MyNOG 8: Next Generation Internet Number Registry Services
1 like425 views
The document provides an overview of internet registry services, focusing on the Registration Data Access Protocol (RDAP) and Resource Public Key Infrastructure (RPKI). RDAP offers a modernized approach to accessing registration data compared to the traditional WHOIS protocol, facilitating automation and enhanced internationalization, while RPKI is designed to secure BGP routing by cryptographically verifying ownership of internet resources. Together, these technologies aim to improve data access, security, and the management of internet resources.
![RDAP JSON raw
14
$ curl https://rdap.apnic.net/ip/103.214.196.0
{"rdapConformance":["history_version_0","rdap_level_0"],"notices":[{"title":"Source","description":["Objects
returned came from source","APNIC"]},{"title":"Terms and Conditions","description":["This is the APNIC WHOIS
Database query service. The objects are in RDAP
format."],"links":[{"value":"https://rdap.apnic.net/ip/103.214.196.0","rel":"terms-of-
service","href":"http://www.apnic.net/db/dbcopyright.html","type":"text/html"}]}],"country":"MY","events":[{"even
tAction":"last changed","eventDate":"2017-08-29T23:07:41Z"}],"name":"MYIX-
MY","remarks":[{"description":["Persatuan Pengendali Internet Malaysia (MyIX)","Malaysian Communications and
Multimedia Commission","Off Persiaran Multimedia"],"title":"description"},{"description":["----------------------
----------------------------------","To report network abuse, please contact mnt-irt","For troubleshooting,
please contact tech-c and admin-c","Report invalid contact via www.apnic.net/invalidcontact","-------------------
-------------------------------------"],"title":"remarks"}],"type":"ASSIGNED
PORTABLE","ipVersion":"v4","startAddress":"103.214.196.0","endAddress":"103.214.199.255","objectClassName":"ip
network","links":[{"value":"https://rdap.apnic.net/ip/103.214.196.0","rel":"self","href":"https://rdap.apnic.net/
ip/103.214.196.0/22","type":"application/rdap+json"}],"handle":"103.214.196.0 -
103.214.199.255","entities":[{"roles":["administrative","technical"],"events":[{"eventAction":"last
changed","eventDate":"2010-10-
19T04:42:12Z"}],"vcardArray":["vcard",[["version",{},"text","4.0"],["fn",{},"text","PERSATUAN PENGENDALI INTERNET
MALAYSIA MYIX - Op"],["kind",{},"text","group"],["adr",{"label":"Malaysian Communications and Multimedia
Commission, Off Persiaran Multimedia,"},"text",["","","","","","",""]],["tel",{"type":"voice"},"text","+60-
123718029"],["email",{},"text","raja.mohan@myix.gov.my"]]],"objectClassName":"entity","links":[{"value":"https://
rdap.apnic.net/ip/103.214.196.0","rel":"self","href":"https://rdap.apnic.net/entity/PPIM1-
AP","type":"application/rdap+json"}],"handle":"PPIM1-AP"},{"roles":["abuse"],"events":[{"eventAction":"last
changed","eventDate":"2018-04-
15T10:27:19Z"}],"vcardArray":["vcard",[["version",{},"text","4.0"],["fn",{},"text","IRT-MYIX-
MY"],["kind",{},"text","group"],["adr",{"label":"Persatuan Pengendali Internet
Malaysia"},"text",["","","","","","",""]],["email",{},"text","raja.mohan@myix.my"],["email",{"pref":"1"},"text","
raja.mohan@myix.my"]]],"objectClassName":"entity","links":[{"value":"https://rdap.apnic.net/ip/103.214.196.0","re
l":"self","href":"https://rdap.apnic.net/entity/IRT-MYIX-MY","type":"application/rdap+json"}],"handle":"IRT-MYIX-
MY"}],"port43":"whois.apnic.net"}
HTTP “get”
JSON format](https://image.slidesharecdn.com/sanjaya-next-generation-registry-190704083520-190715214815/85/MyNOG-8-Next-Generation-Internet-Number-Registry-Services-14-320.jpg)
MyNOG 8: Next Generation Internet Number Registry Services
- 1. 1 Internet Number Registry Services the Next Generation RDAP and RPKI
- 2. Overview • What are registry services • Today’s registry services • Registration Data Access Protocol (RDAP) • Resource Public Key Infrastructure (RPKI)
- 3. What are registries • Organizations running registry services ⎯ With authority for registration of some “Public Resource” • Public databases describing status of resources ⎯ Land titles, vehicle registrations, phone numbers ⎯ Domain Names ⎯ Internet Number Resources (INRs) – IPv4, IPv6, ASN • Internet address Registries ⎯ RIRs, NIRs, LIRs ⎯ Authoritative registry/database function ⎯ Public registry service function
