, RIPE NCC) [~10 min] C. New and revised DB-Software functionality (Tim Bruijnzeels, RIPE NCC) [~30 min] (proposed, test, deployment) D. Personalised authentication update (Tim Bruijnzeels, RIPE NCC) [~10 min] E. Updated Database documentation (Alex Band, RIPE NCC) [~10 min] F. Routing policies vs. reality in BGP (Tomas Hlavacek) [~15 min] G. Afrinic IRR homing project update (Job Snijders/Tim Bruijnzeels, RIPE NCC) [~10 min] Y. Input from other Working Groups and/or Task Forces Z. AOB __________________________________________ -- gucio -> Piotr Strzy?ewski E-mail: Piotr.Strzyzewski(a)polsl.pl ------------------------------

2 1

RIPE 71 DB-WG agenda V1
by Piotr Strzyzewski 27 Oct '15

27 Oct '15

Dear DB-WG Members This is the 1st draft of an agenda for the DB-WG Meeting at RIPE71 at the JW Marriott Bucharest Grand Hotel in Bucharest, Romania. The DB-WG Meeting is scheduled as usual for Thursday, Nov 19th, starting at 14:00 local time, after the lunch break. The length of our timeslot is 90 minutes. For the overall RIPE 71 meeting plan please refer to its most up-to-date version at https://ripe71.ripe.net/programme/meeting-plan/ Please feel free to comment agenda items or propose additional topics to be discussed both on the mailing list or direct to the WG Chairs at db-wg-chairs(a)ripe.net Looking forward to see you all in Bucharest. All the best, Job, Nigel & Piotr ________________________________________________________________________ A. Administrative Matters [~5 min] . Welcome . select scribe (thanks to Nigel for volunteering again!) . finalise agenda . approval of minutes from previous WG meeting(s) . review of action list (Nigel Titley) B. Database Operational Update (Tim Bruijnzeels, RIPE NCC) [~10 min] C. New and revised DB-Software functionality (Tim Bruijnzeels, RIPE NCC) [~30 min] (proposed, test, deployment) D. Personalised authentication update (Tim Bruijnzeels, RIPE NCC) [~10 min] E. Updated Database documentation (Alex Band, RIPE NCC) [~10 min] F. Routing policies vs. reality in BGP (Tomas Hlavacek) [~15 min] G. Afrinic IRR homing project update (Job Snijders/Tim Bruijnzeels, RIPE NCC) [~10 min] Y. Input from other Working Groups and/or Task Forces Z. AOB __________________________________________ -- gucio -> Piotr Strzyżewski E-mail: Piotr.Strzyzewski(a)polsl.pl

1 0

Database release 1.82 deployed to RC environment
by Trudy Prins 19 Oct '15

19 Oct '15

Dear colleagues, We are happy to announce the deployment of RIPE Database software release 1.82 to the Release Candidate (RC) environment. We plan to deploy this version to production on Wednesday 14 October. This release introduces a number of features on the internal API of the RIPE Database that were needed to support the automatic updating of placeholder objects when resources are transferred into or out of the RIPE region. This release should not introduce any publicly visible changes, but we encourage all of you to test the new release in the RC environment. Note that the previous release 1.81 has not been deployed to production. While testing in the RC environment, we found a number of small issues in the User Interface (UI) that we will fix shortly. Technically the UI is not part of the core whois, but version 1.81 introduces a number of changes to the internal API in support of the new UI. Since that UI is not deployed now, there is no need to deploy 1.81 now either. And to avoid doing unnecessary upgrades of the production environment it was decided to skip this release, and deploy these changes only when 1.82 is deployed. Please let us know if you have any questions or comments. Kind regards, Trudy Prins Manager Software Engineering RIPE NCC

