A Happy Story ofInter-RIR Transfer
of Legacy Blocks
from ARIN to RIPE
2016.04.03

Randy Bush <randy@psg.com>
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.01

Legacy at ARIN
• A legal mess; no lawyer will let one signthe LRSA
• You are not a second class citizen; youare not a citizen; you have no rights• The policy community was been captured
by Trump’s Tea Party over a decade ago• But the HostFolk etc. are great; trying
to keep the net running despite2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.0

2

RIPE is Legacy Friendly• A few years back, Legacy and PI policies
were rationalized• One can be a Legacy Member and lose norights in one’s address space• Or you can be sponsored by a friendly
LIR and lose no rights• In either case, you pay and you get allservices, DNS, IRR, RPKI, …
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.0

3

RGnet’s Case
• RGnet had four legacy blocks in theARIN region from before dirt wasinvented• I have been working on RPKI for way too
long and wanted RPKI service• RGnet also does a bit of infrastructurein the RIPE region• One of my $dayjobs is a RIPE member
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.0

4What the Heck
• So it seemed to make sense for RGnet
to have a go at transferring the four
blocks from ARIN to RIPE
• The thought of the bureaucracies wasdaunting• But their processes seemed documented• And, as I was raised by five women, I
can follow orders
2016.04.03 Inter-RIR XferCreative Commons: Attribution-NonCommerci al-Shar eAlike 2.0

5January 26• A kind and patient
RIPE hostmaster
explains I mustfirst fill out theARIN transferrequest• Log in and it’s on
the front page!
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.0

6ARIN loves online forms
I will not bore you withthe details
Policy Hole: You can nottransfer ASNs!
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.07

ARIN Bureaucracy• The web silliness eventually yielded aform letter I had to fill out, sign, etc.
and ‘Notarize,’ a strange American
custom certifying my signature• We have no such thing in Japan• So I agreed with ARIN to give them theproperly done form at NANOG
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.08February 10• I paid ARIN US$500 for the process• I give the form to ARIN HostFolk at
NANOG in San Diego• Their corporate jet was already in use
for political junkets, so it would wait
until the poor HostFolk flew home on acommercial carrier
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.0

9February 19• RIPE HostPerson tells me that ”We havebeen notified by ARIN for the interRIR transfer request …”• Asks me to• Confirm that I want to recive this transfer• Tell of infrastructure in RIPE region• Decide: Become a Member, use a Sponsoring
LIR, ...
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.010

Eurocracy, of Course• I also had to send RGnet LLC’s proof ofexistence• The Legacy Agreement with a Sponsoring
LIR• Utilization plan for the address space• I was teaching a security workshop inAuckland, so did not get this stuff done
until February 26
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.0

11Then the Sponsoring
LIR went on a Ski
Holiday
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.0

12March 11• Sponsoring LIR returns from skiing• We sign the agreement• And send it to RIPE
• Who notes I forgot to list theresources and offers to fix this• We say “Yes, please.”• And RIPE starts to process• But it’s a weekend
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.0

13March 15• RIPE says I need to “Create anOrganisation object for RGnet, LLC
and let me know the Org-id.”• And, for each net block, specify

2016.04.03 Inter-RIR Xfer•

netname:•admin-c:•tech-c:•Country:
Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.0

14March 16• I had not used the RIPE database since1948• I had a maintainer ID and existingobjects in the database• So I played Adventure in
https://apps.db.ripe.net/• And cleaned most old objects up• And created an Organisation: object
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.0

15

YAY!
organisation:org-name:
org-type:
descr:
address:
address:
address:e-mail:admin-c:tech-c:abuse-mailbox:
ref-nfy:mnt-ref:
notify:mnt-by:created:last-modified:source:2016.04.03 Inter-RIR Xfer

ORG-RG79-RIPE
RGnet, LLC
OTHER
RGnet Legacy Holder
5147 Crystal Springs
Bainbridge Island, WA 98110
United States
randy@psg.com
RB366-ARIN
RB366-ARIN
blackhole@bogus.com
randy@psg.com
MAINT-RGNET
randy@psg.com
MAINT-RGNET
2016-03-15T13:41:51Z
2016-03-15T13:41:51Z
RIPE

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.0

16

My Person: Object
person:address:
address:
address:
address:
phone:
fax-no:e-mail:nic-hdl:
abuse-mailbox:
notify:mnt-by:created:last-modified:source:Randy Bush
RGnet, LLC
5147 Crystal Springs
Bainbridge Island, WA 98110
United States+1 330 887 2874
+1 206 973 2762
randy@psg.com
RB366-ARIN
blackhole@bogus.com
rw@rg.net
MAINT-RGNET
1970-01-01T00:00:00Z
2016-03-17T09:55:18Z
RIPE

See my 2000 rant at https://archive.psg.com/ 000914.ripe-whois.pdf
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.0

17There was more RIPE
DataBase Cruft,
but You Don’t
Want to Know
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.0

18March 16 Continued• “We have scheduled with ARIN toprocess this Inter-RIR transfer andupdate our registries this afternoon (atapprox. 17:00 CET or GMT+1).”• So hack and go home, eh? At least it
was not Friday. J• But the reverse DNS was gonna be aproblem, of course
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.0

19DNS Transfer Gl!tch• ARIN had to delete their reverse DNS
delegations to me• To get RIPE to delegate required me tocreate domain: objects• Which I could not do until RIPE had
received the transfer and created theinetnum: objects• Then RIPE’s system had to get ARIN’ssystem to delegate to RIPE DNS
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.020

