tonusoo

irrd:

    # For performance reasons, use an Unix domain socket
    # for communicating with both the PostgreSQL (socket
    # is /run/postgresql/.s.PGSQL.5432) and Redis.
    # For PostgreSQL only the peer authentication is
    # allowed.
    database_url: 'postgresql:///irrd'
    redis_url: 'unix:///run/redis/redis-server.sock'
    # In Filesystem Hierarchy Standard 3.0, /var/run

tonusoo

tonusoo

#!/usr/bin/env python3
"""
Fetches valid route and route6 objects from the IRRd PostgreSQL
database and atomically generates a JSON file formatted for RTRTR.

Expected to be run by systemd-timer under the 'irrd' user.
"""

import ipaddress
import json

tonusoo

#!/usr/bin/env python3

"""RPKI ASPA objects for ASes registered in a country.

Script finds all the AS numbers from RIR statistics files
for a country in which the AS number holder is legally based.
AS numbers are checked against the RPKI ASPA dataset and ASNs
are categorized into two groups: ones with an ASPA object and
ones without it.

tonusoo

#!/usr/bin/env python3

"""RPKI ASPA objects for ASes associated with a country.

Script finds all the v4 and v6 address ranges geolocated to a user-
specified country. For each address range possible exact and more-
specific prefixes from DFZ are found. If the exact prefix was not
found and more-specifics do not fully cover the geolocated address
range, then also less-specific prefixes are checked. Finally, all
the unique origin ASNs for the found prefixes are checked against

tonusoo

#!/usr/bin/env python3

"""RPKI ROA analysis of BGP prefixes covering country's address space.

Script finds all the v4 or v6 address ranges geolocated to a user-
specified country. For each address range possible exact and more-
specific prefixes from DFZ are found. If the exact prefix was not
found and more-specifics do not cover the geolocated address range,
then also less-specific prefixes are checked. Finally, all the unique
prefix and ASN tuples from DFZ are checked against the RPKI ROA dataset.

tonusoo

tonusoo

root@lab-mx960> show configuration services
service-set pat-service-set {
    nat-rules rule-napt-44;
    interface-service {
        /* first PIC of MS-DPC in slot 9; Multiservices MIC should use "ms" interface instead of "sp" interface  */
        service-interface sp-9/0/0;
    }
}
nat {
    pool napt-pool {

tonusoo

#!/usr/bin/env python3

# https://github.com/QratorLabs/ASPA
# https://github.com/ksriram25/IETF/blob/main/ASPA_path_verification_examples.pdf

import sys
import logging

DEBUG_MODE = True

tonusoo

martin@validator-2:~$ # routinator dump --output /tmp/routinator-dump/
martin@validator-2:~$ # "<- ..." comments below are manually added
martin@validator-2:~$ openssl cms -verify -noverify -inform DER -in /tmp/routinator-dump/store/rrdp.arin.net/rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/69fd0156-bb1f-48b6-bf32-c9492286f195/de4a1dfa-8867-4aef-a2e6-131e93add9f9/5486ade0-fc94-3e8d-89dc-e03fab376ea9.roa -outform DER | openssl asn1parse -inform DER -i -dump
CMS Verification successful
    0:d=0  hl=2 l=  28 cons: SEQUENCE
    2:d=1  hl=2 l=   3 prim:  INTEGER           :02571B                <- ASN 153371 (RFC 6482 ASID)
    7:d=1  hl=2 l=  21 cons:  SEQUENCE
    9:d=2  hl=2 l=  19 cons:   SEQUENCE
   11:d=3  hl=2 l=   2 prim:    OCTET STRING
      0000 - 00 02                                             ..      <- v6 addr family (RFC 6482 addressFamily)