2 1

Feedback on updated Database documentation
by Alex Band 14 Oct '15

14 Oct '15

Dear working group, I have an ongoing project to write RIPE Database documentation that is clear and readable, focussing on achieving your goal and offer best practices. I've got a bit of a collection going now: Setting up maintainers and hierarchical authorisation: https://www.ripe.net/manage-ips-and-asns/db/support/security/maintainers The different authentication methods for the RIPE Database: https://www.ripe.net/manage-ips-and-asns/db/support/security/protecting-data Configuring Reverse DNS: https://www.ripe.net/manage-ips-and-asns/db/support/configuring-reverse-dns Managing route objects in the IRR: https://www.ripe.net/manage-ips-and-asns/db/support/managing-route-objects-… I'd really like feedback from you, the users of the RIPE Database, to understand how usable it is and what needs clarifications, diagrams, examples, corrections or additions. I'd also love to hear which topic I should cover next. Thanks, and have a good weekend! -Alex

1 1

Interruption of RIPE Database and Related Services
by Trudy Prins 05 Oct '15

05 Oct '15

Dear colleagues, Starting at approximately 14:30 UTC on 4 October 2015, RIPE Database queries and updates, the LIR Portal and other related services experienced problems. Our investigation found that the service interruptions were due to a hardware failure. The queries were restored at 16:00 UTC and other affected services were restored at around 21:00 UTC. The ability of the RIPE Database to process incoming mail-updates was restored at 12:30 UTC on 5 October 2015. Please be aware that all mail-updates sent to Whois during this outage period must be considered lost. A summary of the hardware failure is as follows: The RAID controller on the master MySQL server reinitialised all of a sudden, causing IO errors. Unfortunately, we also experienced another (unrelated) hardware problem at the same time with the external load balancers. This combination of issues significantly affected the time it took us to rectify the situation. We apologise for any inconvenience this may have caused. Kind regards, Trudy Prins Software Engineering Manager

1 0

RIPE Database and related services interruption
by Theodoros Polychniatis 04 Oct '15

04 Oct '15

Dear colleagues, Since 14:30 UTC on 4 October 2015, RIPE Database queries and updates, the LIR Portal and other related services have been experiencing problems. We are investigating at the moment. We apologise for any inconvenience this may cause. Kind regards, Theodoros Polychniatis Senior Software Engineer RIPE Database Team

1 0

db object hijacking
by Nick Hilliard 03 Oct '15

03 Oct '15

some interesting data here: > https://www.lightbluetouchpaper.org/2015/10/02/badness-in-the-ripe-database/ Nick

3 2

Call for agenda items, DB-WG meeting during RIPE71, Bucharest, Romania
by Piotr Strzyzewski 03 Oct '15

03 Oct '15

Dear DB-WG participants We are reaching out to you for agenda items for the Database Working Group session during the RIPE71 meeting in Bucharest, Romania, 16-20 November 2015. The DB-WG session is currently scheduled as usual for Thursday (Nov 19th), starting at 16:00 local time, after the coffee break. The length of our timeslot is 90 minutes. Please submit your items or topic suggestions directly to the WG chairs or to the list for public discussion. The draft agenda will be published soon. Looking forward to see you all in Bucharest. All the best, Job, Nigel & Piotr -- gucio -> Piotr Strzyżewski E-mail: Piotr.Strzyzewski(a)polsl.pl

6 7

Re: [db-wg] PHP Client for RIPE REST Web Service
by Alexander Stranzky 25 Sep '15

25 Sep '15

Hello, I’ve written a PHP client for the REST web service and now I want to open a discussion whether this library is sufficient for people using the RIPE web service or if there are things I didn’t consider when developing it. the library is available at github: https://github.com/Dormilich/ripedb-client Best regards, Alex

1 0

[training] RIPE NCC Webinars - new dates
by Training Services 22 Sep '15

22 Sep '15

Dear colleagues, We are pleased to announce the launch of new dates for our Webinars. The RIPE NCC Webinars are live and take only one hour. You can interact with our trainers without leaving your desk. We focus on the topics and issues most important for LIRs. Register now at https://www.ripe.net/support/training/learn-online/webinars Participation is limited to 20 people, so don't hesitate if you want to take part! If you have questions, please email <training(a)ripe.net>. We look forward to seeing you online. Kind regards, RIPE NCC Training Services

1 0

[training] RIPE NCC Webinars - new dates
by Training Services 22 Sep '15

22 Sep '15

Dear colleagues, We are pleased to announce the launch of new dates for our Webinars. The RIPE NCC Webinars are live and take only one hour. You can interact with our trainers without leaving your desk. We focus on the topics and issues most important for LIRs. Register now at https://www.ripe.net/lir-services/training/e-learning/webinars Participation is limited to 20 people, so don't hesitate if you want to take part! If you have questions, please email <training(a)ripe.net>. We look forward to seeing you online. Kind regards, RIPE NCC Training Services

