- db-wg - mailman.ripe.net

re-evaluate route-object authorisation model
by Job Snijders 14 May '15

14 May '15

Dear working group, Yesterday during the birds of a feather session about "cross-registry authorisation" the idea to relax the authorisation requirements for route-object creation was brought up (again). I ask this group to further explore. Today, to create a route-object, BOTH the inetnum mntner, and the autnum mntner need to approve the creation of the route-object. One could argue that it is sufficient to require only authorisation from the inetnum owner to create a route-object. This would simplify the process, especially if the autnum is managed in a non-RIPE RIR. No longer would ARIN autnum owners be required to create a superfluous autnum object in the RIPE database. Questions: - should the authorisation model work differently for RIPE managed space versus non-RIPE managed space? Should we even continue to allow route-objects covering non-RIPE managed space? - should the authorisation model work differently when creating a route-object for RIPE managed space with a non-RIPE managed autnum? If yes, how so? - although in this idea the autnum owner is no longer required to approve /creation/ of a route-object, would it be a good idea to allow the autnum owner to /delete/ any route-object in which their autnum is referenced as origin? - Is RFC 2725 the only reason why the authorisation model was implemented as it was implemented, can someone remember practical reasons for doing it this way? During the BoF it was pointed out that any potential DoS vector already exists today. - ... ? Kind regards, Job

7 9

Re: [db-wg] [routing-wg] RPKI Validator 2.19; export ROAs as RPSL route: objects
by Randy Bush 14 May '15

14 May '15

>> We've been getting a lot of requests to make processed RPKI data >> easily available in existing (RPSL based) workflows. This is why we >> added the ability to export all ROAs as route: objects in the latest >> release, version 2.19. Practically, this means that running an RPSL >> export will give you almost 450,000 highly reliable, cryptographically >> validated route: objects. > Interesting! I was considering writing a script to do this, but the NCC > beat me to it! :-) drl wrote the script and has made the data available for years > Wouldn't it make sense to align the "created:" date with something > more specific to the ROA rather then the export date? yes > Another consideration might be to create a "expiry-date:" derived from > the ROA's expiry date for easy debugging purposes. use a remark: randy

1 0

Cross-RIR route object registration
by snash 13 May '15

13 May '15

In considering the verification of Route Object ownership for route acceptance policies, please consider organisations which implement temporary BGP announcements for traffic diversion for uses like DDoS Mitigation. The AS may be registered with an RIR which is not the same as the RIR of the Route Object. Plus there must continue to be a means to have more than one entity pre-authorised to announce any particular Route Object, or subnet thereof. Regards Steve ________________________ Steve Nash CEng MIET Consulting Engineer Arbor Networks office +44 118 967 4917 mobile +44 772 029 1359 www.arbornetworks.com ________________________ Please be advised that this email may contain confidential information. If you are not the intended recipient, please notify us by email by replying to the sender and delete this message. The sender disclaims that the content of this email constitutes an offer to enter into, or the acceptance of, any agreement; provided that the foregoing does not invalidate the binding effect of any digital or other electronic reproduction of a manual signature that is included in any attachment.

1 0

Cross registry authentication BOF - rough notes
by Nigel Titley 13 May '15

13 May '15

Please find the rough notes that I took during this BOF attached Nigel

3 2

Minutes of DB-WG for the RIPE 69 meeting
by Nigel Titley 11 May '15

11 May '15

Folks I'm a bit late in sending these minutes out, for which I apologise. Please rapidly get any comments back to me. Thanks Nigel

1 0

[training] RIPE NCC Training Courses July-September 2015
by Training Services 11 May '15

11 May '15

Dear colleagues, Our training team travels the RIPE NCC service region to deliver training courses to our members without any additional cost. Over the next few months, we'll be in Frankfurt, London, Skopje, Stockholm, Minsk, Sarajevo, Vladivostok, Tel Aviv, Tallinn, Zurich, Paris, Amsterdam. Visit the following page to register and to check which training courses we are giving in your area: https://lirportal.ripe.net/training/courses The RIPE NCC delivers the following training courses: - LIR Training Course - Database Training Course - Basic IPv6 Training Course - 2 day Advanced Training Course - Routing Security Training Course For more information visit: https://www.ripe.net/support/training/courses With kind regards, Rumy Spratley-Kanis Training Services Manager

1 0

Proposal to clean up historical "abuse-mailbox:" attributes
by denis 09 May '15

09 May '15

2 4

[training] RIPE NCC Training Courses July-September 2015
by Training Services 08 May '15

08 May '15

Dear colleagues, Our training team travels the RIPE NCC service region to deliver training courses to our members without any additional cost. Over the next few months, we'll be in Frankfurt, London, Skopje, Stockholm, Minsk, Sarajevo, Vladivostok, Tel Aviv, Tallinn, Zurich, Paris, Amsterdam. Visit the following page to register and to check which training courses we are giving in your area: https://lirportal.ripe.net/training/courses The RIPE NCC delivers the following training courses: - LIR Training Course - Database Training Course - Basic IPv6 Training Course - 2 day Advanced Training Course - Routing Security Training Course For more information visit: http://www.ripe.net/lir-services/training/courses With kind regards, Rumy Spratley-Kanis Training Services Manager

