- db-wg - mailman.ripe.net

Domain Object Cleanup in the RIPE Database
by Edward Shryane 14 Dec '20

14 Dec '20

Dear colleagues, As mentioned in the Operational update during the DB-WG session at RIPE81, the RIPE NCC will shortly clean up (delete) domain objects without a mandatory "nserver:" attribute. This will affect approximately 1,600 domain objects in the RIPE database, which have not been updated since September 2012. We plan to notify the maintainers of affected objects today, and ask them to add "nserver:" attributes to any objects they wish to keep. We will then delete any remaining domain objects without a mandatory "nserver:" attribute in two weeks from now (on 14th December). Regards Ed Shryane RIPE NCC

1 1

Historical records... what is and isn't available
by Ronald F. Guilmette 08 Dec '20

08 Dec '20

I bumped my head on something unexpected a day or two ago, and I would now just like to ask a question, to find out if what I seemed to see was just a product of my own programming mistake, or if it is fact the way things were intended to be. So, true or false? The --list-versions and --show-version options are not supported for person:, role:, and mntner: records. To be clear I am *not* asking if the data returned when the --show-version option is applied to one of the types of records I've just listed is merely redacted of all personal information relating to natural persons. Rather, I am asking if I should in fact be expecting to get absolutely -nothing- back when/if I try to use --show-version on any of the aforementioned record types, regadless of of whether the requested historical information contains 100% personal information or alternatively, if it contains 0% personal information, or anything in between. Regards, rfg

6 9

Proposal to revert NWI-10
by Cynthia Revström 07 Dec '20

07 Dec '20

Apologies if this email is a bit impolite. >From the start NWI-10 seemed like a pointless policy to me and just a policy that was made because the db-wg wanted to make more policies. But as it has already messed up the data on my resources, I see it as a policy that messes up data and wastes time for no real advantage. Hence I suggest that we revert NWI-10 unless someone actually has a good reason for why the legal address needs to match the delegated file, and how to implement it in a non-messy way. - Cynthia

4 10

ORG-TKDS1-RIPE - VECTRA S.A. - Spam filters & abuse reporting addresses
by Ronald F. Guilmette 04 Dec '20

04 Dec '20

Based on my experience, if one is reporting spam to most typical networks, the network operators generally like to actually -see- the spam being reported. Thus, I always include a copy. It is Good that RIPE resource holders now all have abuse reporting addresses in their WHOIS records. It is also Good that RIPE NCC is now checking these abuse reporting contact email addresses to insure that they actually function, at least minimally. What is un-good, in my opinion, is for any network to have an abuse reporting address set up with *content based* anti-spam filters. To illustrate this point, I have recently received a spam from an IP address that is currently being routed by AS29314 - Vectra S.A., located in Poland. I duly forwarded a full copy of that spam to the abuse reporting address provided in the RIPE WHOIS for AS29314, i.e. abuse(a)vectra.pl. That message was rejected with the following SMTP reject message: <abuse(a)vectra.pl>: host smtp.vectra.pl[88.156.64.22] said: 554 Spam. Email Session ID: 86748699 (in reply to end of DATA command) Given that outcome, I now feel compelled to locally blacklist all IP space associated with ORG-TKDS1-RIPE (VECTRA S.A.) until such time as some kind soul provides the operators of this network with some education on the topic of how to operate an abuse reporting address. The space in question is as follows: 31.11.128.0/17 31.22.96.0/21 31.135.168.0/21 37.8.192.0/18 37.77.152.0/21 46.36.224.0/19 62.122.112.0/21 77.222.224.0/19 78.31.152.0/21 78.31.209.0/24 78.88.0.0/16 82.139.0.0/18 83.143.40.0/21 83.143.136.0/21 83.243.104.0/21 88.156.0.0/16 89.151.0.0/18 91.192.76.0/22 91.230.159.0/24 91.230.162.0/23 91.230.164.0/22 91.231.116.0/23 91.238.232.0/22 93.105.0.0/16 94.231.48.0/20 95.160.0.0/16 109.107.0.0/19 109.197.56.0/21 109.197.64.0/21 109.241.0.0/16 178.235.0.0/16 185.51.180.0/22 192.166.120.0/23 193.108.228.0/23 193.201.18.0/23 194.54.188.0/22 195.26.72.0/22 195.28.170.0/23 195.95.170.0/24 195.191.162.0/23 195.225.92.0/22 195.242.252.0/22