1 1

Re: [db-wg] This db-help list will be discontinued
by ripedenis＠yahoo.co.uk 18 Sep '15

18 Sep '15

Hi guys I don't really have any opinion either way as to whether this list is discontinued. But as it is a RIPE list and not a RIPE NCC list I think it should at least be proposed to close it with some justification rather than an announcement of a decision. I can see from the archive that it has not been used very much recently, but maybe that is because it is already shown on the web site as an inactive list. Just for some historical background, this list was intended as a self help forum on database issues. Users of the RIPE Database could ask questions about specific problems or more general issues about usage of the RIPE Database, how other members interact with the database and what tools, if any, they use. Other users could offer advice and the RIPE NCC would only contribute if any questions were left unanswered. So is it considered that there is no need now for a self help forum? Should all questions be directed straight to the RIPE NCC via ripe-dbm or should such questions now go to the DB-WG? If the latter then the description of the DB-WG mailing list should be amended to reflect this. (btw the web site still lists Wilfried as the chair :) ) cheersdenis From: Alex Band <alexb(a)ripe.net> To: db-help(a)ripe.net Sent: Wednesday, 16 September 2015, 13:27 Subject: This db-help list will be discontinued Dear colleagues, We are going to discontinue this mailing list, db-help. If you would like to discuss something related to the RIPE Database, there are several options available: 1. For support or to submit bug report, please contact the RIPE NCC by visiting https://ripe.net/contact or send a message to ripe-dbm(a)ripe.net 2. To start a public discussion about the RIPE Database, for example about suggestions for functionality changes, best practices or operational usage, please subscribe to the RIPE Database Working Group mailing list: https://www.ripe.net/mailman/listinfo/db-wg/ This list will be disabled shortly. Kind regards, Alex Band RIPE NCC

1 0

Re: [db-wg] FAILED: arak1
by ripedenis＠yahoo.co.uk 09 Sep '15

09 Sep '15

Hi Reihane I don't think anyone monitors this db-help list now. I have seen several questions go unanswered on here. But I can answer the question for you. You are trying to create the object 2.179.95.128 - 2.179.95.255 with status 'ASSIGNED PA'. The parent object is 2.179.95.96 - 2.179.96.127 and this also has status 'ASSIGNED PA'. You cannot create a hierarchy of objects all with status 'ASSIGNED PA'. The parent object range is assigned to Islamic-Azad-University-Of-Ashtian. That is part of an allocation range 2.176.0.0 - 2.191.255.255 made to Information Technology Company (ITC). If you have been assigned the sub range 2.179.95.128 - 2.179.95.255 then you need to ask ITC to split the parent object into separate assignments. Otherwise you need to ask ITC to assign you a different range. Either way as ITC controls this block you need to talk to them. cheersdenis From: Javidi <ripe(a)dci.ir> To: db-help(a)ripe.net Sent: Tuesday, 8 September 2015, 12:29 Subject: FW: FAILED: arak1 Why does this object not create? 2.179.95.128 - 2.179.95.255 Error: inetnum parent has incorrect status: ASSIGNED PA But this is not coorect Please advise me Regards Reihane -----Original Message----- From: RIPE Database Administration local [mailto:unread@ripe.net] Sent: Tuesday, September 08, 2015 11:58 AM To: ripe(a)dci.ir Subject: FAILED: arak1 > From: Javidi <ripe(a)dci.ir> > Subject: arak1 > Date: Tue, 08 Sep 2015 10:27:40 +0200 > Reply-To: Javidi <ripe(a)dci.ir> > Message-ID: <002001d0ea18$1e780080$5b680180$(a)dci.ir> SUMMARY OF UPDATE: Number of objects found: 2 Number of objects processed successfully: 1 Create: 1 Modify: 0 Delete: 0 No Operation: 0 Number of objects processed with errors: 1 Create: 1 Modify: 0 Delete: 0 DETAILED EXPLANATION: ***Warning: Invalid keyword(s) found: arak1 ***Warning: All keywords were ignored ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The following object(s) were found to have ERRORS: --- Create FAILED: [inetnum] 2.179.95.128 - 2.179.95.255 inetnum: 2.179.95.128 - 2.179.95.255 netname: Telecommunication-of-Markazi descr: Telecommunication Company country: IR admin-c: AUTO-1 tech-c: AUTO-1 status: ASSIGNED PA mnt-by: AS12880-MNT changed: ripe(a)dci.ir 20150908 source: RIPE ***Error: inetnum parent has incorrect status: ASSIGNED PA ***Warning: Deprecated attribute "changed". This attribute will be removed in the future. ***Warning: Referenced person object aaa159-RIPE from mntner: AS12880-MNT is missing mandatory attribute "mnt-by:" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The following object(s) were processed SUCCESSFULLY: --- Create SUCCEEDED: [person] SM29689-RIPE soroush mazdak ***Warning: Deprecated attribute "changed". This attribute will be removed in the future. ***Warning: Referenced person object aaa159-RIPE from mntner: AS12880-MNT is missing mandatory attribute "mnt-by:" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The RIPE Database is subject to Terms and Conditions: http://www.ripe.net/db/support/db-terms-conditions.pdf For assistance or clarification please contact: RIPE Database Administration <ripe-dbm(a)ripe.net> Generated by RIPE WHOIS Update version 1.80.1 on DB-2 Handled email update (RIPE, 2015-09-08 10:27:57)

