- db-wg - mailman.ripe.net

Status of the language: attribute
by Jan-Erik Eriksson 21 Mar '13

21 Mar '13

Dear DB-WG members, My name is Jan-Erik Eriksson, representing the ccTLD AX I would like to express our strong support for the continuance of the, currently beta state, attribute 'language:' for the inetnum and inet6num object type in the RIPE DB. Background: AX is the ISO country code for the Åland Islands. The Åland Islands is an autonomous, demilitarized and neutralized region belonging to Finland. Its official language is Swedish. Åland are governed according to the Act on the Autonomy of Åland and international treaties. The autonomy is well developed and in many ways Åland function like a sovereign state. The symbols of the autonomy can be seen in the own national flag, stamps, the Parliament building and internet top-level domain (.ax). Our special situation as a Swedish speaking area with the country of Finland have and still are imposing great challenges for s in the on-line world. Typically web services, ads, media and other on-line content is presented to our users in the wrong language. To solve these issues today the only way is to approach the presenter of that content, for instance Google, and lobby for them to handle this situation. As you all understand, this task is impossible considering the number of parties that we would need to contact. In this respect, the language attribute, if supported by the RIPE/Internet community, could serve as a de facto source of reference for both operators, content providers and geoip suppliers. We also believe there are other multi-language countries in Europe that could benefit from using this attribute, should there be a widespread adoption of its use. Sincerely, Jan-Erik Eriksson CTO Ålands Telekommunikaton Ab

4 4

RIPE abuse finder
by Max Tulyev 21 Mar '13

21 Mar '13

Hello! Recently our company started to receive a lot of strange complaints relating to network we don't operate or route. I fount these complaints was sent to points of contact got by RIPE abuse finder. This is the fresh sample of it: IP: 31.133.58.219 Output of RIPE abuse finder: https://apps.db.ripe.net/whois/use-cases/abuse-finder.json?source=ripe&prim… { "abuse-resources":{ "service":"abuse-finder", "link":{ "xlink:type":"locator", "xlink:href":"http://apps.db.ripe.net/whois/use-cases/abuse-finder.json?source=ripe&prima…"} , "parameters":{ "primary-key":{ "value":"31.133.58.219"} , "sources":{ "source":{ "name":"RIPE", "id":"ripe"} } } , "irt-objects":null, "abuse-mailbox-attributes":{ "attribute":{ "name":"abuse-mailbox", "value":"support(a)netassist.ua"} } , "objects-with-abuse-related-remarks":null} } whois -B 31.133.58.219 % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf % Information related to '31.133.32.0 - 31.133.63.255' inetnum: 31.133.32.0 - 31.133.63.255 netname: DIDAN descr: FOP Trubnikov Valeriy Muhaylovich country: UA org: ORG-FTVM1-RIPE admin-c: TA3197-RIPE tech-c: TA3197-RIPE status: ASSIGNED PI mnt-by: RIPE-NCC-END-MNT mnt-lower: RIPE-NCC-END-MNT mnt-by: TRUBNIKOV-MNT mnt-routes: TRUBNIKOV-MNT mnt-domains: TRUBNIKOV-MNT changed: hostmaster(a)ripe.net 20110415 changed: hostmaster(a)ripe.net 20110415 source: RIPE organisation: ORG-FTVM1-RIPE org-name: FOP Trubnikov Valeriy Muhaylovich org-type: other address: 86156, Ukraine, Makiyivka, Zeleniy, 60/182 admin-c: TV1866-RIPE tech-c: TA3197-RIPE e-mail: core(a)didan.org mnt-ref: TRUBNIKOV-MNT mnt-by: TRUBNIKOV-MNT changed: core(a)didan.org 20110414 source: RIPE person: Trubnikov Andrey address: 86156, Ukraine, Makiyivka, Zeleniy, 60/182, phone: +380623277657 nic-hdl: TA3197-RIPE changed: core(a)didan.org 20110331 mnt-by: TRUBNIKOV-MNT source: RIPE % Information related to '31.133.48.0/20AS52091' route: 31.133.48.0/20 descr: FOP Trubnikov Valeriy Muhaylovich origin: AS52091 mnt-by: TRUBNIKOV-MNT changed: core(a)didan.org 20110423 source: RIPE % Information related to 'AS52091' aut-num: AS52091 as-name: TRUBNIKOV-AS descr: FOP Trubnikov Valeriy Muhaylovich org: ORG-FTVM1-RIPE import: from AS47694 accept ANY export: to AS47694 announce AS52091 import: from AS21189 accept ANY export: to AS21189 announce AS52091 admin-c: TA3197-RIPE tech-c: TA3197-RIPE mnt-by: RIPE-NCC-END-MNT mnt-by: TRUBNIKOV-MNT mnt-routes: TRUBNIKOV-MNT changed: hostmaster(a)ripe.net 20110415 source: RIPE organisation: ORG-FTVM1-RIPE org-name: FOP Trubnikov Valeriy Muhaylovich org-type: other address: 86156, Ukraine, Makiyivka, Zeleniy, 60/182 admin-c: TV1866-RIPE tech-c: TA3197-RIPE e-mail: core(a)didan.org mnt-ref: TRUBNIKOV-MNT mnt-by: TRUBNIKOV-MNT changed: core(a)didan.org 20110414 source: RIPE person: Trubnikov Andrey address: 86156, Ukraine, Makiyivka, Zeleniy, 60/182, phone: +380623277657 nic-hdl: TA3197-RIPE changed: core(a)didan.org 20110331 mnt-by: TRUBNIKOV-MNT source: RIPE whois -B TRUBNIKOV-MNT % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf % Information related to 'TRUBNIKOV-MNT' mntner: TRUBNIKOV-MNT descr: FOP Trubnikov Valeriy Muhaylovich admin-c: TA3197-RIPE upd-to: core(a)didan.org auth: MD5-PW # Filtered mnt-by: TRUBNIKOV-MNT referral-by: TRUBNIKOV-MNT changed: core(a)didan.org 20110418 source: RIPE # Filtered person: Trubnikov Andrey address: 86156, Ukraine, Makiyivka, Zeleniy, 60/182, phone: +380623277657 nic-hdl: TA3197-RIPE changed: core(a)didan.org 20110331 mnt-by: TRUBNIKOV-MNT source: RIPE Is it a bug or a feature, and why?