1 0

Fwd: Multi tenancy in a LIR?
by denis walker 20 Nov '20

20 Nov '20

Hi Hank Your scenario is not clear. When you say "each has their own resources", how did they get those resources? Were they separate LIRs that have received allocations, have there been mergers, were they all allocated to the parent organisation's LIR and distributed to sub organisations? Or do you mean they each want to have their own resources? As far as the database is concerned, address space resources allocated to the parent organisation's LIR can be distributed to sub organisations as LIR-PARTITIONED or ALLOCATED-BY-LIR. The sub organisations can separately manage their resources. If you want exclusive management control by the sub organisations you can set the MNTNER attributes accordingly. But ultimately they are still the parent organisations resources. They could be reclaimed by the parent organisation. The organisation reference in the allocations will always be the parent organisation that was allocated the resources by the RIPE NCC. That cannot be changed. cheers denis co-chair DB-WG On Thu, 19 Nov 2020 at 16:28, Hank Nussbacher via db-wg <db-wg(a)ripe.net> wrote: > > Can a LIR account handle multi-tenancy? > > > What if you had a parent organization and a few sub-organizations and each has their own resources (ASN + inetnum) that they wish to manage independently (objects, RPKI, etc) without the other sub-organizations of parent organization able to affect the resources. > > Is that at all possible or is the only solution to create a new LIR account? > > > Thanks, > Hank > Caveat: The views expressed above are solely my own and do not express the views or opinions of my employer

3 5

Multi tenancy in a LIR?
by Hank Nussbacher 19 Nov '20

19 Nov '20

2 1

Problem definition for new NWI (12?) - NRTM service
by Stavros Konstantaras 19 Nov '20

19 Nov '20

Dear db-wg community, Please find below the problem definition for the (upcoming) NWI-12 item as we have discussed it and envisioned it for this project. Problem definition: Back on October 2019 during the RIPE 79 meeting in Rotterdam, we discussed about the need to move forward with a next generation of NRTM service. Upon the completion of NWI-9 and the lifting of the legal restrictions, we can now proceed to design the new solution. As we discussed preciously, the version 3 of the current NRTM solution is not suitable anymore for network operations on 2020. A summary of the reasons are: -Is a Telnet based protocol, thus: • No keep alive mechanism is adopted, • It provides plain text/unencrypted transport of data -The bootstrap process is not always trivial and sometimes is slow -Long time synchronisation is complicated and users need to re-synchronise after a couple of weeks. -No well specified protocol (There is just a PDF doc that describes it) For all the reasons above (and reasons that we might have not think about yet but you are welcome to share), it becomes a necessity for the community to proceed with a new implementation that will be easily adopted by modern tools and last for the years to come. I hope the above text is sufficient for the db-wg chairs to kick off the process and the community to share its feedback. Best regards, Stavros Konstantaras | Sr. Network Engineer | AMS-IX M +31 (0) 620 89 51 04 | T +31 20 305 8999 ams-ix.net

4 3

Re: [db-wg] [address-policy-wg] NWI-4 - role of status: field in multivalued status context -- Last call
by ripedenis＠yahoo.co.uk 17 Nov '20

