[anti-abuse-wg] Solving the issue of rogue ROUTE objects in the RIPE Database

Hi,

I like the idea. I would have preffered a cross registry/RIR solution but
as you said, it has been many months (I actually raised the issue 2 RIPE
meetings ago - in London) but nothing visible has been done to fix this
problem.

+1 from me.

cheers,
elvis

Excuse the briefness of this mail, it was sent from a mobile device.

On Nov 5, 2015, at 11:47, "ripedenis at yahoo.co.uk" <ripedenis at yahoo.co.uk>
wrote:

HI all

I am going to have one last go at solving this problem. I challenge
anyone/everyone to tell me why this is such a stupid idea, technically
impossible to do, won't solve any of the issues partially or fully. Then I
can shut up about it and go away. If you can't condemn the idea then
support it. Lets fix this issue once and for all, stop this endless
discussion about rogue ROUTE objects and get on with life.

So here is my 4 step proposal that I believe could be implemented within a
month. If we implemented this you can be sure that all ROUTE objects in the
RIPE Database were created with the knowledge and approval of the related
resource holders. I believe that is the desired goal.

STEP 1

Any ROUTE object submitted for creation in the RIPE Database involving an
out of region resource (address space and/or ASN) where that out of region
resource does not exist in the authoritative RIR database (has not been
allocated or assigned), reject the creation.

The RIPE NCC mirrors the operational data from all the other 4 RIRs. These
mirrors are updated daily as well as the RIRs daily stats. It is easy to
determine if a resource is registered in the authoritative database.

STEP 2

For those ROUTE objects from STEP 1 where the out of region resource does
exist, hold the object creation as pending. The mechanism for doing this
already exists in the RIPE Database software as it is used for multiple
authentications.

Lookup the out of region resource(s) in the authoritative database(s) and
find the contacts for that resource. Send a notification to those contacts
informing them of the pending ROUTE object creation in the RIPE Database.
The notification mechanism already exists in the RIPE Database software. If
they don't approve, do nothing and the creation request will time out after
a week and the object will not be created. If they do approve, respond in
some way (many technical options for doing this that the RIPE NCC can
choose from). If appropriate approval(s) are received within a week, create
the ROUTE object.

STEP 3

On a daily basis, for each ROUTE object in the RIPE Database that relates
to an out of region resource, check for the continued existence of that
resource in the appropriate RIR database. If it no longer exists, delete
the ROUTE object from the RIPE Database.

STEP 4

This is a one off cleanup of existing ROUTE objects. For all ROUTE objects
currently in the RIPE Database that relate to an out of region, existing
resource, send the appropriate notifications. For any that no response is
received within a week, delete the ROUTE object from the RIPE Database.

cheers
denis
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ripe.net/ripe/mail/archives/anti-abuse-wg/attachments/20151105/39cba141/attachment.html>