Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia. 1 New Version of the RIPE Database Andrei Robachevsky RIPE NCC

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia. 2 Outline Current status of the RIPE Database New database software Migration timeline More information

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia. 3 RIPE Database Status Contains IP allocations/assignments Domain registry Routing registry 3.7 Million objects 80% person, 10% inetnum, 0.65% route 6,700 updates/day 770,000 queries/day (9 queries/s) 38% IP addresses, 1% IP prefixes

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia. 4 Distribution by object type (February 2001)

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia /sec Queries =~ 9/sec average

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia. 6 % of queries by object type (February 2001)

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia. 7 Updates 21/min -> 5/min

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia. 8 RIPE Database Whois service Database Consistency Project Routing Registry Consistency Check

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia. 9 What’s wrong with current version? It’s good old software, but... RIPE-181 for routing policy description Lack of IRR security Poor scalability Performance limits Hard to maintain

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia New version of the RIPE Database Supports RPSL (RFC2622) Extended syntax New objects and attributes Supports RPSS (RFC2725) New authorization rules Supports RAToolset RtConfig -protocol bird Code is completely rewritten

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia RPSL Support Extended syntax rules apply to all object types end of line comments line continuation order of attributes New objects as-set (as-macro), route-set (community) peering-set, filter-set, rtr-setpeering-set, filter-set, rtr-set New attributes member-of mbrs-by-ref person: Test Person Object source: TEST nic-hdl: TP-TEST # nic handle address: Nobody knows where he lives… + remarks: be prepared to parse one

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia RPSS support New object as-block New attributes mnt-routes: [ rpsl list of prefixes | ANY] referral-by: auth-override: YYYYMMDD New authorization rules route creation aut-num hierarchical names

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia RAToolset Support New queries -l -x -K RtConfig -protocol bird Patch is available to parse RIPE-style comments (%) ftp://ftp.ripe.net/ripe/dbase/software/RAToolSet/

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia New software Mainly in C, multithreaded RDBMS as a back-end MySQL, transaction support In-memory radix tree for IP lookups also more and less specific lookups for reverse delegation domains MIME and GPG support correct PGP keys are also accepted Automatic access control separate accounting for public and contact data

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia Server architecture RDBMS Core Server Update FE RDBMS Mirror Server NRTM clients Queue rules Message queues Syntax checks, acks, notifications queries

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia What’s different ? Extended object syntax Modified objects New attributes New objects New query flags person: Test Person Object source: TEST nic-hdl: TP-TEST # nic handle address: Nobody knows where he lives… + remarks: be prepared to parse one Modified objects: mntner route aut-num as-set (was: as-macro) route-set (was: community) inet-rtr inetnum New objects: as-block rtr-set peering-set filter-set New attributes: member-of mbrs-by-ref mnt-routes referral-by auth-override New query flags: -l -x -K -d -q sources [ ] -q version Access control: %ERROR:202: access control limit reached % You have reached the limit of returned contact information objects. % This connection will be terminated now. % Continued attempts to return excessive amounts of contact % information will result in permanent denial of service. New access control New database format New version of the mirroring protocol RDBMS (MySQL): CREATE TABLE mntner ( thread_id int(11) DEFAULT '0' NOT NULL, object_id int(10) unsigned DEFAULT '0' NOT NULL, mntner varchar(80) DEFAULT '' NOT NULL, dummy tinyint(4) DEFAULT '0' NOT NULL, PRIMARY KEY (object_id) ); New NRTM protocol: was: UPD = (ADD + DEL) will be: UPD = ADD

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia Who will be affected ? Query users new query flags Update users new syntax rules new authorization rules Scripts new object format and syntax new/modified objects and attributes access control NRTM clients new software new version of the mirroring protocol