- 4. APNIC registry services • whois ⎯ Query service on TCP port 43 (RFC 812, 1982) ⎯ Public registry lookup service ⎯ Very simple, limited service ⎯ Query and response are not standardised • Registration Data Access Protocol (RDAP) (NEW since 2015) ⎯ API for access to “whois” registry data ⎯ Automation, AAA, i18N, redirection, extensibility • Resource Public Key Infrastructure (RPKI) (since 2010) ⎯ PKI for INRs ⎯ Cryptographically verifiable “ownership” of INRs ⎯ Mechanism for authorisation to route IPv4/v6 blocks
- 5. 5 whois
- 6. CLI web UI RPSL whois at APNIC 6 whois port 43registry database
- 7. whois command line 7 Query to port 43 RPSL response
- 8. whois www interface 8 HTML wrapper Same RPSL response
- 9. Whois – limitations • “blob” query and result formats ⎯ Registry-specific queries and responses ⎯ Automation is difficult • No authentication/authorization/accounting model ⎯ Built for public service only • Most servers serve US-ASCII only ⎯ i18n is undefined • No redirection ⎯ User/client must find the right server 9
- 10. 10 RDAP Registration Data Access Protocol
- 11. RDAP • RDAP is the successor to the ageing WHOIS protocol. • Like WHOIS, RDAP provides… ⎯ Access to registration data: domain names, AS numbers, and IP address • Unlike WHOIS, RDAP provides… ⎯ Structured request and response semantics; ⎯ Differentiated access; ⎯ Internationalisation; ⎯ Redirection; ⎯ Extensibility.* * Source: RDAP.org
- 12. RDAP: designed for automation • Query: REST ⎯ REpresentational State Transfer - via HTTP ⎯ Inherits many useful features from HTTP/HTTPS ⎯ Query defined within URL issued to RESTful server example: https://rdap.apnic.net/ip/2001:dc0:2001:11::194 • Response: JSON ⎯ JavaScript Object Notation ⎯ Standardised text representation of structured data ⎯ Translates directly into data types in modern programming languages like JavaScript/HTML5, Java, Perl, Python, Ruby
- 13. RDAP 13 registry database port 80 / 443RDAP web client whowas VizAS … whois port 43 JSON
- 14. RDAP JSON raw 14 $ curl https://rdap.apnic.net/ip/103.214.196.0 {"rdapConformance":["history_version_0","rdap_level_0"],"notices":[{"title":"Source","description":["Objects returned came from source","APNIC"]},{"title":"Terms and Conditions","description":["This is the APNIC WHOIS Database query service. The objects are in RDAP format."],"links":[{"value":"https://rdap.apnic.net/ip/103.214.196.0","rel":"terms-of- service","href":"http://www.apnic.net/db/dbcopyright.html","type":"text/html"}]}],"country":"MY","events":[{"even tAction":"last changed","eventDate":"2017-08-29T23:07:41Z"}],"name":"MYIX- MY","remarks":[{"description":["Persatuan Pengendali Internet Malaysia (MyIX)","Malaysian Communications and Multimedia Commission","Off Persiaran Multimedia"],"title":"description"},{"description":["---------------------- ----------------------------------","To report network abuse, please contact mnt-irt","For troubleshooting, please contact tech-c and admin-c","Report invalid contact via www.apnic.net/invalidcontact","------------------- -------------------------------------"],"title":"remarks"}],"type":"ASSIGNED PORTABLE","ipVersion":"v4","startAddress":"103.214.196.0","endAddress":"103.214.199.255","objectClassName":"ip network","links":[{"value":"https://rdap.apnic.net/ip/103.214.196.0","rel":"self","href":"https://rdap.apnic.net/ ip/103.214.196.0/22","type":"application/rdap+json"}],"handle":"103.214.196.0 - 103.214.199.255","entities":[{"roles":["administrative","technical"],"events":[{"eventAction":"last changed","eventDate":"2010-10- 19T04:42:12Z"}],"vcardArray":["vcard",[["version",{},"text","4.0"],["fn",{},"text","PERSATUAN PENGENDALI INTERNET MALAYSIA MYIX - Op"],["kind",{},"text","group"],["adr",{"label":"Malaysian Communications and Multimedia Commission, Off Persiaran Multimedia,"},"text",["","","","","","",""]],["tel",{"type":"voice"},"text","+60- 123718029"],["email",{},"text","raja.mohan@myix.gov.my"]]],"objectClassName":"entity","links":[{"value":"https:// rdap.apnic.net/ip/103.214.196.0","rel":"self","href":"https://rdap.apnic.net/entity/PPIM1- AP","type":"application/rdap+json"}],"handle":"PPIM1-AP"},{"roles":["abuse"],"events":[{"eventAction":"last changed","eventDate":"2018-04- 15T10:27:19Z"}],"vcardArray":["vcard",[["version",{},"text","4.0"],["fn",{},"text","IRT-MYIX- MY"],["kind",{},"text","group"],["adr",{"label":"Persatuan Pengendali Internet Malaysia"},"text",["","","","","","",""]],["email",{},"text","raja.mohan@myix.my"],["email",{"pref":"1"},"text"," raja.mohan@myix.my"]]],"objectClassName":"entity","links":[{"value":"https://rdap.apnic.net/ip/103.214.196.0","re l":"self","href":"https://rdap.apnic.net/entity/IRT-MYIX-MY","type":"application/rdap+json"}],"handle":"IRT-MYIX- MY"}],"port43":"whois.apnic.net"} HTTP “get” JSON format