5 14

Soft launch of "abuse-c:", ripe-563: Improving Abuse Contact Information
by Kaveh Ranjbar 19 Mar '13

19 Mar '13

[Apologies for duplicate emails] Dear Colleagues, RIPE NCC has initiated a soft launch of phase one of RIPE Policy 563: "Abuse Contact Management in the RIPE Database". All facilities to provide abuse contact information for organisations registered in the RIPE Database are be in production state. Please see the announcement sent earlier to the RIPE Anti-Abuse Working Group mailing list (http://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2013-March/002226.html). Kind Regards, Kaveh Ranjbar Database Group Manager RIPE NCC

1 0

Redevelopment of the RIPE Database software is complete
by Kaveh Ranjbar 25 Feb '13

25 Feb '13

Dear Colleagues, The RIPE NCC is proud to announce that our redevelopment of the RIPE Database software is complete. At RIPE 63, the RIPE NCC announced that we were starting a project to replace the 11-year old legacy RIPE Database software with a new system. At RIPE 64, we were able to report completion of the new query software and the start of the update project. The new query software has been handling all queries for almost a year, and the new update software is now in place and handling all updates. This new software is able to scale the RIPE Database to meet the expanding requirements of the members, the RIPE community and the RIPE NCC. It will also improve our response times on bug fixes, changes and major feature requests. With near complete unit test coverage of the code, higher level integration tests and extensive end to end 'use case' testing we have greatly improved the maintainability and reliability of the entire RIPE Database infrastructure. The new systems were rolled out incrementally, so the process was almost invisible to users of the service. The new software is mostly backwards compatible, although we have introduced some long-anticipated features and requirements. On our website, we are publishing software release notes that are updated for each new release. These can be found here: http://www.ripe.net/data-tools/db/release-notes With the new software now in place, we have a lot of opportunity for future expansion of the service and to implement features desired by the members and the wider community. During the redevelopment process we also had the chance to improve the behaviour of our system. Some of the areas improved are: - Some community-approved policies which were not fully enforced within the RIPE Database are now enforced by the new software for all RIPE address space. - A lot of issues in the authorisation are resolved. Resource holders now have full control over the resources they maintain and situations where they might lose control of their resources by mistake are no longer possible. - All resources allocated or assigned by the RIPE NCC have their entries in the RIPE Database protected against accidental deletion by users. - The new system accepts IPv6 network addresses in different formats, but always normalises the input to a single format which is used for storing, searching and displaying the records. If you query, create, modify or delete an object, no matter what format you specify the address in, it will first be normalised, then the operation will be actioned. In general, the new system is much smarter in the interpretation of IPv4 and IPv6 addresses on input and can handle different notations. - New error messages are more comprehensive and the system provides more specific error messages and logging and in many different situations. - The new system is about four times faster on queries and three times faster on processing updates. We have published an article on RIPE Labs with details about the features in the new system: https://labs.ripe.net/ripe-database/changes-to-the-processing-of-ripe-datab… Internally, the new system has a lot of benefits as well: - The new software has been designed from scratch with distribution in mind. Additional query and update nodes can easily be added for redundancy and performance. - Hot deployments of new software are now possible with no interruption to the service. - Some additional security measures have been introduced to improve the overall security of the system. - Logging and debugging facilities have been improved for easier support and maintenance. - The whole system is integrated and self-contained. It doesn't rely on external scripts for any task (such as the import of external data for mirroring or automatic data clean-up of unreferenced objects) and so is much easier to maintain. - Internal management and monitoring facilities have been improved and integrated into the system, so support and maintenance can provide users with direct feedback from the production system. - The memory footprint of the new system is much smaller. - The code base is much cleaner, making it easier to understand and maintain. Java is now the single language, replacing a mix of C, Perl and Java code. So, what's next? - Currently we are working on a new set of RIPE Database documentation that will be clean, concise and linked directly to each release, including a further review of error messages and all information provided when interacting with RIPE Database. - Investigate with the community the integration of RIPE Database authentication with the single sign-on (SSO) service for RIPE NCC services. - Implementing the IETF WEIRDS RDAP Protocol, fully integrated into the RIPE Database API, as a cooperative software development project with APNIC. - Using business rules to 'fix' parts of resource objects that users should not change, then allowing all objects to be updated by normal methods rather than special editors in the LIR Portal. - Providing the new software to the public and making the project open source and accessible for third parties. - Liaise with the community on new features and data clean-up as announced at the last RIPE Meeting. As always, you can contact us at <ripe-dbm(a)ripe.net> for any issues, feature requests or suggestions. Kind regards, Kaveh Ranjbar Database Group Manager RIPE NCC