1 0

Database release 1.81 deployed to RC environment
by Alex Band 08 Sep '15

08 Sep '15

Dear colleagues, We are happy to announce the deployment of RIPE Database software release 1.81 to the Release Candidate (RC) environment. This release extends and fixes some of the functionality changes that were part of the 1.80 release, especially with regards to authenticating and creating objects. This is why we urge you, again, to thoroughly test the RC environment to make sure nothing in your workflow breaks: https://www.ripe.net/data-tools/db/release-notes/rc-release-candidate-envir… Here are the most notable changes I'd like to highlight. When using the RC environment, please focus on using webupdates to test these features: - We added auto-complete for attributes such as maintainers. This means you can start typing a maintainer name and webupdates will suggest existing maintainers, along with their associated authentication. - Webupdates tries to be smarter about deleting objects. When, for example, you want to delete a person object, webupdates will suggest you also delete the associated maintainer, if it is not referenced anywhere else. - "Create a new person and maintainer pair" (previously known as the New Organisation Startup Form) has been redesigned. After logging in with your RIPE NCC Access account, you just need to enter four fields to get going. Because webupdates contains such fundamental user interface changes, gathering your feedback has been cumbersome at times. This is why we added the Usersnap feedback widget to the RC environment, so you can highlight and annotate the page you are providing feedback on. It will make it easier for us to process your comments and implement fixes and changes. From all of us at the Database team, we are looking forward to your comments and we hope you enjoy this release! Kind regards, Alex Band Product Manager RIPE NCC

1 0

[training] IP Address Space Course this November in Bucharest
by Training Services 08 Sep '15

08 Sep '15

Dear colleagues, We are happy to announce that a RIPE NCC training course will take place on the Sunday before the RIPE 71 Meeting in Bucharest this November. This course will focus on how to obtain and manage IP address space. The course is free of charge and is open to anyone interested. The course will cover the most frequently asked questions that the RIPE NCC receives about IP address space. ----------------- Course details ---------------- IPv6 Address Space Basics: How to Obtain and Manage Your IP Addresses Sunday, 15 November 2015, 10-16:00 JW Marriott Bucharest Grand Hotel ---------------- Course goals ---------------- By the end of this course, you will be able to: - Manage your IPv4 and IPv6 addresses according to current RIPE Policies - Understand how to obtain IPv4 addresses through transfers - Protect your address space from hijacking ---------------------------------------- Who will benefit from this course? ----------------------------------------- Anyone interested in the policies and procedures around address space in the RIPE NCC service region will find this course useful. No prior knowledge of the topic is necessary. ------------------------- Course outline: ------------------------- - Becoming a RIPE NCC member (why and how) - Obtaining IP addresses (IPv4 and IPv6) - IP address space transfers, mergers and acquisitions - IPv6 basics - Address space hijacking - Resource Certification (RPKI) ---------------------------- Additional information ---------------------------- - Free of charge - Coffee and lunch will be provided - Delivered by the RIPE NCC’s Training Services and Registration Services departments ----------------------------------------- Registration for RIPE NCC members ----------------------------------------- If you are a RIPE NCC member and interested in attending this course, please visit our website on the following page to register: <https://lirportal.ripe.net/training/register/courseCode/LIR20150032> ------------------------------------ Registration for non-members ------------------------------------- If you are not (yet) a member, please fill out the following information and send this to <training(a)ripe.net>: - Email: - Course name: - Full name : - Vegetarian: yes/no Be quick - we only have 45 seats available on a first come, first served basis! If there is enough interest, we will continue to offer courses on different topics of interest alongside future RIPE Meetings. Kind regards, RIPE NCC Training Services