1 0

Re: [db-wg] db-wg Digest, Vol 44, Issue 7
by denis walker 08 May '15

08 May '15

Hi Piotr Just to be clear, you refer to free text attributes. This has a specific meaning in terms of database syntax checks. It applies to those attributes where no syntax checks are done, for example "address:", "descr:", "remarks:". Is your proposal only referring to these attributes? I trust you do not mean all attributes other than primary keys. Incidentally, although "person:", "role:" and "org-name:" are not primary keys, they are not free text either. Currently there are syntax checks done on these values. If you allow these in UTF8 then all these syntax checks will have to be dropped. cheersdenisindependent netizen Date: Fri, 17 Apr 2015 12:18:04 +0200 From: Piotr Strzyzewski <Piotr.Strzyzewski(a)polsl.pl> To: db-wg(a)ripe.net Subject: [db-wg] Proposal to allow UTF8 Message-ID: <20150417101804.GD7031(a)hydra.ck.polsl.pl> Content-Type: text/plain; charset=utf-8 Dear DB-WG Members Proposal: I propose to allow UTF8 in all free text attributes of all DB objects except in primary keys. Description: RIPE NCC service region covers Europe, the Middle East and parts of Central Asia. Moreover we have users from outside of this region. This means that WHOIS DB stores data for people and organizations from number of different countries using number of different alphabets. At this moment, all data in the RIPE WHOIS DB have to be stored using 7-bit plain US ASCII character set. [As a side note: It is technically possible to store some UTF8 content in some attributes, but the answer to whois query (both terminal and web based) returns "?" character in this case.] Lack of the full support for national character sets leads to some problems which includes, but is not limited to: 1. Mistakes in person/organization names due to national->english and english->national (based mostly on guess) conversion. 2. Mistakes in person/organization address due to national->english and english->national (based mostly on guess) conversion. 3. Conflict of converted words with other correct words (most visible in latin-based character sets). 4. Possible offensive word formation due to national->english conversion of names and/or addresses of person/organization. [As a side note to points no 1-3: This could lead to some problems when LEA tries to find out precisely who should be contacted in case of abuse.] On the other side, community members needs to know who is responsible for certain resource without the necessity of understanding all the others character sets. Moreover, some objects are filled with data that has to be provided in ASCII character set due to business rules (like ORGANISATION object details for LIRs). RIPE NCC has a policy to insist on latin based names for organisation objects that it verifies (allocated, and sponsored end-user space). Taking this into accout I propose to allow UTF8 in all free text attributes of all DB objects except in primary keys. Some possible issues to be addressed: 1. When this proposal will be supported by the DB-WG, then it has to be discussed at least with AA-WG and AP-WG. 2. UTF8 may cause problems for client code. Comment: The proper implementation plan and announcements schedule should be prepared. 3. UTF8 may result in contact addresses and names that are not readable by a large part of the community. Comment: Primary keys (mostly names) still have to be in ASCII character set. Moreover, LIRs data are also in ASCII character set due to business rules. 4. At this moment there are no major technical issues blocking UTF8 support in the RIPE DB back-end. However thorough checks have to be done. Looking for your comments. Piotr -- gucio -> Piotr Strzy?ewski E-mail: Piotr.Strzyzewski(a)polsl.pl

4 7

Database release 1.79 deployed to RC environment
by Tim Bruijnzeels 07 May '15

07 May '15

Dear colleagues, The RIPE NCC is pleased to announce the deployment of RIPE Database software release 1.79 to the Release Candidate (RC) environment: https://www.ripe.net/data-tools/db/release-notes/rc-release-candidate-envir… <https://www.ripe.net/data-tools/db/release-notes/rc-release-candidate-envir…> This release introduces the new attributes "created:" and "last-modified:" as part of the first phase of the deprecating the changed attribute in the RIPE Database. You can find more information about the three phases of this effort here: https://labs.ripe.net/Members/tim/deprecating-the-changed-attribute-in-the-… <https://labs.ripe.net/Members/tim/deprecating-the-changed-attribute-in-the-…> It should be noted however that: = The new attributes will only be enabled in output this Thursday 2 April (because updating all objects with initial values takes a long time) = We have found that we needed to use the 1970-01-01T00:00:00Z instead of 0000-00-00T00:00:00Z (because it's invalid, and we observed inconsistencies in dealing with year 0 AD different libraries) We will update the referenced article shortly to reflect these changes. This release also changes attribute "referral-by" from mandatory to optional. This attribute is part of a mntner object for historical reasons and will be deprecated. Detailed release notes are published here: https://www.ripe.net/data-tools/db/release-notes/ripe-database-release-1.79 <https://www.ripe.net/data-tools/db/release-notes/ripe-database-release-1.79> Documentation for this release is published here: https://www.ripe.net/data-tools/support/documentation/ripe-database-documen… <https://www.ripe.net/data-tools/support/documentation/ripe-database-documen…> Please let us know if you find any issues with this release. We plan to deploy this release to the production environment on Tuesday 28 April, and we plan to enable the new "created:" and "last-modified:" attributes the following Monday 4 May - after the initial values have been added for all objects. Please let us know if you have any questions or comments. Kind regards, Tim Bruijnzeels Assistant Manager Software Engineering RIPE NCC

5 12