tonusoo

#!/usr/bin/env python3

"""RPKI ASPA objects for ASes registered in a country.

Script finds all the AS numbers from RIR statistics files
for a country in which the AS number holder is legally based.
AS numbers are checked against the RPKI ASPA dataset and ASNs
are categorized into two groups: ones with an ASPA object and
ones without it.

tonusoo

#!/usr/bin/env python3

"""RPKI ASPA objects for ASes associated with a country.

Script finds all the v4 and v6 address ranges geolocated to a user-
specified country. For each address range possible exact and more-
specific prefixes from DFZ are found. If the exact prefix was not
found and more-specifics do not fully cover the geolocated address
range, then also less-specific prefixes are checked. Finally, all
the unique origin ASNs for the found prefixes are checked against

tonusoo

#!/usr/bin/env python3

"""RPKI ROA analysis of BGP prefixes covering country's address space.

Script finds all the v4 or v6 address ranges geolocated to a user-
specified country. For each address range possible exact and more-
specific prefixes from DFZ are found. If the exact prefix was not
found and more-specifics do not cover the geolocated address range,
then also less-specific prefixes are checked. Finally, all the unique
prefix and ASN tuples from DFZ are checked against the RPKI ROA dataset.

tonusoo

tonusoo

root@lab-mx960> show configuration services
service-set pat-service-set {
    nat-rules rule-napt-44;
    interface-service {
        /* first PIC of MS-DPC in slot 9; Multiservices MIC should use "ms" interface instead of "sp" interface  */
        service-interface sp-9/0/0;
    }
}
nat {
    pool napt-pool {

tonusoo

#!/usr/bin/env python3

# https://github.com/QratorLabs/ASPA
# https://github.com/ksriram25/IETF/blob/main/ASPA_path_verification_examples.pdf

import sys
import logging

DEBUG_MODE = True

tonusoo

martin@validator-2:~$ # routinator dump --output /tmp/routinator-dump/
martin@validator-2:~$ # "<- ..." comments below are manually added
martin@validator-2:~$ openssl cms -verify -noverify -inform DER -in /tmp/routinator-dump/store/rrdp.arin.net/rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/69fd0156-bb1f-48b6-bf32-c9492286f195/de4a1dfa-8867-4aef-a2e6-131e93add9f9/5486ade0-fc94-3e8d-89dc-e03fab376ea9.roa -outform DER | openssl asn1parse -inform DER -i -dump
CMS Verification successful
    0:d=0  hl=2 l=  28 cons: SEQUENCE
    2:d=1  hl=2 l=   3 prim:  INTEGER           :02571B                <- ASN 153371 (RFC 6482 ASID)
    7:d=1  hl=2 l=  21 cons:  SEQUENCE
    9:d=2  hl=2 l=  19 cons:   SEQUENCE
   11:d=3  hl=2 l=   2 prim:    OCTET STRING
      0000 - 00 02                                             ..      <- v6 addr family (RFC 6482 addressFamily)

tonusoo

root@vjr-17> show configuration routing-options bmp
/* Rotonda */
station BMP-feed-for-RTBH-1 {
    /* if the session breaks, then the router tries to reestablish it every 30 seconds */
    connection-mode active;
    /* Route Monitoring messages are sent only for peers defined under specific BGP groups */
    route-monitoring {
        none;
    }
    station-address 10.10.8.3;

tonusoo

tonusoo

#!/usr/bin/env bash

get_journal_logs() {

        log_type="$1"

        if [[ "$log_type" == "system" ]]; then

                args+=( "--dmesg" )