- db-wg - mailman.ripe.net

Whois Release 1.101
by Edward Shryane 01 Jul '21

01 Jul '21

Dear Working Group, RIPE Database release 1.101 has been deployed to the Release Candidate environment. We plan to deploy to production on Thursday 1st July. This release includes the following main changes: * Switch RIPE database to UTC timezone (all timestamps will be in UTC and all timestamps specify the 'Z' timezone) * Display an error on NRTM if client is blocked by ACL limit (#812) * Added rewrite rules to embedded Jetty (#801) * RDAP nameserver queries always return Not Implemented (#811) * Updated dependencies *Additionally* some operational changes will also be made to the production environment on 1st July: * Remove support for TLS versions 1.0 and 1.1 on HTTPS connections * The IETF has formally deprecated these TLS versions, now only versions 1.2 and 1.3 are recommended. * Remove insecure TLS cipher algorithms * TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA * TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA * TLS_DHE_RSA_WITH_SEED_CBC_SHA * TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA * TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA * Remove HTTP redirects for whois.ripe.net and www.db.ripe.net * HTTP requests to these hosts will no longer redirect to https://apps.db.ripe.net but will return 400 Bad Request. * Remove HTTP redirects for the legacy Whois REST API * The legacy Whois REST API was retired in 2015, a temporary redirect to https://rest.db.ripe.net will be removed. * HTTP requests to the legacy API at http://apps.db.ripe.net/whois/lookup/ripe will return 400 Bad Request. Please check your Whois client in case you are affected by these changes. The release notes are on the website: https://www.ripe.net/manage-ips-and-asns/db/release-notes/ripe-database-rel… More information on the Release Candidate environment can be found on our website: https://www.ripe.net/manage-ips-and-asns/db/release-notes/rc-release-candid… Please let us know if you find any issues with this release in the RC environment. Regards Ed Shryane RIPE NCC

1 1

Removie ALL bogus route objects from BOTH data bases
by Ronald F. Guilmette 21 Jun '21

21 Jun '21

I guess I'll try this again, since I don't recall seeing either any ascent nor any pushback the last time I tried to raise this point here. Al long as those bogus route objects that refer to bogon IP address space are being removed from the data, why not also remove all of the equally bogus route objects that refer to bogon AS numbers? I hope that I'm not actually the only one who sees the wisdom in cleaning up the whole mess that currently exists in the RIPE data bases. There are, at present, on the order of about 80 or so bogus route objects in the "regular" data base that refer to bogon AS numbers, and there are, give or take, about 1,500 of such bogus route objects currently within the (separate) RIPE-NONAUTH data base. Is anyone passionately in favor of keeping all of this useless and potentially fraudlent or misleading garbage in the data base? If not, then why not clear it all out? I mean seriously, the RIRs data bases are *supposed* to be the definitive guides to who has what and who may use what. And yet RIPE is, in effect, tacitly -appproving- of the use of bogon AS numbers. So I need to ask: Why? Regards, rfg

1 0

Removal of bogon route objects
by Ronald F. Guilmette 15 Jun '21

15 Jun '21

Friends, As previously discussed, the decision was made awhile back to remove from the data base all RIPE-NONAUTH route objects which refer to currently unallocated IP space: https://www.ripe.net/ripe/mail/archives/db-wg/2021-May/006952.html In recent days I stumbled upon one such object that was still present in the data base. Upon seeing that object, I necessarily assumed that it was most likely not a "one off", and that it probably had siblings. In the spirit of trying to help out, and after a fair bit of fooling around on my part, I managed to concoct a rather simple method for finding all such bogon route objects that remain in the data base, and I wrote a small Perl script to do that exact thing. A copy of the script may be obtained here, for anyone who may be interested: https://pastebin.com/raw/LsvZ05tX Notes: *) The script assumes the presence of two external programs and their presence on the user's current $PATH, i.e. the widely used wget progarm, and also John Levine's version of a thing called grepcidr, sources for which may be obtained here: https://github.com/jrlevine/grepcidr3 *) The initial line of the script may have to be adjusted depending on the location, in the filesystem, of your local Perl interpreter. *) The script computes its results based upon the following two input data files, both of which are automagically fetched by the script using wget: https://www.nro.net/wp-content/uploads/delegated-stats/nro-extended-stats ftp://ftp.ripe.net/ripe/dbase/ripe-nonauth.db.gz (It is my understanding that each of these is updated on a daily basis.) *) The script DOES NOT verify that the entirety of any given RIPE-NONAUTH route object in fact refers to bogon space. Rather the script only checks to see whether or not the first IPv4 address of each current RIPE-NONAUTH route object does or does not refer to current bogon space. If it does, then the entire IPv4 CIDR of the route object is printed to stdout. *) Assuming that the script is installed as "ripebogonroutes" and in one's path, it may be invoked simply as: ripebogonroutes > bogon-route-cidrs *) At present there are 55,964 RIPE-NONAUTH objects in the data base. Of these, the first address of 857 of them refers to current bogon space. It is my fervent hope that the corresponding RIPE-NONAUTH route objects will be removed from the data base as soon as reasonably practical. Regards, rfg