2 1

[training] RIPE NCC Training Courses April-June 2013 - BA UK AE DE NL PL LI RU FR ES HU FI
by Training Mailbox 25 Feb '13

25 Feb '13

Dear Colleagues, Our training team travels the RIPE NCC service region to deliver training courses to our members without any additional cost. Over the next few months, we'll be in Sarajevo, Leeds, Dubai, Berlin, Amsterdam, Warsaw, Vaduz, St. Petersburg, Marseilles, Madrid, Budapest, Helsinki. Visit the following page to register and to check which training courses we are giving in your area: https://lirportal.ripe.net/training/courses The RIPE NCC delivers the following training courses: - LIR Training Course - Database Training Course (new) - IPv6 for LIRs Training Course - Routing Security Training Course For more information visit: http://www.ripe.net/lir-services/training/courses With kind regards, Rumy Spratley-Kanis Training Services Manager

1 1

bug? accepting larger than 32 bit BGP Communities in RPSL
by Job Snijders 07 Jan '13

07 Jan '13

Dear RIPE DB group, A small snippet from the current AS15562 object as stored in the RIPE DB. remarks: Larger than 32bit BGP Community test remarks: 64 bit export: to AS199036 action community .= { 0000199036:0000199036 }; announce AS-SNIJDERS The value "0000199036:0000199036" is a 64 bit integer: (199036<<32)+199036 = 854853110925692 854853110925692 Is far larger than what RFC 2622 [1] allows in section 7.1: typedef: # a community value in RPSL is either # - a 4 byte integer (ok to use 3561:70 notation) # - internet, no_export, no_advertise (see RFC-1997 ) community_elm union integer[1, 4294967295], enum[internet, no_export, no_advertise], So my main question is, why is the RIPE DB allowing such values to be stored? This is not conforming to any specification that I am aware of. Currently there is no consensus on what the future of BGP communities will look like within the IETF. Kind regards, Job [1] http://tools.ietf.org/html/rfc2622

