- opensource-wg - mailman.ripe.net

new project: DHCP Protect
by Pascal Gloor 29 Oct '19

29 Oct '19

Hi Community, NOTE: I hope this post is appropriate in this mailinglist, please let me know if it isn’t. I don’t know about you, but as an ISP we’ve always faced the problem of crazy DHCP clients (v4 and v6) flooding our servers. While at my employer we have a proprietary DHCP server with anti-flood mechanisms it might not the case for everyone. This is why I wrote DHCP Protect. DHCP Protect works with the userspace API of Netfilter (iptables/ip6tables) and will treat each DHCP(v4/v6) packet and decide if it should be forwarded or not. Don’t worry, iptables can be configured in a way that if the program is not working, it will ACCEPT the packets by default. There are no packages available, but don’t be scared, it’s really simple to install and it will do all the systemd stuff for you! After make install it will already be running (you can also make uninstall which will delete everything and remove it from systemd). git clone https://git.home.spale.com/dhcp_protect.git cd dhcp_protect sudo apt-get install build-essential uthash-dev libnetfilter-queue-dev make all sudo make install That’s it. And then you need the iptables/ip6tables rule: iptables -A INPUT -p udp -m udp --dport 67 -j NFQUEUE --queue-num 67 --queue-bypass ip6tables -A INPUT -p udp -m udp --dport 547 -j NFQUEUE --queue-num 67 --queue-bypass (SAME queue number! the program can treat v4/v6 at the same time) It doesn’t need to be on the DHCP server itself, it can also be run on the path, in that case replace INPUT by FORWARD. The program will log to syslog when it blacklists. I’ve tested this with 10kpps and the CPU load of the program was about 4-6% on one core (AMD Ryzen 7 2700X). There’s also a flooding perl client in the repository to test the performance. It can do pseudo DHCPv4/DHCPv6, but since it’s pseudo, don’t use the perftest.pl against a real DHCP server. More information in the README -> https://git.home.spale.com/public/dhcp_protect I’d be glad on feedback! It is useful? what additional features would you like to see? Thanks for reading Pascal

2 2

Light(e)ning talks
by Ondrej Filip 14 Oct '19

14 Oct '19

Dear WG members, as usually we have some time for lightning talks at the end of our meeting. If you want to deliver a short (about 5 min) presentation, please contact us before Tuesday 14:00 local time. Your OS WG chairs Martin & Ondrej opensource-wg-chairs(a)ripe.net

1 0

Agenda Open Source WG for the upcoming RIPE 79 in Amsterdam
by Martin Winter 27 Sep '19

27 Sep '19

A. Administrative Matters (Working Group Chairs) Welcome finalize agenda approval of minutes from previous WG meeting(s) review of action list B. Collaborative Open Source: MANRS Validator (Leslie Daigle, ThinkingCat Enterprises) This presentation will show early results from an ongoing collaborative open source software project to build a validator tool for the MANRS (Mutually Agreed Norms for Routing Security) project. The project demonstrates the feasibility of applying concrete, objective tests to MANRS, as well as the need for cross-organizational collaboration to develop such tools. This presentation will outline key steps so far in this pilot project for collaborative open source. C. Recent development of the RPKI Validator project (Mikhail Puzanov, RIPE) RIPE NCC has been developing its own RPKI validator since 2010. The latest version 3 was started in 2017 as an attempt to address the issues found over years of usage in the RPKI validator version 2. While certain issues have been resolved, many new ones were introduced causing multiple bugs and reputation damage. The presentation mostly goes about the choice of Java-technologies and the efforts taken to change it. It also covers the progress in the latest developments and some changes between versions 3.0 and 3.1. D. NGI0: The Next Generation Internet initiative (Michiel Leenaars, Director of Strategy at NLnet Foundation) The Next Generation Internet initiative is a significant new effort aimed at strengthening the internet community. NGI was bootstrapped in 2016 at the initiative of the European Commission. The ambition of NGI is “to re-imagine and re-engineer the internet” in a human-centric way. An innovative grantmaking scheme and delivery mechanism focused on open source, open standards and open hardware to make the internet more trustworthy, resilient and and sustainable, both societally, economically and environmentally. NGI Zero invites you to consider to joining over 100 others in ‘working for the internet’ E. Automating networks using Salt, without running Proxy Minions (Mircea Ulinic, DigitalOcean) Salt is an agent-based open source software used to automate the management and configuration of infrastructure and application at scale. It typically requires a Salt Minion service to be running on the node managed with Salt. While this is not a blocker on any server generally speaking, in the networking world, it is not possible to install custom software on the network gear you want to manage. This is why a few years ago SaltStack, the company maintaining Salt, introduced the Proxy Minion, which is a derivative of the regular Minion, just that it doesn’t need to be installed on the targeted device, as it can run anywhere. Similar to the regular Minion, you need to manage as many Proxy Minion services as network devices you have. This comes with a considerable cost - as in managing the infrastructure, operational, training of the users, and so on - not always justified. For example, there are many cases in the networking world where we need to interact with the device only once or twice a year, however those interactions must be consistent and safe, thus automation is the only way to go; but keeping a service up and running during this time is not an ideal solution F. OpenSource Lightening Updates These are short updates on different relevant OpenSource projects. They should be 5 mins (preferably) with a maximum of 10 mins (if space allows). No formal submission required ahead of RIPE, but please send a short message to opensource-wg-chairs(a)ripe.net (mailto:opensource-wg-chairs@ripe.net) by noon on Tuesday during the RIPE if you want to present an update. Selection of talks are done on Tuesday afternoon.