6 18

RIPE-NONAUTH route object anomalies
by Ronald F. Guilmette 14 Jun '21

14 Jun '21

It appears that, by and large, the route objects currently present within the ripe-nonauth.db.gz file refer either to bogons (which I've already provided a list of) or else they refer to out-of-region IP address blocks. The latter group seems at least explainable. The former group I am hoping will disappear from the data base soon. Checking now however I find there are a very small number of anomalous route objects within the latest edition of the ripe-nonauth.db.gz file, i.e. ones that refer to in-region IP blocks: 192.124.252.0/22 192.70.0.0/17 192.76.32.0/21 192.108.160.0/20 I'm not sure how these should be made to go away, but I wish they would. They offend my personal sense of fastidiousness, and I don't like unexplainable mysteries. Note that the RIPE-NONAUTH route object 192.76.32.0/21 appears to have some counterpart route objects for sub-blocks of that /21 and these sub-blocks route objects are *not* marked as RIPE-NONAUTH, suggesting that there is no compelling reason for the 192.76.32.0/21 route object to be marked as RIPE-NONAUTH. The same sort of syndrome appears to apply also in the case of the 192.124.252.0/22 RIPE-NONAUTH route object, i.e. in this case also there appear to be valid non-RIPE-NONAUTH route objects in the data base for sub-blocks of 192.124.252.0/22, which begs the question: Why is the 192.124.252.0/22 markes as RIPE-NONAUTH? Regards, rfg

3 5

Issue creating new AS-SET
by Denis Fondras 09 Jun '21

09 Jun '21

Hi all, I am trying to add a new AS-SET but I get an error : as-set: Syntax error in AS201376:AS-MEMBERS:DIRECT Here is the object I try to create : AS-SET: AS201376:AS-MEMBERS:DIRECT members: AS60983 TECH-C: DF5400-RIPE ADMIN-C: DF5400-RIPE MNT-BY: AUVERNIX-MNT MNT-BY: DF39378-MNT SOURCE: RIPE AS201376:AS-MEMBERS already exists in the database. I cannot see what I do wrong here. Can anybody help ? Also I tried to do some tests on the test DB but I get a 404 error when clicking 'submit'. I don't know if it is me or a bug. Thank you in advance. -- Denis Fondras / Liopen

4 6

NWI-4 - role of status: field in multivalued status context - reprise
by Carsten Schiefner 08 Jun '21

08 Jun '21

Dear all - after a quick chat with Dennis on this, he encouraged me to toss this into the seemingly stalled, but not yet dead debate: Right now, only the "inet[6]num:" attribute is the primary key to, of or for inet[6]num objects. I wonder if it would be possible to make the tuple ("inet[6]num:","status:") the primary key instead: that should solve the challenge to have an assignment that shall have the size of an allocation. In case this has been exhaustedly discussed here already, please excuse my ignorance - I then obviously have failed to spot the respective contribution in the archives. All the best, -C.

6 7

Re: [db-wg] "status:" attribute values in the RIPE database
by Edward Shryane 07 Jun '21

07 Jun '21

Hi Carsten, > On 7 Jun 2021, at 12:57, Carsten Schiefner <carsten(a)schiefner.de> wrote: > > Ed & all - > > makes sense to me, too. > > However: Instead of forcing this on the creator/updater of an object - > how about the NCC to be as liberal as possible (John Postel's law, the > robustness principle) and to accept any case combination, e.g. "aSSigNED > pi", but very conservatively keep the attribute sored in the DB in > uppercase only? > I agree, apologies I wasn't clear, by force the "status:" attribute value to uppercase, I mean that the value should be automatically changed to all-uppercase, and we should still accept the value in any case. Also, we should perform a cleanup on currently inconsistent values (affecting less than 1% of total inetnum and inet6num objects). Regards Ed > ATB, > > -C. >