6 8

Severe performance problems with RIPE whois server
by Nick Hilliard 27 Dec '12

27 Dec '12

So the new kid on the block for issuing IRR querys is bgpq3: http://snar.spb.ru/prog/bgpq3/ (Thanks to Job Snijders for pointing it out). Here are some comparative results for bgpq3 and irrtoolset using a random large-ish as-set with ~5000 ASNs: > ubuntu1:/home/nick/bgpq3-0.1.16> time bgpq3 AS-NEOT > /dev/null > 0.144u 0.032s 0:04.26 3.9% 0+0k 0+0io 0pf+0w > ubuntu1:/home/nick/trunk/src/peval> time ./peval -h whois.radb.net -protocol irrd AS-NEOT > /dev/null > 8.600u 0.516s 10:14.14 1.4% 0+0k 0+0io 0pf+0w > ubuntu1:/home/nick/trunk/src/peval> time ./peval -h whois.ripe.net -protocol ripe AS-NEOT > /dev/null > 2.900u 0.304s 12:21.72 0.4% 0+0k 0+0io 0pf+0w Due to its use of pipelining it can return IRRD query results ridiculously quickly, and it's pretty clear that irrtoolset is being completely trashed by comparison because it doesn't support pipelining. The difference between the RIPE and RADB whois server is related to the fact that the RADB server supports recursive as-set expansion. In fact, a more interesting question is not why bgpq3 is 175 times faster than irrtoolset, but rather why it takes as long as 4.26 seconds to complete an inverse query for the as-set in question. If I did ran a SQL query on a single term with indexed lookups and which returned 50k results, I'd wonder why it was so slow. In this case, it turns out that the answer mostly relates to the amount of data returned (~750k), and the rtt to the whois server from my query box (~150ms), rather than as a result of the query latency. Anyway, it should be clear that for large query sets, the RIPE server is extremely slow because of its lack of command pipelining and lack of support for recursive expansion of certain types of objects. This directly affects INEX because we run a full rebuild of our route server configuration three times daily. Our route server as-set (AS-SET-INEX-RS) contains about 5400 ASNs and the consequent serialisation delays are currently causing our rebuild scripts to take slightly more than 30 minutes to complete. This varies depending on client policies: earlier this year, rebuilds were taking about 2 hours. In fact for performance reasons, we need to query whois.radb.net instead of RIPE for the larger AS-SETs. This is because of the recursive as-set performance issue which affects queries to whois.ripe.net In order to solve this problem, what we'd really love to see is: 1. support for command pipelining 2. support for recursive expansion of as-set to a list of ASNs. 3. support for recursive inverse key expansion of an as-set to a list of prefixes These would mean a massive performance gain for INEX's use case (and a bunch of other IXPs around europe) and #3 would mean that the RIPE whois server could leapfrog IRRD in terms of performance. Would it be possible for the DB people to look into this? Nick

4 4

RIPE NCC Webinars - new dates
by Training Mailbox 21 Dec '12

21 Dec '12

[Apologies for duplicate e-mails] Dear colleagues, We are pleased to announce the launch of new dates for our Webinars for LIRs. The RIPE NCC Webinars are live, one hour online training courses that allow participants to interact with our trainers without leaving their desks. We focus on the topics and issues most important for LIRs. Register now at https://www.ripe.net/lir-services/training/e-learning/webinars Participation is limited to 20 people, so don't hesitate if you want to take part! If you have questions, please email <e-learning(a)ripe.net>. We look forward to seeing you online. Kind regards, RIPE NCC Training Services

1 1

Re: [db-wg] [anti-abuse-wg] RIPE NCC's proposed implementation of Abuse Contact Management in the RIPE Database
by Denis Walker 13 Dec '12