1 0

[training] RIPE NCC Training Courses October-December 2015
by Training Services 27 Aug '15

27 Aug '15

Dear colleagues, Our training team travels the RIPE NCC service region to deliver training courses to our members without any additional cost. Over the next few months, we'll be in Amsterdam, Athens, Odessa, Naples, Cardiff, Barcelona, Oslo, Bucharest, Budapest, Istanbul, Zagreb, Doha, Berlin. Visit the following page to register and to check which training courses we are giving in your area: https://lirportal.ripe.net/training/courses The RIPE NCC delivers the following training courses: - LIR Training Course - RIPE Database Training Course - Basic IPv6 Training Course - 2 days Advanced IPv6 Training Course - Routing Security Training Course - DNSSEC Training Course For more information visit: https://www.ripe.net/support/training/courses With kind regards, Rumy Spratley-Kanis Training Services Manager

1 0

Updating maintainer objects with filtered auth lines
by Daniel Stolpe 24 Aug '15

24 Aug '15

I just had a very specific experience but this is a general problem. What I wanted to do was update a maintainer object in the database. No problems since I was authorized via a PGP key. The problem was that one of the lines looked like: auth: MD5-PW # Filtered And although I have no personal use for the md5 hash I did not want to disturb users who might have. I asked the NCC for advice and the answers were like "if you have an access account" (yes) you can add a line "auth: SSO xxxx(a)xxxx.xx" (yes). Still not a solution to my problem since adding the SSO line would just break the md5 anyway. The solution this time was that I eventually found a local copy of the object with the md5 hash unfiltered. I know the md5 hashes are a security problem and I do not recommend anyone using them but as long as they are there the filtering causes trouble. And by the way, we now see a lot of auth: SSO # Filtered What I am looking for is a way to retrieve the whole unfiltered object for anyone authorized, or, at least, a possibility to updated the object without touching the filtered lines. Maybe you could send a PGP signed request, not for updating but just for viewing the complete object? Best Regards, Daniel Stolpe _________________________________________________________________________________ Daniel Stolpe Tel: 08 - 688 11 81 stolpe(a)resilans.se Resilans AB Fax: 08 - 55 00 21 63 http://www.resilans.se/ Box 45 094 556741-1193 104 30 Stockholm

6 9

call for application authorisation ideas
by Job Snijders 24 Aug '15

24 Aug '15

Hi group, I know all of you have automated their interactions with the RIPE database entirely. :-) As it currently stands, there are two ways to automate interaction with the RIPE DB: a) send GPG signed emails (and wait for the dumb greylisting to clear) b) call the http://rest.db.ripe.net/{source}/{objecttype}/{key}?password=XXX restful API Option A works, but is not very nice if you want something done immediatly and require a confirmation that the operation succeeded. The advantage of option A is that you don't need any auth: MD5-PW lines in your mntner object and RIPE stores no sensitive data. Option B goes very well with modern programming paradigms, but the disadvantage is that you need to have an "auth: MD5-PW XXX" line in your maintainer, and should that pass ever leak somehow it could be used through webupdates / email / api, from any location. I think all in the group agree that it would be very nice if you can perform 100% of all operations without the need for any MD5-PW. I'll even go as far as stating that we should not be looking at successors such as SHA3-PW, let's leap forward and make the PW auth concept entirely obsolete. :-) CALL FOR IDEAS ============== Now that personalised authorisation is covered and in progress, what about our poor applications? How should they authenticate with the RIPE DB? I see value in stuff like signalling to RIPE "this token can only be used for the API from this source IP address", I've also heard that OAUTH2 is magic and populair for app2app auth. Or maybe all of this is is overkill and we just need to GPG sign the payload of the requests to rest.db.ripe.net and call it a day? DB-WG, please speak up and voice your ideas! Kind regards, Job