17 Nov '20

Hi Lee With the current data model it is not possible to have two independent objects with the same primary key. Creating 2 smaller objects is a work around. Having 2 status attributes is another work around. The question is, which work around is preferable? cheersdenis co-chair DB-WG On Tuesday, 17 November 2020, 14:25:35 CET, Howard, Lee <leehoward(a)hilcostreambank.com> wrote: That sounds like it would be confusing to me. I’d want to see both the allocation to the LIR and the assignment to the end user independently. Lee From: address-policy-wg <address-policy-wg-bounces(a)ripe.net>On Behalf Of ripedenis--- via address-policy-wg Sent: Monday, November 16, 2020 7:57 AM To: address-policy-wg(a)ripe.net Subject: [address-policy-wg] NWI-4 - role of status: field in multivalued status context -- Last call Colleagues We have not had enough comment on this to make a decision if any change is needed. So can we have a last round of comment to decide if this is a sufficiently important issue to make a change or if we just close this action item? In brief: when assigning a whole allocation should we be able to give the INET(6)NUM object 2 status values to reflect it being both an allocation and an assignment, rather than splitting it into two smaller assignment objects? cheers denis co-chair DB-WG On Monday, 5 October 2020, 16:48:34 CEST, ripedenis--- via address-policy-wg <address-policy-wg(a)ripe.net> wrote: Colleagues I was about to post this to the DB-WG but it may be more appropriate to include it as part of this discussion... Yet another 4 year old NWI that needs to be progressed or closed. The details are here: https://www.ripe.net/ripe/mail/archives/db-wg/2016-May/005242.html In summary it concerns the assignment of a whole allocation. Because the range is the primary key (pkey) in the database you cannot have an allocation object and an assignment object with the same pkey. A common work around is to split the allocation and make two assignments. The suggestion is to allow "status:" to be a multiple attribute. This could be done quite easily and constrained in it's use by business rules in the database software. So the syntax could be changed in INET(6)NUM objects to: status: [mandatory] [multiple] [ ] The business rules could make this multiple option only allowed in very limited situations. For example if an INETNUM object has 'status: ALLOCATED PA' it could be possible to add a second value 'status: ASSIGNED PA' or 'status: SUB-ALLLOCATED PA'. If the status in an INET6NUM object is 'status: ALLOCATED-BY-RIR' it could be possible to add a second value 'status: ALLOCATED-BY-LIR' or 'status: ASSIGNED'. The business rules could prevent any other multiple status values. The "descr:" attribute is already multiple so it can describe both the allocation and the assignment. Is this still considered to be an issue? cheers denis co-chair DB-WG On Monday, 5 October 2020, 16:13:53 CEST, Erik Bais <ebais(a)a2b-internet.com> wrote: Dear WG, I want to bring the following email and questions of our PDO - Petrit Hasani to your attention that might have slipped over the vacation period. Please have a look at this discussion again and provide input if you can. Regards, Erik Bais Co-chair AP-WG. ( on behalf of the AP-WG Chair collective ) On 02/07/2020, 13:36, "address-policy-wg on behalf of Petrit Hasani" <address-policy-wg-bounces(a)ripe.net on behalf of phasani(a)ripe.net> wrote: Dear colleagues, Thank you to everyone who responded to our earlier questions on the intent of the policy regarding IPv4 status hierarchies. While this was helpful, it would be great if we could have input from a wider group of people: - Should inetnums with these statuses be allowed to be created inside one another? - Should there be a limit on the minimum size of a sub-allocation? - Do we need a policy update? https://www.ripe.net/ripe/mail/archives/address-policy-wg/2020-June/013195.… We look forward to hearing from you. Cheers, -- Petrit Hasani Policy Officer RIPE NCC > On 16 Jun 2020, at 15:36, Petrit Hasani <phasani(a)ripe.net> wrote: > > Dear colleagues, > > We are reviewing IPv4 status hierarchies in the RIPE Database (looking at objects with the same status as their less-specifics). > > Some cases are clear - "ASSIGNED PA" shouldn't be allowed under "ASSIGNED PA", for example. Other statuses might need a closer look and we would like guidance from this working group. > > The RIPE Database does not currently have any limitations on creating inetnums that have the status "SUB-ALLOCATED PA" or "LIR-PARTITIONED PA" under inetnums with the same status. This often results in chains of inetnums that have the same status, sometimes ending with the sub-allocation of a single IP address. > > Although this might not seem useful at first glance, there might be practical uses for a few levels of sub-allocation. For example, a global company could give sub-allocations to its national branches, which make smaller sub-allocations to their multiple daughter companies. These daughter companies could then create and maintain assignments for their actual networks. > > However, this is not allowed under a strict reading of the policy, as only the LIR itself can make sub-allocations, and these must be used for assignments. > > Section 5.3 "Sub-allocations" of the IPv4 Address Allocation and Assignment Policies (ripe-733) states: > > "Sub-allocations are intended to aid the goal of routing aggregation and can only be made from allocations with a status of "ALLOCATED PA". > > [...] > > LIRs may make sub-allocations to multiple downstream network operators." > > https://www.ripe.net/publications/docs/ripe-733#54 > > Before making any changes, we want to be sure that we understand the intent of the policy and what the community wants us to do. Thus, we would like to hear from the Address Policy Working Group: > > - Should inetnums with these statuses be allowed to be created inside one another? > - Should there be a limit on the minimum size of a sub-allocation? > - Do we need a policy update? > > We look forward to your guidance. > > Kind regards, > -- > Petrit Hasani > Policy Officer > RIPE NCC > > > > >

1 0

How does reverse delegation work for legacy resources across RIR?
by Yang Yu 12 Nov '20

