RIPE Database. Updates and Extras. Alvaro Vives Amsterdam RIPE 77

Transcription

1 RIPE Database Updates and Extras Alvaro Vives Amsterdam RIPE 77

2 RIPE Database DB Clients Quality of Access Quality of Data Domain Objects Creation Wizard NWI-7: abuse-c implementation RESTful API NWI-5: Out of region route(6)/aut-num!2

3 Domain Objects Creation Wizard

4 What is Reverse DNS? Mapping of IP addresses to host names :67c:2e8:22::c100:68b

5 Reverse Delegation Basics IPv4 - in-addr.arpa zone - /24 or /16 blocks only IPv6 - ip6.arpa zone - Blocks multiple of 4 bits (/28, /32, /36, /40, /44, /48)!5

6 Setting Up Reverse Delegation Configure your DNS servers - at least two name servers in different subnets - create a zone file on each for each chunk Check your zones:

7 Domain Objects Create records on RIPE NCC DNS servers Pointing to authoritative name servers domain For this zone, go to these DNS servers: nserver1 nserver2 nserver1 RIPE NCC Name Servers nserver2!7

8 Reverse DNS for IPv / in-addr.arpa / in-addr.arpa /8 192.in-addr.arpa!8

9 Domain Object for /24 domain: descr: admin-c: tech-c: zone-c: nserver: nserver: ds-rdata: mnt-by: created: last-modified: source: in-addr.arpa rdns for my IPv4 network NOC12-RIPE NOC12-RIPE NOC12-RIPE pri.example.net sns.company.org d9acbf3d3fec11b6d6 EXAMPLE-LIR MNT T13:52:29Z T15:09:46Z RIPE!9

10 Reverse DNS for IPv6 2001:0db8:003e:ef11:0000:0000:c100:004d /48 e b.d ip6.arpa / b.d ip6.arpa / b.d ip6.arpa / b.d ip6.arpa /32 8.b.d ip6.arpa /28 b.d ip6.arpa!10

11 Domain object for 2001:db8::/32 domain: descr: admin-c: tech-c: zone-c: nserver: nserver: ds-rdata: mnt-by: created: last-modified: source: 8.b.d ip6.arpa rdns for my IPv6 network NOC12-RIPE NOC12-RIPE NOC12-RIPE pri.example.net sns.company.org d9acbf3d3fec11b6d6 EXAMPLE-LIR MNT T13:52:29Z T15:09:46Z RIPE!11

12 Create Domain Objects Wizard domain: in-addr.arpa domain: mnt-by: in-addr.arpa EXAMPLE-MNT domain: nserver: tinny.arin.net mnt-by: nserver: EXAMPLE-MNT sec3.apnic.net domain: nserver: tinny.arin.net mnt-by: nserver: EXAMPLE-MNT sec3.apnic.net nserver: tinny.arin.net mnt-by: nserver: EXAMPLE-MNT sec3.apnic.net nserver: tinnie.arin.net in-addr.arpa in-addr.arpa nserver: sec3.apnic.net!12

13 stat.ripe.net!13

14 RESTful API

15 Textual representations of web resources Uniform and predefined set of stateless operations Client-Server Characteristics URIs Response standard formats: HTML, XML, JSON RESTful Web Service Common use of HTTP(S): GET, POST, PUT, DELETE Performance Properties Reliability Scalability Simplicity Portability!15

16 URI for each Database Object URI Format: RIPE Database RESTful API POST: create Supported Methods GET: lookup PUT: update DELETE: delete HTTP/1.1 Content Negotiation Accept: application/xml Accept: application/json.xml.json!16

17 URI Format: ripe: RIPE database {source} test: TEST database person, role, organisation {objecttype} inet(6)num, aut-num route(6), domain, mntner, etc. {key} Primary key of the object unfiltered, unformatted!17

18 HTTP Status Code Cause Bad Request (400) The service is unable to understand and process the request. Forbidden (403) Query limit exceeded. Not Found (404) No results were found (on a search request), or object specified in URI does not exist. Conflict (409) Integrity constraint was violated (e.g. when creating, object already exists). Internal Server Error (500) The server encountered an unexpected condition which prevented it from fulfilling the request.!18

19 WHOIS REST API Lookup http(s)://rest.db.ripe.net/{source}/{objecttype}/{key} GET RIPE Database DB Clients 200 Object found 400 Bad request 404 No valid object!19

20 Lookup Examples curl ' curl -H 'Accept: application/json' ' mntner/ripe-dbm-mnt' curl ' unfiltered' curl % json'!20

21 WHOIS REST API Update PUT RIPE Database DB Clients 200 Successful update 400 Bad request: incorrect object type or key 401 Incorrect password 404 Object not found!21

22 Lookup Examples curl -X PUT -H 'Content-Type: application/xml' ' curl -X PUT -H 'Content-Type: application/json' -H 'Accept:application/json' ' rest.db.ripe.net/ripe/person/pp1-ripe?password=...' curl -X PUT ' person/tp1-ripe?dry-run&password=...'!22

23 WHOIS REST API Create POST RIPE Database DB Clients 200 Success (object created) 400 Bad request 401 Incorrect password 409 Object already exists!23

24 Create Examples curl -X POST -H 'Content-Type: application/xml' ' curl -X POST -H 'Content-Type: application/json' -H 'Accept: application/json' ' person?password=...' curl -X POST ' person?dry-run&password=...'!24

25 WHOIS REST API Delete &reason={reason} DELETE RIPE Database DB Clients 200 Successful delete 400 Bad request: invalid object type or key 401 IncorrecT password 404 Object not found!25