5 10

Re: [db-wg] [opensource-wg] Question for RPSL Parser
by Stavros Konstantaras 20 Aug '15

20 Aug '15

Shane is right, I don’t have the intention to shuffle the project with Bison and Flex because 1) I don’t have the knowledge of these technologies 2) I don’t have the time to learn them 3) I want to Pythonize as much as I can and be independent as much as possible (OK maybe a little bit dependent from other Python Libraries but this is the boundary). I am sure that you guys made a great job 14 years before but now or soon RPSL will be replaced with something else so I still want my toolset to be alive by easily and quickly replacing 1-2 Python libraries. What my prototype does now is extract the attributes and values by using Regular Expressions, a solution that has already been proposed in this discussion and I think this is the way to go. In theory, it can be an easy parser based on Python’s RE but complexity starts when -for example- RPSL says “accept as-set BLABLA” instead of “accept 10.100.200.0/16" and that as-set needs to be resolved (another query to RIPE DB). But anyway, thanks for your ideas. Crazy or not, I don’t mind everyone is welcome. If I still need to reply to Tomas last e-mail but I am quite busy today. Kind Regards Stavros > On 20 Aug 2015, at 13:05, Shane Kerr <shane(a)time-travellers.org> wrote: > > Denis, > > There are two problems with this: > > 1. Lex and YACC (actually flex and bison for the RIPE Database) are > tightly integrated into C (or C++ if you are feeling brave). > > 2. Stavros does state a goal of avoiding reuse of past or legacy > software, which surely means the RIPE Database code. (Okay, I think > it was only 12 or 14 years ago when we wrote these parts, but that > surely counts as "past"...) > > :) > > Cheers, > > -- > Shane > > On Thu, 20 Aug 2015 10:56:20 +0000 (UTC) > denis walker <dw100uk(a)yahoo.co.uk> wrote: > >> HI >> The RIPE Database I believe still uses LEX and YACC to parse the routing policy information from the RPSL attribute/value pairs. Is it possible to just 'drop' this into a python script and extend it to do any extra parsing you want? (I know nothing about python so I may be way off the mark here :) but it is just a thought) >> cheersdenis >> From: Shane Kerr <shane(a)time-travellers.org> >> To: Stavros Konstantaras <stavros(a)nlnetlabs.nl> >> Cc: db-wg(a)ripe.net >> Sent: Thursday, 20 August 2015, 5:21 >> Subject: Re: [db-wg] [opensource-wg] Question for RPSL Parser >> >> Stavros, >> >> On Wed, 19 Aug 2015 16:00:59 +0200 >> Stavros Konstantaras <stavros(a)nlnetlabs.nl> wrote: >> >>> To make things more clear, our project at NLnet Labs is the >>> development of "a modern IRRtoolset" written in Python and targeting >>> any operator, not just another homemade tool for our own needs. Or to >>> say in more detail the creation of a tool that is able to configure >>> BGP routers directly+automatically by extracting the policies from >>> RIPE DB. This means that I am struggling to avoid the (re)use of any >>> past or legacy software that exists, otherwise we loose independency >>> and inherit restrictions from the past. >> >> I don't know of any Python RPSL parser you can use. >> >> Your goals make a certain amount of sense. Unfortunately RPSL is an >> ugly language... it's actually more like several languages in one, all >> bad. :P >> >> * Start with simple attribute/value, one per line >> >> * Oh, but then "RPSL-ize", which allows line continuation and >> end-of-line comments >> >> * Oh, actually we want to make a separate grammar for each attribute >> >> * But be sure to make all of this "extensible", to insure maximum >> confusion! >> >> My approach in the past has been to start with a simple generic parser >> that split text into objects, objects into attributes, extracts >> attribute name & values (handling line continuation and end-of-line >> comments). You can do all of this with Python regular expressions, >> something like r"\n(?![ \t+])" to split objects into attributes; >> cleaning end-of-line comments & line continuation characters is >> straightforward. Then you can deal with the grammar for the attributes >> you know, and ignore the rest. You can extend the parsing to be more >> and more comprehensive until you are able to parse the data set you >> worry about. >> >> I'm not sure this is worth doing... but if there was a good, >> easy-to-use Python library then maybe interesting things would result? >> >> >> >> Cheers, >> >> -- >> Shane >> >> >> >> >