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia Transition timeline - Updates Updates in RIPE-181 to Updates in RPSL to Updates in RPE-181 to RIPE181 RPSL Production Prototype/Compatibility TEST Updates in RIPE-181 to Updates in RPSL to Updates in RPSL to Updates in RPSL to Proposed dates: X=23 AprilY=14 MayZ=15 October

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia Transition timeline - Queries Querying RIPE DB in RIPE-181 at whois.ripe.net :43 Querying RIPE DB in RPSL at rpsl.ripe.net :43 Additional flags available Querying RIPE DB in RPSL at whois.ripe.net : 43 Additional flags available RIPE-181 v2.x RPSL v3.0 Production Prototype Proposed date: X=23 April

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia Transition timeline - NRTM Mirroring RIPE DB in RIPE-181 at whois.ripe.net :43 Mirroring RIPE DB in RPSL at rpsl.ripe.net :4444 Mirroring RIPE DB in RPSL at whois.ripe.net : 4444 RIPE181 v2.x RPSL v3.0 Production Prototype Proposed date: X=23 April

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia Project Status Version 3.0ß2 has been released Core server functionality is complete Infrastructure is under development Testing is in progress Portability issues are on our list Solaris, Linux, FreeBSD, UnixWare(?),... Thanks to everyone who helps make it more portable Special thanks to George Michaelson!

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia Prototype servers Near real-time mirror of the RIPE Database whois -h rpsl.ripe.net contains live RIPE Database in RPSL format Test server for submissions mail whois -h rpsl.ripe.net -p 4343 NRTM rpsl.ripe.net, port 4444 please contact

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia More Information RIPE-181 to RPSL Migration page Documentation Transition to the RIPE DB v3.0 Whois Queries in the RIPE DB v3.0 Updates in the RIPE DB v3.0 Error codes in the RIPE DB v3.0 Software New whois client ftp://ftp.ripe.net/ripe/dbase/reimp/whoisRIP-1.0.tar.gz Server software v3.0

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia Questions?

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia New Version of the RIPE Database Andrei Robachevsky RIPE NCC

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia New objects peering-set filter-set rtr-set as-block

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia New attributes RPSL: member-of, mbrs-by-ref RPS-auth: mnt-routes: [ rpsl list of prefixes | ANY] referral-by: auth-override: YYYYMMDD

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia Modifications to all objects Line continuation Attribute order is relevant Support for end of line comments Handling of empty attributes Legend: holes: [optional] [multiple] automatically translated member-of: [optional] [multiple] new cross-nfy: [optional] [multiple] preserved community: [optional] [multiple] deprecated

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia Modified objects mntner object mntner: [mandatory] [single] [primary/look-up key] descr: [mandatory] [multiple] [ ] admin-c: [mandatory] [multiple] [inverse key] tech-c: [optional] [multiple] [inverse key] upd-to: [mandatory] [multiple] [inverse key] mnt-nfy: [optional] [multiple] [inverse key] auth: [mandatory] [multiple] [ ] remarks: [optional] [multiple] [ ] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] auth-override: [optional] [single] [ ] *** RPS auth *** referral-by: [mandatory] [single] [inverse key] *** RPS auth *** changed: [mandatory] [multiple] [ ] source: [mandatory] [single] [ ]

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia Modified objects route object route: [mandatory] [single] [primary/look-up key] descr: [mandatory] [multiple] [ ] origin: [mandatory] [single] [primary/inverse key] holes: [optional] [multiple] [ ] *** hole in RIPE 181 *** withdrawn: [optional] [single] [ ] comm-list: [optional] [multiple] [ ] advisory: [optional] [multiple] [ ] member-of: [optional] [multiple] [inverse key] *** RPSL *** inject: [optional] [multiple] [ ] *** RPSL *** aggr-mtd: [optional] [single] [ ] *** RPSL *** aggr-bndry: [optional] [single] [ ] *** RPSL *** export-comps:[optional] [single] [ ] *** RPSL *** components: [optional] [single] [ ] *** RPSL *** cross-nfy: [optional] [multiple] [inverse key] community: [optional] [multiple] [ ] mnt-lower: [optional] [multiple] [inverse key] *** RPS auth *** mnt-routes: [optional] [multiple] [inverse key] *** RPS auth *** mnt-by: [mandatory] [multiple] [inverse key] changed: [mandatory] [multiple] [ ] source: [mandatory] [single] [ ]

