Re: bgpd ROA validation

2018-09-28 Thread Sebastian Benoit
Claudio Jeker(cje...@diehard.n-r-g.com) on 2018.09.27 10:57:12 +0200: > On Thu, Sep 27, 2018 at 09:39:36AM +0200, Claudio Jeker wrote: > > On Wed, Sep 26, 2018 at 06:24:36PM +0200, Claudio Jeker wrote: > > > On Tue, Sep 25, 2018 at 12:23:48PM +0200, Claudio Jeker wrote: > > > > On Sat, Sep 22,

Re: bgpd ROA validation

2018-09-27 Thread Claudio Jeker
On Thu, Sep 27, 2018 at 09:39:36AM +0200, Claudio Jeker wrote: > On Wed, Sep 26, 2018 at 06:24:36PM +0200, Claudio Jeker wrote: > > On Tue, Sep 25, 2018 at 12:23:48PM +0200, Claudio Jeker wrote: > > > On Sat, Sep 22, 2018 at 09:48:24PM +, Job Snijders wrote: > > > > Hi claudio, > > > > > > >

Re: bgpd ROA validation

2018-09-27 Thread Claudio Jeker
On Wed, Sep 26, 2018 at 06:24:36PM +0200, Claudio Jeker wrote: > On Tue, Sep 25, 2018 at 12:23:48PM +0200, Claudio Jeker wrote: > > On Sat, Sep 22, 2018 at 09:48:24PM +, Job Snijders wrote: > > > Hi claudio, > > > > > > Seems we are getting very close. Some suggestions to simplify the > > >

Re: bgpd ROA validation

2018-09-26 Thread Claudio Jeker
On Tue, Sep 25, 2018 at 12:23:48PM +0200, Claudio Jeker wrote: > On Sat, Sep 22, 2018 at 09:48:24PM +, Job Snijders wrote: > > Hi claudio, > > > > Seems we are getting very close. Some suggestions to simplify the > > experience for the end user. > > > > Let's start with supporting just one

Re: bgpd ROA validation

2018-09-25 Thread Job Snijders
On Tue, Sep 25, 2018 at 12:23:48PM +0200, Claudio Jeker wrote: > On Sat, Sep 22, 2018 at 09:48:24PM +, Job Snijders wrote: > > Seems we are getting very close. Some suggestions to simplify the > > experience for the end user. > > > > Let's start with supporting just one (unnamed) roa-set, so

Re: bgpd ROA validation

2018-09-25 Thread Claudio Jeker
On Sat, Sep 22, 2018 at 09:48:24PM +, Job Snijders wrote: > Hi claudio, > > Seems we are getting very close. Some suggestions to simplify the > experience for the end user. > > Let's start with supporting just one (unnamed) roa-set, so far I've > really not come across a use case where

Re: bgpd ROA validation

2018-09-22 Thread Job Snijders
Hi claudio, Seems we are getting very close. Some suggestions to simplify the experience for the end user. Let's start with supporting just one (unnamed) roa-set, so far I've really not come across a use case where multiple ROA tables are useful. I say this having implemented origin validation

Re: bgpd ROA validation

2018-09-22 Thread Job Snijders
On Fri, Sep 21, 2018 at 05:29:24PM +0200, Claudio Jeker wrote: > I currently use the RIPE RPKI validator to grab a JSON file (e.g. > http://localcert.ripe.net:8088/export.json) and feed that to this perl > script to convert it into bgpd syntax: For now I recommend using

Re: bgpd ROA validation

2018-09-21 Thread Sebastian Benoit
Claudio Jeker(cje...@diehard.n-r-g.com) on 2018.09.21 22:30:17 +0200: > > In my setup I get these numbers: > > 5895 invalid prefixes > > 67478 valid prefixes > > 638299 unknown prefixes > > This is from a single IPv4 only full feed. > > > > Disclaimer: works for me but I did not test

Re: bgpd ROA validation

2018-09-21 Thread Claudio Jeker
On Fri, Sep 21, 2018 at 05:29:24PM +0200, Claudio Jeker wrote: > This diff adds the rest needed to do ROA validation. > > It does: > - add the filter logic for roa validation check >deny from any roa-set RPKI invalid >match from any roa-set RPKI valid set community local-as:42 > - makes