12 Nov '20

According to https://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xhtml 147/8 Administered by ARIN 1993-05 whois.arin.net https://rdap.arin.net/registry http://rdap.arin.net/registry LEGACY > $ dig 147.in-addr.arpa. ns ; <<>> DiG 9.16.1-Ubuntu <<>> 147.in-addr.arpa. ns ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20223 ;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 65494 ;; QUESTION SECTION: ;147.in-addr.arpa. IN NS ;; ANSWER SECTION: 147.in-addr.arpa. 86400 IN NS r.arin.net. 147.in-addr.arpa. 86400 IN NS u.arin.net. 147.in-addr.arpa. 86400 IN NS x.arin.net. 147.in-addr.arpa. 86400 IN NS y.arin.net. 147.in-addr.arpa. 86400 IN NS z.arin.net. 147.in-addr.arpa. 86400 IN NS arin.authdns.ripe.net. ;; Query time: 75 msec ;; SERVER: 127.0.0.53#53(127.0.0.53) ;; WHEN: Thu Oct 29 15:02:58 PDT 2020 ;; MSG SIZE rcvd: 165 >another example $ dig 196.in-addr.arpa. ns +short ns1.afrinic.net. ns2.afrinic.net. ns3.lacnic.net. ns3.afrinic.net. ns4.apnic.net. tinnie.arin.net. afrinic.authdns.ripe.net. For legacy /8 that exists today in multiple RIRs, what is the process to make sure rDNS gets delegated correctly and avoid split views? Is there some mechanism to sync the zone across RIRs? How long does it typically take for this type of reverse delegation update to get reflected in DNS zone? When I created a domain object for 208.75.147.in-addr.arpa., it didn't show up in DNS until the next day. Yang

2 2

Re: [db-wg] Interest to continue NWI-9
by Job Snijders 09 Nov '20

09 Nov '20

Hi Cynthia, The NRTM v4 initiative is in an awkward early stage where various parties (with *no* obligations towards each other!) are attempting to set the stage for the future existence of an inter-operable successor to the NRTM v3 protocol. As indicated before, the nature of this call was informal, akin to a hallway meeting at a conference. Decisions about the RIPE NCC database are made on the db-wg(a)ipe.net mailing list. It was a courtesy to this group to indicate some volunteers would have a call to help progress things. You too were free to join. Hallway meetings are not recorded. I'm interested to hear your opinions on-list or off-list! :-) Kind regards, Job On Sat, Nov 07, 2020 at 10:36:43AM +0100, Cynthia Revström wrote: > I would like to see more here on the mailing list, so I would request that > any future calls be recorded and published. > > I have opinions on this subject and I don't think me missing the call > should leave me out of the loop. > > - Cynthia > > On Fri, Nov 6, 2020, 11:31 Stavros Konstantaras < > stavros.konstantaras(a)ams-ix.net> wrote: > > > Hi Cynthia, > > > > Yes the call happened and the problem description is almost ready. Soon > > will be published here in the mailing list so the DB-WG chairs can > > officially create a new NWI and submit it to RIPE NCC developers > > > > Thank you for your support and your interest on that :) > > > > > > Best regards, > > > > Stavros Konstantaras | Sr. Network Engineer | AMS-IX > > M +31 (0) 620 89 51 04 | T +31 20 305 8999 > > ams-ix.net > > > > On 6 Nov 2020, at 02:51, Cynthia Revström via db-wg <db-wg(a)ripe.net> > > wrote: > > > > I also support creating a new NWI for a modernized NRTM like service. > > > > - Cynthia > > > > On Fri, 6 Nov 2020, 02:50 Cynthia Revström, <me(a)cynthia.re> wrote: > > > >> Hi Job, > >> > >> Was there a call about this yet? > >> > >> And if so, was there any outcome? > >> > >> - Cynthia > >> > >> On Thu, 29 Oct 2020, 20:38 Job Snijders via db-wg, <db-wg(a)ripe.net> > >> wrote: > >> > >>> On Thu, Oct 29, 2020 at 06:30:28PM +0100, denis walker wrote: > >>> > I would suggest we create NWI-12 to move forward with a new version of > >>> > NRTM. Perhaps you could write the first draft of the problem > >>> > statement? > >>> > >>> Given that more people than just myself were engaged with this subject > >>> so far... maybe Stavros, Emil, a DB-WG chair, myself and any other > >>> interested parties can have a 1 hour group phone call to formulate an > >>> updated problem statement for NWI-12? > >>> > >>> Perhaps next week, November 4th, 15:00 UTC? Consider it a "hallway > >>> chat", not something formal. The chairs can report back to the mailing > >>> list. > >>> > >>> Kind regards, > >>> > >>> Job > >>> > >>> > >

4 4