- db-wg - mailman.ripe.net

source: field for non RIPE address space
by Nick Hilliard 25 Nov '14

25 Nov '14

Hello, There's been a bit of media panic recently about registration of non RIPE address space in the RIPE IRRDB, e.g. > http://krebsonsecurity.com/2014/11/network-hijackers-exploit-technical-loop… The premise is that if you can register a prefix in a routing registry, this will give you the ability to inject a prefix into the DFZ. We'll ignore the fact that what you actually need to inject a prefix into the DFZ is a complicit transit provider and that most transit providers don't use the IRRDBs for bgp leaf filtering anyway, and even if they did, there are plenty of other IRRDBs where this information can be registered. But that aside, some organisations use IRRDB information extensively, particularly IXPs running route servers. Many of these organisations filter on source: because of the amount of trash in alternative IRRDBs. So, could the RIPE NCC database people consider using a different source: value for non RIPE address space, so that it would be possible for irrdb users to easily filter out authoritative data from non authoritative data? E.g. 185.6.36.0/22 might continue to have "source: RIPE", but a prefix like "210.57.192.0/20" might have "source: RIPE-NONAUTH". Would this be feasible for the RIPE DB software? Interesting to note that Mega-Spred has started providing transit for Telstra Hong Kong, Sify in Chennai, iWay Africa in Cape Town and others: > % peval AS201640 > ({210.57.192.0/20, 210.57.0.0/19, 202.39.112.0/20, 119.227.224.0/19, 105.154.248.0/21, 41.198.224.0/20}) Nick

8 14

restrict usage of RIPE-NCC-RPSL-MNT
by Job Snijders 20 Nov '14

20 Nov '14

Dear working group, The RIPE databse provides a mntner object which can be used to create route objects for IP ranges which are not allocated or assigned through the RIPE NCC. http://www.ripe.net/data-tools/db/faq/faq-db/how-to-create-a-route-object-w… I did some digging to understand how the RIPE-NCC-RPSL-MNT mntner object is used in practise. You can fetch the dataset through this command: $ whois -h whois.ripe.net -- '-K -i mnt-by RIPE-NCC-RPSL-MNT' Usage exceeded my expectations: (object type: occurances) route: 12195 route6: 77 And much to my suprise I found that there are all kinds of objects which reference RIPE-NCC-RPSL-MNT with an "mnt-by:" attribute: aut-num: 341 mntner: 51 as-set: 37 person: 40 route-set: 33 organisation: 5 rtr-set: 1 inet-rtr: 1 key-cert: 1 Would it be an idea to prevent objects from being updated/created when they carry a "mnt-by: RIPE-NCC-RPSL-MNT" attribute? Secondly, should RIPE NCC proactively remove all "mnt-by: RIPE-NCC-RPSL-MNT" references from the database? Kind regards, Job

3 7

-V database query semantics
by Nick Hilliard 17 Nov '14

17 Nov '14

Could someone from RIPE clarify the semantics for the -V query? In the database query reference manual, section 2.6 it says: > -V --client <client-tag> Sends information about the client to the server. But in section 2.11, it says: > The database server provides a facility for such proxy clients that > allows accounting to be based on the IP address of the clients using the > proxy to query the RIPE Database and not on the IP address of the proxy > server. This is done using the “-V” flag as follows: > > -V <version>,<ipv4-address> > > where > > <version> is a client tag that usually represents the software version > that the proxy uses > <ipv4-address> is the IPv4 address of the client that queries the > database using the proxy According to the source code, the argument for the -V parameter is passed into the QueryFlag.CLIENT variable and then parsed using getProxyIp(). If the format looks like "version,ipv4addr" then the argument is passed to the proxy accounting mechanism for rate limiting. But if the argument is not formatted like this, it looks like the "-V" parameter is ignored. Is this understanding correct, and should all whois clients use the "-V" query to pass their client ID to the whois server by default? As an aside, the isProxyValid() function uses InetAddresses.isInetAddress(), which suggests that the code should also understand "-V <version>,<ipv6-address>". If this is correct+tested, the documentation should be updated. Nick

2 1

RIPE Database Release 1.76 Deployed to Release Candidate Environment
by Tim Bruijnzeels 12 Nov '14

12 Nov '14

Dear colleagues, The RIPE NCC is pleased to announce the deployment of RIPE Database software release 1.76 to the Release Candidate (RC) environment. Detailed information about features, changes and how this release might affect your operations, are available in the release notes: https://www.ripe.net/data-tools/db/release-notes/ripe-database-release-1.76 This release includes many small bug fixes and feature improvements. Notably, we have addressed the following issues: - Issue #221: It is now possible to change the name of a PERSON or ROLE object - Issue #256: Abuse contact information is now shown when using web lookups - Issue #220: Failed update notifications now include a diff of the attempted change A number of users requested the notification of a failed update to include a diff showing what was attempted to be changed. A consequence of this change is that, if you mistype the password pseudo-attribute (eg "pasword: clear_password"), the notification will include your clear text password. This is a good time for all maintainers of data in the RIPE Database to review to whom these notifications are sent. The "upd-to:" attribute in a MNTNER object should only include the email address of a person or team in your organisation who deals with security issues. If this team receives such a notification, they should advise the user to change their password. We invite all users of the RIPE Database to review the new release in the RC environment: https://www.ripe.net/data-tools/db/release-notes/rc-release-candidate-envir… We look forward to any questions or comments you might have. Kind regards, Tim Bruijnzeels Assistant Manager Software Engineering RIPE NCC