26 Delete Examples curl -X DELETE ' password=123' curl -X PUT ' person/tp1-ripe?dry-run&password=...'!26

27 Demo Doing it for real!

28 Demo Lookup RIPE Database Location: rest.db.ripe.net Source: ripe Object Type Type: inet6num Key Key: 2001:67c:64::/48 Format XML and JSON!28

29 Demo: Update TEST Database Location: rest-test.db.ripe.net Source: test Object Type Type: person Key Key: TP29-TEST Format XML!29

30 Demo: Create TEST Database Location: rest-test.db.ripe.net Source: test Object Type Type: inet6num (ASSIGNED) Key Key: 2001:ff29:1234::/48 Format XML!30

31 Demo: Delete TEST Database Location: rest-test.db.ripe.net Source: test Object Type Type: inet6num (ASSIGNED) Key Key: 2001:ff29:1234::/48 Format XML!31

32 Search Metadata Additional Services Geolocation Abuse Contact!32

33 References GitHub WHOIS REST API: GitHub WHOIS REST API WhoisResources: WhoisResources!33

34 NWI-7 Abuse-c implementation

35 Internet resource holders need to be contactable in case of problems.!35

36 Before Resource org: organisation role: Abuse Reports inetnum abuse-c: AR0555-RIPE nic-hdl: AR0555-RIPE inet6num abus box: aut-num!36

37 How abuse-c is displayed!37

38 Problem Statement Can t specify other abuse contacts for different resources from the same organisation Can t specify alternative abuse contacts for resources assigned to organisations other than the parent organisation After introduction of abuse-c", "abus box:" in person, mntner, organisation and irt objects was intended to be deprecated!38

39 What did we improve?!39

40 Changes in the Database Clean legacy/temporal information: - Removed abus box: from person, mntner, organisation, irt objects (NWI-7) - abus box: only allowed in role objects abuse-c: allowed in inetnum, inet6num and aut-num objects!40

41 After Resource role: Abuse Reports abuse-c: AR0123-RIPE org: organisation nic-hdl: abus box: AR0123-RIPE inetnum inet6num abuse-c: AR0555-RIPE role: Abuse Reports nic-hdl: AR0555-RIPE aut-num abus box:

42 RIPE NCC Mandate Regular validation of all abus box: attributes First trial soon after RIPE meeting Start with initial validation beginning of 2019 Presentation in the Anti-abuse WG - Thursday, 18 October 11:00-12:30!42

43 References Abuse Contact Management in the RIPE Database - RIPE

44 NWI-5 Out of region Route(6)/ AUT-NUM objects

45 How route(6) objects used to be created You needed permission from: 1. aut-num 2. inetnum or inet6num 3. route or route6 ALLOCATION aut-num: AS mnt-by: RIPE-NCC-HM-MNT mnt-by: ONE-MNT 1 mnt-by: DEFAULT-LIR-MNT mnt-routes: TWO-MNT mnt-routes: ANOTHER-MNT mnt-routes: ANOTHER-MNT route(6) origin: mnt-by: AS12345 ANOTHER-MNT 3!45

46 Out of Region Resources Because: - Need for route(6) objects - No authoritative alternative IRR available - No proper mntners RIPE community allowed placeholder objects - Using RIPE-NCC-RPSL-MNT inet(6)num as-block mnt-by: RIPE-NCC-HM-MNT mnt-routes: RIPE-NCC-RPSL-MNT mnt-by: RIPE-NCC-HM-MNT mnt-lower: RIPE-NCC-RPSL-MNT!46

47 Some numbers 68,343 out-of-region ROUTE objects (28/6/18) 1,902 out-of-region ROUTE6 objects (28/6/18)!47

48 Problem Statement Out-of-region objects authorisation is anecdotal Globally duplicate AUT-NUM objects are required for out-ofregion ASNs, confusing contact information, policy, etc. This facilitates hijacking for out-of-region resources and RIPE NCC is neither mandated nor well-staffed enough to deal with these issues Detailed placeholders need maintenance, causing overhead especially with inter-rir transfers!48

49 What changed? (I) Removed ASN authorisation requirement for route(6) Deprecated "mnt-routes:" attribute in aut-num Removed 'pending object creation' functionality for route creation!49

50 What changed? (II) Created new source RIPE-NONAUTH Moved all route(6) objects relating to non-ripe-managed address space to new source Moved all non-ripe managed aut-num objects to new source Disallowed creation of new aut-num/route(6) objects for non- RIPE-managed resources Removed mnt-routes:" from placeholder inet(6)num objects for non-ripe-managed address space!50

51 How to create route(6) objects You needed permission from: 1. inetnum or inet6num 2. route or route6 ALLOCATION route(6) 1 mnt-by: RIPE-NCC-HM-MNT mnt-by: DEFAULT-LIR-MNT origin: AS mnt-routes: ANOTHER-MNT mnt-by: ANOTHER-MNT!51

52 Registering IPv4 Routes inetnum: /22 mnt-by: mnt-by: TEST-NCC-HM-MNT SM30-MNT route: /22 origin: mnt-by: AS65530 SM30-MNT!52

53 Registering IPv6 Routes inet6num: 2002:ff30::/32 mnt-by: mnt-by: TEST-NCC-HM-MNT SM30-MNT route6: 2002:ff30::/32 origin: mnt-by: AS65530 SM30-MNT!53

54 References Out-of-Region ROUTE(6) and AUT-NUM Objects in the RIPE Database - Impact Analysis for NWI-5 Implementation Using RIPE-NCC- RPSL-MNT - implementation!54

55 Questions