I got up in the middleof my night and createddomain: objects
domain:descr:
admin-c:tech-c:zone-c:nserver:
nserver:
mnt-by:source:2016.04.03 Inter-RIR Xfer

230.83.192.in-addr.arpa
RG79-192-83-230
RB366-ARIN
RB366-ARIN
RB366-ARIN
rip.psg.com
nlns.globnix.net
MAINT-RGNET
RIPECreative Commons: Attribution-NonCommerci al-Shar eAlike 2.0

21The 18 Minute Gap J• This is a complex process with step bystep checks for safety• So there was a gap of a few hours wherereverse DNS did not work
• Luckily these are research networks
with no paying customers• I go back to sleep and wake in themorning to find everything is OK!
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.0

22Of course Heas noticed
the DNS gap andsent a surly emailJ
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.023Six Weeks
Could’a Been Two/Three
No Real Pain
Lots’o Help
Fantastic HostFolk
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.024

With Thanks and Amazement• ARIN HostFolk who patiently helped methrough their bureaucracy• An amazing RIPE HostPerson who notonly helped me through the RIPE NCC
bureaucracy, but gave me step by step
instructions for dummies, which I needed• And the RIPE and ARIN communities who
made Inter-RIR transfer workable
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.025

No one will get annoyed with me foroverly helping someone from ourcommunity (a legacy holder in this case).
In fact we are encouraged to do so (aslong as it’s within the boundaries of ourfunction). The mentality in Registration
Services dept. is “if you can take anextra step to help someone then takeit” ;)2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.026

And now on to the RPKI
part of the project
Putting up a CA as achild of RIPE’s CA
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.027

I UsedDragon Research Labs
CA and Relying PartySoftware
https://trac.rpki.net/wiki/doc/RPKI/
RRDPtestbed2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.028

XML Upgrade• RIPE is running old XML and will moveslowly to the new Internet-Draft so as
not to break things• Dragon Research software moved ahead• So, when doing the identity set-up, one
has to translate once, child to RIPE andonce RIPE to child2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.029

First, you need xsltproc# apt-get install xsltproc
Then get the translator# wget http://subvert-rpki.hactrn.net/branches/
tk705/potpourri/oob-translate.xsl

Then you can convert# xsltproc oob-translate.xsl RGnetCA.identity.xml> RGnetCA.identity-old.xml

and upload it to your parent's server.
In return, you should fetch your parent's identity. In RIPE's case, the gui hasa link
https://localcert.ripe.net/api/rpki/issuer-identity

As the xml crossed the ripe/local xml version boundary, you need to translate
the ripe identity into the new xml format and feed this to your GUI or torpkic# xsltproc -o ripe-identity-new.xml oob-translate.xsl
issuer-identity-20160323.xml ca.rg.net:/root/foo# rpkic configure_parent ripe-identity-new.xml
Parent calls itself 'e17841a7-8582-4832-ab81-8644b3d41dba',
we call it 'e17841a7-8582-4832-ab81-8644b3d41dba'
Parent calls us 'a5b39a7d-2629-496b-8806-86270050d53a'
Wrote /root/foo/RGnetCA.e17841a7-8582-4832-ab818644b3d41dba.repository-request.xml
This is the file to send to the repository operator2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommercial-ShareAlike 2.030

umask & uid Pain
• Dumped MYSQL, and Postgres uses uids
• CLI interface, rpkic, does not run as root
• The current directory might not be ownedby rpki:rpki• So it would create files it then could notread etc.
• Code was hacked to switch in and out ofrpki:rpki when reading or creating files
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.031

TLS Problem
Old Debian and Ubuntu releases runversions of Python old enough that thePython "ssl" module in those versions
doesn't support the TLS 1.2 cipher suites,
resulting in a TLS negotiation failure
trying to talk to RIPE NCC's RRDP server.
I gave up and went to Xenial, Ubuntu
16.04 Beta-2
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.032

TLS 1.2 Test
$ objdump -T `python -c 'import ssl;
print ssl._ssl.__file__'` | fgrep _method
0000000000000000

DF *UND*

0000000000000000

OPENSSL_1.0.1 TLSv1_1_method

0000000000000000

DF *UND*0000000000000000

OPENSSL_1.0.0 SSLv23_method

0000000000000000

DF *UND*0000000000000000

OPENSSL_1.0.0 TLSv1_method

0000000000000000

DF *UND*0000000000000000

OPENSSL_1.0.1 TLSv1_2_method

All the happy platforms run Python 2.7.11,
while Debian Wheezy runs 2.7.3 and Ubuntu
Trusty runs 2.7.6.
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.033

Xenial• It is pre-release• So the daily dist-upgrade from hell
• And it has openssh 7, which has abunch of changes• Hash and key length upgrades may
bite you2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.034

Lets Encrypt and Dane
• Let’s Encrypt is a bit of a PITA
• https://wiki.rg.net/wiki/AcmeTinyUbuntu• But heck, it is breaking the CA cartel• DANE is another anti-cartel path
• I like to do both, and DANE is much easier• Just a CNAME pointing to a TLSA RR for a
LetsEncrypt certificate chain
2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.035

And the Result2016.04.03 Inter-RIR XferCreative Commons: Attribution-NonCommerci al-Shar eAlike 2.036

It’s Documented
I try to wiki as much as possible
https://trac.rpki.net/wiki/doc/RPKI/RRDPtestbed

And these slides are online as
https://archive.psg.com/160403.pdf

2016.04.03 Inter-RIR Xfer

Creative Commons: Attribution-NonCommerci al-Shar eAlike 2.037