[db-wg] Draft Minutes of the RIPE 52 DB-WG meeting

> Well the RFC is from 12/1999 , we have now 2006. Things may change!.

Indeed.

> Even 1999 people saw the problem and according to the wording in D.3 it is
> not clear that the mnt-routes must appear in the route object itself. It can
> also be seen that a mnt-routes in the inetobject itself could be used. Or am
> i
> wrong?

I hope I'm not misunderstanding what you're saying, but I think you
may have missed part of section 9.9, "Adding to the Database".

   Adding a route object is somewhat more complicated.  The route object
   submission must satisfy two authentication criteria.  It must match
   the authentication specified in the aut-num and the authentication
   specified in either a route object or if no applicable route object
   is found, then an inetnum.

   An addition is submitted with an AS number and prefix as its key.  If
   the object already exists, then the submission is treated as a modify
   (see Section 9.10).  If the aut-num does not exist on a route add,
   then the addition is rejected (see Section C for further discussion
   of tradeoffs).  If the aut-num exists then the submission is checked
   against the applicable maintainer.  A search is then done for the
   prefix first looking for an exact match.  If the search for an exact
   match fails, a search is made for the longest prefix match that is
   less specific than the prefix specified.  If this search succeeds it
   will return one or more route objects.  The submission must match an
   applicable maintainer in at least one of these route objects for the
   addition to succeed.  If the search for a route object fails, then a
   search is performed for an inetnum that exactly matches the prefix or
   for the most specific inetnum that is less specific than the route
   object submission.  The search for an inetnum should never fail but
   it may return an unallocated or reserved range.  The inetnum status
   must be "allocated" and the submission must match the maintainer.

   Having found the AS and either a route object or inetnum, the
   authorization is taken from these two objects.  The applicable
   maintainer object is any referenced by the mnt-routes attributes.  If
   one or more mnt-routes attributes are present in an object, the mnt-
   by attributes are not considered.  In the absence of a mnt-routes
   attribute in a given object, the mnt-by attributes are used for that
   object.  The authentication must match one of the authorizations in
   each of the two objects.

Does that help explain the current authorisation model?

Regards,
Rob