1 0

Apply for next RIPE NCC hackathons, in six locations!
by Vesna Manojlovic 05 Sep '19

05 Sep '19

Dear colleagues, as our tenth hackathon, we are hosting our first IoT-themed event (Internet of Things) on the weekend of 12-13 October in Rotterdam: https://labs.ripe.net/Members/becha/iot-hackathon-at-ripe-79-in-rotterdam This is planned for the weekend just before RIPE 79: http://ripe79.ripe.net You can apply at: https://www.ripe.net/participate/forms/apply/iot-hackathon-rotterdam-2019/ The application deadline is *9 September 2019*. Shortly after that, for the first time ever, we are holding the hackathon simultaneously in five connected 'nodes' across Europe: Delft, Dublin, Padua, Paris and Sarajevo! https://labs.ripe.net/Members/ulka_athale_1/take-part-in-pan-european-quant… Topic is Quantum Internet, and dates 5 & 6 November. The first application deadline is *15 September 2019*. This will probably be extended due to the summer & academic holidays. You can apply at: https://www.ripe.net/participate/forms/apply/peqi/ Warm regards, Vesna Manojlovic Community Builder RIPE NCC

1 0

Call for Opensource-WG Presentations (RIPE79, Rotterdam, 14-18 Oct 2019)
by Martin Winter 26 Aug '19

26 Aug '19

The next RIPE Meeting is coming up again - your chance to present about some interesting Open Source If you would like to give a presentation during the OpenSource WG session, then please contact us (the WG chairs). In general, each talk is 15-30 mins (depending on how much time is needed). If you have some idea and not sure how/if you should present something then feel free to contact us as well to discuss the idea. For small project updates, we are planning to reserve 30 mins again at the end of the WG session. These short 5..10(max) min updates/talks are decided on the day before the WG session on a time/space available base. No need to submit anything for these talks at this time. Thanks, Martin Winter & Ondrej Filip OpenSource WG Chairs

1 0

Open Source WG - Call for Co-Chairs Nomination
by Martin Winter 26 Aug '19

26 Aug '19

It’s 2 month before our annual Fall meeting - which means it’s time for nominations to become a new co-chair of the WG. Please send your nominations within the next 21 days to the WG chairs: opensource-wg-chairs(a)ripe.net (mailto:opensource-wg-chairs@ripe.net) Deadline for nomination: Sunday, Sep 15 23:59 UTC Both of the existing chairs are willing to continue. If there are no nominations, then there will be no change. Details on Chair Selection Policy: https://www.ripe.net/participate/ripe/wg/open-source-working-group/open-sou… In short: If there are NO nominations, then the existing chairs will continue. If there are nominations, then the existing chairs will have a discussion with the candidates to see if we can come to an agreement (i.e. expand to 3 chairs, replace one of us etc). If there is no agreement between all the existing chairs and the new nominations until 14 days before RIPE, then there will be a vote during the RIPE meeting. Regards, Martin Winter & Ondrej Filip Open Source WG Chairs ReplyForward