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia Modified objects autnum object aut-num: [mandatory] [single] [primary/look-up key] as-name: [mandatory] [single] descr: [mandatory] [multiple] as-in: [optional] [multiple] [ ] as-out: [optional] [multiple] [ ] interas-in: [optional] [multiple] [ ] interas-out: [optional] [multiple] [ ] as-exclude: [optional] [multiple] [ ] member-of: [optional] [multiple] [inverse key] *** New in RPSL *** import: [optional] [multiple] *** as-in in RIPE 181 *** export: [optional] [multiple] *** as-out in RIPE 181 *** default: [optional] [multiple] remarks: [optional] [multiple] admin-c: [mandatory] [multiple] [inverse key] tech-c: [mandatory] [multiple] [inverse key] cross-mnt: [optional] [multiple] [inverse key] cross-nfy: [optional] [multiple] [inverse key] notify: [optional] [multiple] [inverse key] mnt-lower: [optional] [multiple] [inverse key] *** RPS auth *** mnt-routes: [optional] [multiple] [inverse key] *** RPS auth *** mnt-by: [mandatory] [multiple] [inverse key] changed: [mandatory] [multiple] source: [mandatory] [single]

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia Modified objects as-set (previously as- macro) as-set: [mandatory] [single] [primary/look-up key] *** as-macro in RIPE 181 *** descr: [mandatory] [multiple] members: [optional] [multiple] *** as-list in RIPE 181 *** mbrs-by-ref: [optional] [multiple] [inverse key] *** New in RPSL *** remarks: [optional] [multiple] tech-c: [mandatory] [multiple] [inverse key] admin-c: [mandatory] [multiple] [inverse key] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] changed: [mandatory] [multiple] source: [mandatory] [single]

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia Modified objects route-set (previously community) route-set: [mandatory] [single] [primary/look-up key] *** community in RIPE 181 *** descr: [mandatory] [multiple] members: [optional] [multiple] *** New in RPSL *** mbrs-by-ref: [optional] [multiple] [inverse key] *** New in RPSL *** remarks: [optional] [multiple] tech-c: [mandatory] [multiple] [inverse key] admin-c: [mandatory] [multiple] [inverse key] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] changed: [mandatory] [multiple] source: [mandatory] [single]

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia Modified objects inet-rtr inet-rtr: [mandatory] [single] [primary/look-up key] descr: [mandatory] [multiple] alias: [optional] [multiple] *** New in RPSL *** local-as: [mandatory] [single] [inverse key] *** localas in RIPE 181 *** ifaddr: [mandatory] [multiple] [look-up key] peer: [optional] [multiple] member-of: [optional] [multiple] [inverse key] *** New in RPSL *** remarks: [optional] [multiple] admin-c: [mandatory] [multiple] [inverse key] tech-c: [mandatory] [multiple] [inverse key] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] changed: [mandatory] [multiple] source: [mandatory] [single]

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia Modified objects inetnum inetnum: [mandatory] [single] [primary/look-up key] netname: [mandatory] [single] [lookup key] descr: [mandatory] [multiple] [ ] country: [mandatory] [multiple] [ ] admin-c: [mandatory] [multiple] [inverse key] tech-c: [mandatory] [multiple] [inverse key] rev-srv: [optional] [multiple] [inverse key] status: [generated] [single] [ ] remarks: [optional] [multiple] [ ] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] mnt-lower: [optional] [multiple] [inverse key] mnt-routes: [optional] [single] [inverse key] *** RPS auth *** changed: [mandatory] [multiple] [ ] source: [mandatory] [single] [ ]