2 1

Re: [db-wg] [opensource-wg] Question for RPSL Parser
by Stavros Konstantaras 20 Aug '15

20 Aug '15

Hi Thomas and others, thanks for your quick replies. To make things more clear, our project at NLnet Labs is the development of "a modern IRRtoolset" written in Python and targeting any operator, not just another homemade tool for our own needs. Or to say in more detail the creation of a tool that is able to configure BGP routers directly+automatically by extracting the policies from RIPE DB. This means that I am struggling to avoid the (re)use of any past or legacy software that exists, otherwise we loose independency and inherit restrictions from the past. Currently, I do have a working proof of concept with a simple RPSL parser written in Python which is able to parse simple policies with (v6)import(s)-(v6)export(s)-accept-announce-action-pref-med-coomunity attributes. Convenient I would say for many existing policies like KPN’s, RIPE’s etc. but definitely it will crash in complex policy files like GRNET’s. My current solution uses also BGPq3 to translate AS, AS-SET and ROUTE-SET and this is also something that I want to ged rid of. So I was looking for the existence of a Python Library which can do a complete job and translate any existing policy in an intermediate data structure like XML (this is what I do now). I was hoping to find one, adopt it and present our (completed) work in the next RIPE meeting (yes I know I am very ambitious, I need to slow down). * Masimo, I already checked rpsltool and discarded it. But thanks for your super-fast reply. * Tomas, thanks for pointing me to your library. I will have a look at it and check if it is convenient for our project. * George, yes you are right. This should be the #1 step, take corresponding RPSL RFCs and implement them in Python. However, that would take too much time and will not allow us to work on other missing functionalities of the prototype. And we would like to have something ready at the beginning of November. However, I will check your solution as well. I hope now that I made myself more clear. Big thanks to everyone, every help, info or idea is kindly appreciated. Kind Regards Stavros ---- Stavros Konstantaras Internet Research Engineer, NLnet Labs Science Park 400, 1098 XH, Amsterdam Fingerprint: 4502 7D16 2DF8 ADB0 4AA6 21A9 BF9E EFFF 2744 FE5D > On 19 Aug 2015, at 14:39, Tomas Hlavacek <tomas.hlavacek(a)nic.cz> wrote: > > Hi Stavros! > > On 08/19/2015 02:15 PM, Ondrej Filip wrote: >> >> Vis o necem? >> >> -------- Forwarded Message -------- >> Subject: [opensource-wg] Question for RPSL Parser >> Date: Wed, 19 Aug 2015 14:13:58 +0200 >> From: Stavros Konstantaras <stavros(a)nlnetlabs.nl> >> To: db-wg(a)ripe.net >> CC: opensource-wg(a)ripe.net >> >> >> >> >> Hi all WG members, >> >> For my project at NLnet Labs I would like to ask you if you know any >> (relatively) complete RPSL parser written in *Python*. I searched >> around and I didnât find anything. Does someone know any repository >> where I can get one or maybe contact someone who has written one? > > It depends on what you need... I wrote one - > https://github.com/tmshlvck/bgpcrunch , but the aim was rather data > analysis than "authoritative" RPSL translation. When it comes to filter > interpretation my approach is quite "heuristic" and it is focused on > speed and ability to take short-cuts which wouldn't be possible with > full parsing the RPSL objects according to EBNF metasyntax. > > Have you considered creating simple Python interface for peval from > IRRToolSet? It might do the job if you don't need any special features. > > Cheers, > Tomas

4 4