13 Dec '12

Dear Gert and other colleagues, After some off list clarification we see the point you are concerned with. The simplest case where an organisation manages all the abuse for all customers is easy to understand. In the real world this organisation has one or more internet resources and within the organisation there is a function (or role) that handles abuse complaints. So a real world picture is clear. Taking a member organisation as an example: member organisation / \ / \ internet abuse resources role This maps exactly to the new RIPE Database model: member ORGANISATION object / \ / \ INET(6)NUM member abuse objects ROLE object It is easy to see how to find the abuse handling role for any of these internet resources. The problem appears to be with the vision of what happens lower down in a network. After years of modifications the data model of the RIPE Database no longer reflects the real world. The relationships between objects are less than optimal. If you try to think of anything in terms of RIPE Database objects and relationships, it is not always obvious or clear. The implementation of the abuse-c proposal takes one small step to bringing the RIPE Database model closer to reflecting the real world, as outlined in the Database Groups presentation at RIPE 65. When a customer wants to handle abuse for their part of a network, they are taking over part of the management of that internet resource. In reality the customer's situation is the same as the member's. member ORGANISATION object / \ / \ INET(6)NUM abuse objects ROLE object / \ / \ / \ customer ORGANISATION object / \ / \ / \ / \ other INET(6)NUM customer abuse customers object ROLE object INET(6)NUM objects By including the customers ORGANISATION object the same structure is modelled at any level. This is the basic structure of any organisation that manages internet resources. So now it is easy to see how to find this customers abuse handling role and also how to find the abuse handling role for any of the other customers. This structure can be repeated as many times as necessary at any point in a network. We don't have abuse contacts hanging off different object types. The principle of finding the abuse contact is always the same. That is what makes the model simple in all cases. Internet resources includes AUT-NUM objects as well, and an organisation can have multiple top level INET(6)NUM objects, but to keep the diagram simple I ignored them. I hope this helps to explain the reasoning behind this model. To help with practical administration the RIPE NCC will provide some easy to use tools initially so a customers details only need to be entered once and appropriate objects will be created and the references made. To remove this setup for a specific customer just delete the reference to the ORGANISATION object. The extended garbage cleanup process will delete any cluster of ORGANISATION, MNTNER, ROLE, PERSON objects that are unused. We will also provide more extensive tools for managing changes to contact data at any level across multiple objects. Regards, Denis Walker Business Analyst RIPE NCC Database Group On 10/12/2012 14:42, Gert Doering wrote: > Hi, > > On Wed, Dec 05, 2012 at 11:10:09AM +0100, Denis Walker wrote: >> If at some point a customer chooses to do their own management of abuse >> handling for their assigned address space you simply create the >> ORGANISATION and abuse ROLE objects for this customer and add the "org:" >> reference to this customers assignment. > > I'm not sure if I find this "simple", to be honest. > > Being able to specify an abuse-c: in the ASSIGNED inet(6)num: object, > and having the RIPE DB software honour that on queries - that is: not > go to the allocation's org->abuse-c - would require less objects to be > created, and thus, less effort and less opportunity for confusion. > > Gert Doering > -- NetMaster >

2 2

RIPE NCC's proposed implementation of Abuse Contact Management in the RIPE Database
by Kaveh Ranjbar 07 Dec '12

07 Dec '12

Dear Colleagues, The RIPE NCC's proposed implementation plan of RIPE policy 563 (policy proposal 2011-06) titled "Abuse Contact Management in the RIPE Database" is as follows: =========== Introduction =========== Abuse Contact Management in the RIPE Database (as defined in RIPE policy document 563) mandates the RIPE NCC to gather and publish abuse contact information for Internet resources provisioned by the RIPE NCC. =========== Approach =========== Abuse handling is generally a role within an organisation and the RIPE NCC is planning to model this relation in the RIPE Database. So the "abuse-c:" attribute will be available in the ORGANISATION object and should reference a ROLE object. When a ROLE object is referenced from an ORGANISATION object by the "abuse-c:" attribute, it must have an "abuse-mailbox:" attribute. All resources allocated or assigned by the RIPE NCC are required to have a reference to an ORGANISATION object in the RIPE Database. By adding a single "abuse-c:" attribute to their ORGANISATION object, a resource holder can quickly cover all their resources. All resources that are allocated or assigned by the RIPE NCC and which are subject to and compliant with current resource policies will then either directly reference an abuse contact or will inherit one from the parent resource. The detailed changes to RIPE Database objects and business rules, fine tuning, search options and facilities for quick data entry by RIPE NCC members using the LIR Portal are all described in an article on RIPE Labs: https://labs.ripe.net/Members/kranjbar/implementation-details-of-policy-201… ============ Timeline ============ * Phase 0 - Q1 2013 The RIPE NCC will make internal changes to the RIPE Database and LIR Portal, this should be done by end of Q1 2013. * Phase 1 - Q2 and Q3 2013 The RIPE NCC will ask members to add "abuse-c:" to their member ORGANISATION object at least and will conduct a follow-up on that. RIPE NCC Members will be required to have abuse contact data for their resources when working with our Registration Services department. If a member has not added abuse-c:" to their ORGANISATION object by the end of this phase, the RIPE NCC will automatically add the member's published contact email address as the member's abuse contact. Members can edit this information any time through the LIR Portal. At the end of this phase, all PA allocations and their more specifics will have an abuse contact. * Phase 2 - Q4 2013 to Q3 2014 The RIPE NCC will ask AS Number and PI Resource holders to add abuse contact information to their ORGANISATION objects. If some resource holders have not added their abuse contact data by the end of this phase, the RIPE NCC will add the published abuse contact data for the responsible LIR to the ORGANISATION object listed in the resource. Any resource holder with access to the related object can always edit this information. At this point, ALL resources in the RIPE Database which are subject to and compliant with RIPE policies will have accessible abuse contact information. Please let us know if you like this proposal or have any feedback or ideas for improvement of this implementation proposal. Regards, Kaveh Ranjbar, RIPE NCC Database Group Manager

6 8