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia New object: peering-set Peering-set peering-set: [mandatory] [single] [primary/look-up key] descr: [mandatory] [multiple] peering: [mandatory] [multiple] remarks: [optional] [multiple] tech-c: [mandatory] [multiple] [inverse key] admin-c: [mandatory] [multiple] [inverse key] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] changed: [mandatory] [multiple] source: [mandatory] [single] <=

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia New object: filter-set defines a set of routes that are matched by its filter filter-set: [mandatory] [single] [primary/look-up key] descr: [mandatory] [multiple] filter: [mandatory] [single] remarks: [optional] [multiple] tech-c: [mandatory] [multiple] [inverse key] admin-c: [mandatory] [multiple] [inverse key] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] changed: [mandatory] [multiple] source: [mandatory] [single] <=

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia New object: rtr-set defines a set of routers specified by inet-rtr names, ipv4_addresses or other rtr-set names rtr-set: [mandatory] [single] [primary/look-up key] descr: [mandatory] [multiple] members: [optional] [multiple] mbrs-by-ref: [optional] [multiple] remarks: [optional] [multiple] tech-c: [mandatory] [multiple] [inverse key] admin-c: [mandatory] [multiple] [inverse key] notify: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] changed: [mandatory] [multiple] source: [mandatory] [single] <=

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia New object: as-block Defines a range of AS numbers delegated to a given repository as-block: [mandatory] [single] [primary/look-up key] descr: [optional] [multiple] remarks: [optional] [multiple] tech-c: [mandatory] [multiple] [inverse key] admin-c: [mandatory] [multiple] [inverse key] notify: [optional] [multiple] [inverse key] mnt-lower: [optional] [multiple] [inverse key] mnt-by: [mandatory] [multiple] [inverse key] changed: [mandatory] [multiple] source: [mandatory] [single] <=

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia Queries New queries -l -x -K -d -q sources [ ] -q version Inverse queries Other differences

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia l One level less specific Does not return the exact match Returns the smallest IP range that is bigger than the supplied range and that fully contains it whois -r -Tin /23 whois -r -Tin -l /23 whois -r -Tin -L /23

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia x Exact match If no matching object is found nothing is returned whois -r -Tin /24 whois -r -Tin -x /24

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia K Only primary keys are returned Exception is a set object, where the members attribute is also returned Does not apply to person and role objects whois -Trt -K -M /16 whois -K -imo RS-HEPNET whois -K AS-WORLD

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia d (proposed) Triggers inclusion of in-addr.arpa and ip6.int domain objects in the result of IP lookup More/less specific lookups are possible whois -r -d whois -d -Tdn -K -M /20

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia Accounting and Access Control Access to “public” and “contact” data is accounted differently Is based on number of objects returned limit = f(max_limit1, query_rate) when limit is hit - the query is aborted and limit =0 limit recovers in time # of times the limit may be hit before permanent denial Trusted proxies: accounting is based on client’s IP

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia Authorization of route creation route: /16 mnt-by: M2-MNT... inetnum: mnt-by: M1-MNT... aut-num: AS65000 mnt-by: M3-MNT... route: /24 origin: AS65000 mnt-by: M4-MNT... mntner: M1-MNT auth:... mntner: M3-MNT auth:... mntner: M2-MNT auth:... mntner: M4-MNT auth:...

Andrei Robachevsky. APNIC/APRICOT2001, February 2001, Kuala Lumpur, Malaysia Membership of set objects route-set: RS-FOO mbrs-by-ref: MNT-FOOBAR... route: /22 origin: AS3333 member-of: RS-FOO mnt-by: MNT-FOOBAR... route: /24 origin: AS3333 member-of: RS-FOO mnt-by: OTHER-MNT... as-set: AS-BAR members: AS3333 mbrs-by-ref: MNT-FOOBAR... aut-num: AS aut-num: AS3267 member-of: AS-BAR mnt-by: MNT-FOOBAR...