1 0

New RIPE Labs article: ARTEMIS: an Open-source Tool for Detecting BGP Prefix Hijacking in Real Time
by Mirjam Kuehne 23 Aug '19

23 Aug '19

Dear colleagues, ARTEMIS is an open-source tool for detecting BGP prefix hijacking in real time. Please find an update of the ARTEMIS project on RIPE Labs: https://labs.ripe.net/Members/vasileios_kotronis/artemis-an-open-source-too… You can find more details about the project in this earlier article: https://labs.ripe.net/Members/vasileios_kotronis/artemis-neutralising-bgp-h… Kind regards, Mirjam Kühne RIPE NCC

1 0

ideas for adding IPv6 support to existing Open Source apps
by JORDI PALET MARTINEZ 14 Jun '19

14 Jun '19

Hi all, The next AFRINIC meeting, middle of June, in Uganda, will host a 2-days hackathon to add IPv6 support to some apps. We are trying to compile a list of Open Source applications that could be subject for this exercise. I think a possible priority could be apps used by operators which still don't have IPv6 support. If you have something in mind, please provide the URLs where to get the source and it must be possible to upload a patch afterwards, to take as much advantage as possible. Thanks! Regards, Jordi ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

3 3

hackathon discussion at RIPE 78 opensource-wg session
by Charles Eckel (eckelcu) 12 Feb '19

12 Feb '19

Happy New Year Everyone! RIPE has hosted several very successful RIPE NCC Hackathons. I have helped IETF and MEF start and run a series of Hackathons. I spoke about these at RIPE 76. There was a suggestion from Vesna at that time to create a common page on which we post information about such events. The current RIPE hackathon page (https://labs.ripe.net/hackathons) is a good start. I would be happy to add to this. I would like to propose having some time at RIPE 78 to discuss open source efforts like these various hackathons, what is working well, what is not, and how we can improve them. For example, the IETF hackathons need to be better about turning hackathon code into contributions to projects that are easy to find, use, and contribute to any time rather than just in the context of the hackathon. Another example is competition. Some people think hackathons are perceived as being too competitive and non-inclusive. I do not agree, and I try to make it very clear that the IETF hackathons are collaborative and open to newcomers, but the fact I need to keep stating this means there is a problem and an opportunity to do something better. What do others think about having some time in the opensource-wg to share information, ideas, issues, and potential solutions? Would it be better to have a workshop? What about doing both? Martin and Ondrej, I understand this is your call to make, so I hope you do not mind me posting here to help get a sense of interest and help refining the idea. Cheers, Charles

3 3

FOSDEM DNS devroom CfP
by Peter van Dijk 19 Oct '18

19 Oct '18

Hello Open Source WG, After a successful and packed half-day DNS devroom at FOSDEM 2018, we are happy to announce a full-day DNS devroom at FOSDEM 2019. As with last year, we hope to host talks anywhere from hardcore protocol stuff, to practical sessions for programmers that are not directly involved with DNS but may have to deal with DNS in their day to day coding or system administrators responsible for DNS infrastructure. We have been allotted a room on Sunday 3 February 2019. We expect to schedule 30 minutes per talk, including questions, but if you need more or less time, we can discuss this. If you have something you’d like to share with your fellow developers, please head to pentabarf at https://penta.fosdem.org/submission/FOSDEM19. Examples of topics are measuring, monitoring, DNS libraries, and anecdotes on how you’ve (ab)used the DNS. Here’s the 2018 schedule, for your inspiration: https://archive.fosdem.org/2018/schedule/track/dns/ . The deadline for submission is December 1st. If you have a FOSDEM pentabarf account from a previous year, please use that account. Reach out to dns-devroom-manager(a)fosdem.org if you run into any trouble. See you there! Cheers, Peter van Dijk, Shane Kerr, Pieter Lexis, and Kees Monshouwer

1 0