2 1

Restricting WHOIS searches to type: netname
by Ronald F. Guilmette 29 May '21

29 May '21

One of the helpful options provided by the RIPE WHOIS server is the --types option which provides a list of what specific object types a given set of query results may be restricted to. That list is as follows: inetnum inet6num as-block aut-num as-set route route6 route-set inet-rtr filter-set peering-set rtr-set domain poetic-form poem mntner irt key-cert organisation role person Can anyone explain to me why "netname" is not on the above list? I would like to be able to query the data base for "ABC" but restrict the query so that I only get back the records for the dozen or so IP blocks whose registrants have (unwisely?) elected to label their networks as "ABC", while NOT also getting back all 16 or so of the organisation objects whose org-name: field contains the substring "ABC", much less the numerous and additional person and role records whose person: and role: fields also and likewise contain the substring "ABC". If I can selectively query just for poems, is there some reason why netnames deserve less respect? And as long as we are on the subject, may I safely infer from the presence, in the data base, of a dozen different networks named "ABC" that no attempt has ever been made to insure uniqueness of netnames within the data base? Are netnames even restricted, as they seem to be, to having a form which is rather strikingly reminicent of actual unique data base handles, i.e. consisting of only alphanumerics and hyphens? Regards, rfg P.S. I do not mean to pick on RIPE specifically here. A quick check reveals that whois.apnic.net and whois.afrinic.net also fail to support selective querying for just netnames... although in those two cases selective quering for poems is also not an option... a sad fact that has left me rather entirely bereft, as I'm sure you can all imagine.

4 4

created: field value
by Ronald F. Guilmette 29 May '21

29 May '21

My apologies to all. I don't intend to be a complainer. I'm just trying to understand fully what's going on in the data base. I must say however that I am getting the impression that the value in the created: field for some (many?) inetnum objects may not be entirely reliable, or even entirely consistant with other available historical data. Example: inetnum: 138.201.0.0 - 138.201.255.255 netname: HETZNER-RZ-BLK-ERX4 descr: Server Block country: DE org: ORG-HOA1-RIPE admin-c: HOAC1-RIPE tech-c: HOAC1-RIPE status: LEGACY mnt-by: HOS-GUN mnt-lower: HOS-GUN mnt-routes: HOS-GUN mnt-domains: HOS-GUN created: 1970-01-01T00:00:00Z last-modified: 2019-12-04T13:10:40Z source: RIPE Given that 1970-01-01T00:00:00Z is rather well known to be the beginning of UNIX time (i.e. time: 0) I could not help but be a bit suspicious of the value in the created: field of the record shown above. A quick look at version #1 of the data base object for the 138.201.0.0/16 block suggests that a rather more appropriate value might have been something more like 2003-12-11T17:11:00Z ======================================================================== % Version 1 of object "138.201.0.0 - 138.201.255.255" % This version was a UPDATE operation on 2003-12-11 17:11 inetnum: 138.201.0.0 - 138.201.255.255 remarks: remarks: This inetnum has been transfered as part of the ERX. remarks: It was present in both the ARIN and RIPE databases, so remarks: the information from both databases has been merged. remarks: If you are the mntner of this object, please update it remarks: to reflect the correct information. remarks: remarks: Please see the information for this process: remarks: http://www.ripe.net/db/erx/erx-ip/network-138.html remarks: remarks: **** INFORMATION FROM ARIN OBJECT **** remarks: netname: NETCS-CUST4 descr: netCS Informationstechnik GmbH descr: Feuerbachstrasse 47/49 descr: D-1000 Berlin 41 remarks: country: DE remarks: changed: hostmaster(a)arin.net 19900523 remarks: changed: hostmaster(a)arin.net 20010220 remarks: **** INFORMATION FROM RIPE OBJECT **** netname: KIEZ-NET1 descr: Kiez-Net WAN country: DE rev-srv: DNS-A.Kiez.Net rev-srv: DNS-B.Kiez.Net status: ASSIGNED PI mnt-by: KIEZ-MNT source: RIPE # Filtered Am I the only one who thinks so? It is certainly my hope that the value in the created: field should accurately reflect the date & time when any given object was in fact created within the RIPE WHOIS data base. Is there any compelling reason why this should ever not be the case? Regards, rfg

4 5

BOGON => 103.86.68.0/22
by Ronald F. Guilmette 28 May '21

28 May '21

My apologies to all. My interests and attention are getting pulled in so many different directions these days that I tend to forget the answers to questions that I seem to vaguely remember having already asked. So, at the risk of repeating myself, what's the current policy on stale route objects in the data base that refer to current bogon address space? I'm specifically interested in 103.86.68.0/22 at the moment. route: 103.86.68.0/22 origin: AS131477 mnt-by: HUAJUAN-MJJ-MNT created: 2018-02-24T19:00:10Z last-modified: 2018-09-04T19:09:05Z source: RIPE-NONAUTH

4 7