- 15. RDAP JSON formatted 15 Browser with json plugin Structured result
- 16. RDAP client Web-based client Processed result https://rdap-web.apnic.net
- 17. RDAP access control • REST allows for service differentiation ⎯ General public vs authorised access ⎯ Public vs privileged information ⎯ Rate limiting etc. • Implemented using standard web authentication ⎯ HTTP 1.1 “basic” and “digest” forms ⎯ TLS with server/client certification ⎯ OAuth, OpenID under development in IETF draft process
- 18. RDAP internationalization • RDAP content is UTF-8 encoded UNICODE • Roles and contact information ⎯ Defined using vCard RFC6868 (updated from 1998 RFC2425) ⎯ Widely understood for contact information, mail systems ⎯ Allows alternates, order preferences, language and character set • Normally RDAP fetches all encodings ⎯ Client gets to pick preference ⎯ But server could use client “language hint” via HTTP
- 19. RDAP query redirection • RDAP uses HTTP mechanism to redirect ⎯ “302 redirect temporary” points to temporary URL for this query ⎯ In case query is for resource that server knows is held elsewhere • Globally coordinated redirection ⎯ IANA registry of all delegations in RDAP with base URL • Result: RDAP can find “most specific” registry ⎯ No more “this record has moved” responses!
- 20. RDAP extensibility • OAuth/OpenID under development ⎯ Federated identity model, well supported in public Internet • RDAP History (APNIC) ⎯ Time sequenced set of records, to denote changes across time in RDAP information ⎯ Basis of the APNIC “WHOWAS” service ⎯ Currently being promoted in standards at IETF
- 24. RDAP benefits • Automation – JSON input to common programming languages ⎯ Integration with firewall, NMS, IPAM… • “Differentiated Access” ⎯ If needed • Speaks your language (and character set) ⎯ Can implement server-side or in-client language preference • One stop query ⎯ Will auto-redirect to the right authoritative server • Web protocol is CDN friendly ⎯ Serve local, via anycast or DNS redirection methods ⎯ Cacheable, survives DDoS longer since distributed
- 25. RDAP specifications • RFC 7480 – HTTP Usage in RDAP • RFC 7481 – Security Services for RDAP • RFC 7482 – RDAP Query Format • RFC 7483 – JSON Responses for RDAP • RFC 7484 – Finding the Authoritative RDAP Service • RFC 7485 – Inventory and Analysis of WHOIS Objects
- 26. APNIC RDAP Status • First implemented May 2015 ⎯ Adjunct service query to WHOIS radix tree (in memory) ⎯ Rewrote RPSL on-the-fly • Re-implemented into WHOWAS Late 2016 ⎯ Static in-memory data model. Fast response • Working with NIRs ⎯ Hope to serve <nir>.rdap.apnic.net more-specific service • APNIC region-wide consistent service model goal for 2019 ⎯ Working with NIRs and other RIRs
- 27. 27 RPKI Resource Public Key Infrastructure 29 RPKI Resource Public Key Infrastructure
- 28. RPKI • RPKI is a public key infrastructure (PKI) framework, originally designed to secure BGP routing ⎯ Based on X.509 PKI standards • RPKI adds INR information to X.509 certificates issued to resource holders ⎯ Representing INR custodianship and other status ⎯ Certification hierarchy follows INR delegation hierarchy IANA ➔ RIR ➔ NIR ➔ ISP ➔ …
- 29. RPKI hierarchy ISP EE ISP EE ISP EE ISP EE IANA CA APNIC CA LACNIC CA RIPE- NCC CA ARIN CA AFRINIC CA
- 30. RPKI certificates • Resource certificates ⎯ Extension of standard X.509 certificates ⎯ Providing authority to use given IPv4/6 and ASN resources ⎯ Signed by issuing registry (serving as CA) The holder of the private key that pairs with the public key on the certificate is the authorised holder of the IPv4/6 range and ASN listed in the certificate
- 31. RPKI applications • Route Origin Validation (ROV) ⎯ Validation of Route Origin Authorisations (ROA) to make BGP routing decisions • RTA ⎯ Allows an arbitrary digital object to be signed by the holder of the IP address/ASN mentioned in the digital object, using RPKI • Other future applications 31
- 33. RPKI application: ROV • Route Origin Validation AS17821 Announce: 203.176.32.0/19 Peer ?