3 3

Launching the RIPE NCC Academy
by Rumy Kanis 11 Nov '14

11 Nov '14

Dear colleagues, The RIPE NCC is pleased to announce the launch of the RIPE NCC Academy, a virtual learning environment that allows you to take courses and obtain certificates online: https://academy.ripe.net/ The first course available is the RIPE Database Expert Course. You can sign in to the RIPE NCC Academy with your RIPE NCC Access account (if you don’t already have one, you can easily create one through the link provided). The RIPE NCC Academy is available to everyone, free of charge. Before starting a course, you should know that: - You have 90 days to complete the course from the moment you start it. - We are working to automate the evaluation of all of the activities. In the meantime, some of them need to be checked manually, so you may have to wait for a trainer to review them. - If you’re very confident that you already know all you need to know about the RIPE Database, you can choose to complete the activities without studying the content. - You will earn a certificate when you achieve a score of 70% or better, including all the activities and the final test. - Your certificate will remain valid for three years. The first 100 users to earn a certificate will get a limited edition RIPE NCC Academy Graduate t-shirt. Don’t wait too long - graduate to the next level today! In the coming months, we’ll be making more courses available via the RIPE NCC Academy, so stay tuned. If you have any questions, please feel free to contact us at academy(a)ripe.net. Watch the RIPE NCC Academy teaser at https://www.youtube.com/watch?v=P7K89w8VXCI Happy learning, Rumy Spratley-Kanis, Training Services Manager and Sandra Bras, E-Learning Coordinator — Rumy Spratley-Kanis Training Services Manager RIPE NCC Follow us on Twitter for the fastest and latest RIPE NCC Training news! @TrainingRIPENCC

1 0

[training] RIPE NCC Training Courses January-March 2015
by Training Services 10 Nov '14

10 Nov '14

Dear colleagues, Our training team travels the RIPE NCC service region to deliver training courses to our members without any additional cost. Over the next few months, we'll be in Milan, Madrid, Munich, Podgorica, Prague, Moscow, Riga, Ramallah, Edinburgh, Copenhagen, Amsterdam. Visit the following page to register and to check which training courses we are giving in your area: https://lirportal.ripe.net/training/courses The RIPE NCC delivers the following training courses: - LIR Training Course - RIPE Database Training Course - Basic IPv6 Training Course - Advanced IPv6 Training Course - Routing Security Training Course - DNSSEC Training Course The RIPE NCC delivers the following tailor-made workshops: - Measurements Tools Workshop - Introduction to BGP For more information visit: http://www.ripe.net/lir-services/training/courses With kind regards, Rumy Spratley-Kanis Training Services Manager

1 0

RIPE69 DB-WG Draft Agenda V2
by Nigel Titley 06 Nov '14

06 Nov '14

Attached please find the V2 of the draft agenda for today's DB-WG meeting. Nigel pp Wilfried

1 0

RIPE69 DB-WG Draft Agenda V1
by Wilfried Woeber 05 Nov '14

05 Nov '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear DB-WG folks, Chairpersons, "Meeting"! This is the 1st -rough- draft of an agenda for the DB-WG Meeting at RIPE69 in London. For time slot allocations please refer to the most up-to-date meeting plan at https://ripe69.ripe.net/programme/meeting-plan/ The DB-WG Meeting is scheduled for *Thursday*, November 6th, starting at 16:00 local time[1], after the coffee break. The length of our timeslot is 90 Minutes. The overall (draft) RIPE 69 meeting outline is already available at https://ripe69.ripe.net/programme/meeting-plan/ Please feel free to propose additional topics to be discussed! I'd also suggest that you submit your points of view regarding the topics on the proposed agenda on the mailing list, preferably before the WG meeting's start :-) Best regards, hope to see you soon in London, Wilfried. PS: thanks to Job and Piotr for suggesting items! [1] for remote participation, this 15:00 UTC ________________________________________________________________________ A. Administrative Matters . Welcome . select scribe (thanks to Nigel for volunteering again!) . finalise agenda . approval of minutes from previous WG meeting(s) . review of action list B. Data Base Operational Update (N.N., RIPE NCC, t.b.c.) C. New DB-Software functionality (proposed, test, deployment) . referral-by deprecation - (based on deprecation guidelines) - present time table for 'referral-by' . from "changed:" to "last-modified:" / "created:" - explain new attr., examples, - timeline for implementation D: Personalised authentication? E: Maintainer Password resets? X. Working Group Management [~10 min] . chair replacement procedure . WW144 to resign . new DB-WG Chairs to take over Y. Input from other Working Groups and/or Task Forces Z. AOB __________________________________________ 2014-10-21 19:15 UTC -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (MingW32) iQCVAwUBVEazMt/RXX7wrLNpAQK3xQQAutAXz+LcI53fGT4dmNbfSyDGuc10RQLG S3liIaKCwRgLg0sKSkInShdHjE8zIINdN4WGwZ1EECTfEahzYilmau9jgfxWy3E9 vx3QRtQ9iXDd43CvyUDjOW09j1g2CfTlXCx8oEJaM9oULihGte3ECRzn9Acvptl0 3UuUmikSt3s= =5Rjx -----END PGP SIGNATURE-----

4 3

Draft minutes of RIPE 67 meeting
by Nigel Titley 05 Nov '14

05 Nov '14

Please find draft minutes of the DB-WG meeting held in Athens today. Comments, complaint, misrepresentations etc, to me Nigel

1 1

Revised RIPE Database Documentation on ripe.net
by Denis Walker 03 Nov '14

03 Nov '14

Dear colleagues, The RIPE NCC has expanded the revised RIPE Database documentation to include the information from the RIPE Database Query Reference Manual. The RIPE Database Query Reference Manual itself will be removed over the coming weeks. This revised documentation is available for version 1.76 of the RIPE Database software: https://www.ripe.net/data-tools/support/documentation/ripe-database-documen… We look forward to your feedback. Regards, Denis Walker RIPE NCC

1 0