- 34. ROA • Route Origin Authorization (ROA) ⎯ Giving an ASN authority to route specific IP blocks ⎯ Contains a list of prefixes with ASN authorized to announce ⎯ Signed by IP resource holder • RPKI validates the integrity of the ROA ⎯ It is provably created by the holder of the prefix ⎯ Can now be used to construct route filters for prefix-OriginAS pair in BGP 34 Prefix 203.176.32.0/1 9 Max-length /24 Origin ASN AS17821
- 35. RPKI Validator • Gathers and validates ROAs from the distributed RPKI databases ⎯ Using rsync or RRDP (preferable) ⎯ Maintains a validated cache representing complete global state • Can then perform ROV for routers using RPKI-Router (RTR) protocol rpki.apnic.net IANA APNIC RIPE ISP ISP rsync RRDP Validated cache Validator
- 36. ROV at Border Routers ISP Validated cache Validator RPKI-to-Router (RTR)
- 37. ROV at IXP Validated cache Validator RPKI-to-Router (RTR) Routes Tagged/filtered routes Route Server
- 38. Route validation states • Not Found (Unknown) ⎯ No ROA found, probably not created yet ⎯ This will be “default” for some time • Valid ⎯ ROA exists ⎯ Prefix, Origin ASN and prefix-length match those found in validated cache • Invalid ⎯ ROA exists ⎯ Prefix found, but Origin ASN is wrong, Prefix-length longer than Max-length, or certificates are expired or otherwise invalid. ⎯ Some action needed
- 39. Action for invalid routes • For inbound routes from upstreams/peers ⎯ Drop them ⎯ Give them lower LOCAL_PREF ⎯ Do nothing (not recommended) • For outbound routes to customers ⎯ Tag them before re-distributing them to customers ⎯ Allow customers to make their own choices • Tagging (eg at IXPs) ⎯ Apply community tags based on the validation state § Not Found (ASN:65XX1) § Valid (ASN:65XX2) § Invalid (ASN:65XX3)
- 40. RPKI application: RTA • Take existing “letter of authority” practice ⎯ Typically a scanned/signed PDF under company letterhead ⎯ Unverifiable without more information • Generate “detached signature” using RPKI ⎯ Signing certificate contains IP address range listed in the letter of authority document ⎯ This is now a cryptographically verifiable letter of authority • Pilot implementation ⎯ In development at APNIC (via MyAPNIC) ⎯ IETF draft in progress
- 41. RPKI benefits • Improved in-band verification of resource custodianship ⎯ Much safer than manually checking whois or IRR database ⎯ Ease of automation • Secure Origin is the first step to preventing many attacks on BGP integrity ⎯ BGP Path remains a problem which is under development ⎯ Related information such as IRR Policy can now leverage strong proofs of validity (end the maintainer-authority problem in RADB/IRR) • Instruction/information from the resource custodian can be cryptographically verified (e.g. LOA signing)
- 42. RPKI specifications • RFC3779 X. 509 Extensions for IP Addresses and AS Identifiers • RFC6480 Infrastructure to support secure routing • RFC6481 Profile for repository structure • RFC6482 Profile for Route Origin Authorisation (ROA) • RFC6483 Validation model • RFC6484 Certificate Policy (CP) for RPKI • RFC6485 Algorithms & Key sizes for RPKI • RFC6486 Manifests for repositories in RPKI • RFC6487 Profile for RPKI Certificates • RFC6488 Signed object CMS template • RFC6489 Key Rollover • RFC6490 Trust Anchor Locator (TAL) • RFC6492 RPKI Provisioning Protocol • RFC7318 Policy Qualifiers in RPKI certificates • RFC7382 Certificate Practice Statement (CPS) • RFC8181 RPKI publication protocol • RFC8182 RPKI Delta protocol (RRDP) • RFC8183 Out-of-band RPKI setup protocol • RFC8360 RPKI Validation Reconsidered Some of over 42 RFCs on implementation of RPKI and BGPsec
- 43. How do I start? • Use MyAPNIC: ⎯ Create ROAs to better protect your own routes § Encourage your peers/customers to do the same § Encourage your IXP to implement Route Origin Validation (ROV) in their Route Server ⎯ Then § Set up route validation at your own border routers § Use public or IXP validator, or your own