#rpki — Public Fediverse posts

rpki-client 9.9 released https://www.undeadly.org/cgi?action=article;sid=20260824085031 #openbsd #openbgpd #rpkiclient #bgp #routing #rpki #security #cryptography #networking #freesoftware #libresoftware

rpki-client 9.9 has been released:
https://marc.info/?l=openbsd-announce&m=178751317654834&w=2
#rpki #bgp #OpenBSD #rpkiclient #routing #networking

For future reference:

/usr/bin/sh -c 'awk -v RS="" "/protocol static {\n\s+aspa/,/^}/" < /etc/bird-rpki/bird > /etc/bird-rpki/birdfilt'

#rpki #bird #bgp

Can I get ASPA validation (with Debian stable packages?)
fort-validator 1.6.6 does not seem to have it (only 1.7.0-experimental?)
stayrtr 0.6.4 apparently doesn't either.
What now?

#bgp #rpki #aspa

@Larvitz
What kind of or where this ASPA signing app/frontend?

#AS201379 #BGP #RPKI #ASPA #IPv6 #RoutingSecurity #NetOps

BGP security stack complete for AS201379: ASPA records published for upstream authorization, backed by valid RPKI ROAs and IRR objects.

#AS201379 #BGP #RPKI #ASPA #IPv6 #RoutingSecurity #NetOps

Claudio Jeker (claudio@) has announced the release of OpenBGPD 9.2 -portable.

Release notes: https://cdn.openbsd.org/pub/OpenBSD/OpenBGPD/openbgpd-9.2-relnotes.txt

#BGP #OpenBGPD #FreeBSD #Linux #BIRD #RPKI #NANOG

New blog post: Don't Deserialize: Serving 1.5M RPKI ROA Records from a Memory-Mapped Trie
#BGP #RPKI
https://bgpkit.com/blog/zero-copy-prefix-tries-with-rkyv/

bgpipe v0.22 is out! 🚀

New: MRT table dump support. A full RIB snapshot from RouteViews or RIPE RIS now streams as BGP updates, each tagged with the peer it came from.

Which means every stage you already use just works on them:

bgpipe --rpki <cache> -- read rib.bz2 -- rov -- grep 'tag[rov/status] == INVALID'

That is RPKI validation of an entire routing table. 4.1M routes in 7s, validated in 8s.

https://bgpipe.org

#BGP #RPKI #networking

Weekend Reads

* Inside an Internet shutdown
https://labs.ripe.net/author/mdkamruzzaman-khan-2/inside-a-shutdown-bgp-evidence-from-an-operator-who-was-there/
* Inferring shared IP addresses
https://burdantes.github.io/assets/pdf/multi_user_ip-sigcomm.pdf
* BGP origin attribute manipulation
https://blog.cloudflare.com/bgp-origin-attribute/
* IP reassembly congestion DoS attacks
https://cispa.saarland/group/rossow/papers/FragJam-usenix2026.pdf
* Operators on academic BGP security solutions
https://pure.mpg.de/rest/items/item_3719779_1/component/file_3719780/content

#InternetShutdown #NAT #BGP #DoS #RPKI

#BGP #RPKI

"With eight Firehol level 1 blocklist matches out of only 79 prefixes, repo.rpki.space stands out immediately. Inspection of BGP Tools DNS records for this server reveals a high density of mailing domains, strongly suggesting that spam mailing infrastructure is hosted across the prefixes in question. "

An interesting survey of "small" RPKI servers. https://labs.ripe.net/author/ties-dirksen/whos-running-all-those-tiny-rpki-servers/

China jumps - in the span of just 3 months - from 4% to a whopping 80% RPKI ROA coverage. Absolutely impressive. #RPKI #RoutingSecurity

In today's episode of "Who Cares?", #APNIC serves up an enthralling tale of minuscule #RPKI servers run by who-knows-who 🙄. It's a thrilling saga of navigating #Whois databases and paying bills, guaranteed to put you to sleep faster than you can say "IPv6" 😴.
https://blog.apnic.net/2026/07/15/whos-running-all-those-tiny-rpki-servers/ #WhoCares #IPv6 #TechHumor #HackerNews #ngated

Who's running all those tiny RPKI servers?

https://blog.apnic.net/2026/07/15/whos-running-all-those-tiny-rpki-servers/

Comments: https://news.ycombinator.com/item?id=48917055

#HackerNews #RPKI #servers #internet #security #network #operators #cybersecurity

The Internet Last Week

* Telstra outage
https://www.msn.com/en-au/money/markets/time-keeping-technology-triggers-telstra-nationwide-outage-heres-what-we-know/ar-AA27rA3Y
https://www.capitalbrief.com/briefing/telstra-hit-by-nationwide-mobile-outage-3042bf2f-942c-428e-bfa7-b95b32dbf3a0/
* APNIC ASPA deployment
https://orbit.apnic.net/hyperkitty/list/[email protected]/thread/R5CLUB6WT4J72WJA2OOMQOHIWJJOP5RY/
https://blog.apnic.net/2026/07/09/aspa-at-apnic-strengthening-bgp-path-validation/
* KVM guest-to-host escape vulnerability
https://github.com/V4bel/Januscape

#Telstra #APNIC #RPKI #KVM #Outages

I keep the ledger at isp6.

The boring, reliable work: allocations, ROAs, reverse DNS — the records that decide whether the internet believes a prefix is yours. Done right, you never notice any of it.

I'll write plainly here about IPv6, portability, and why the network identity you run on should be yours — on paper, not on loan.

No hype. No drama. Just the work, signed.

— Ada

#Introduction #IPv6 #BGP #RPKI

Looks like @mingwei is promoting #RPKI tooling with pop up stores!

Please note that we have volunteered to have all of our products and libraries analyzed by LLM tooling, so you can expect security releases for pretty much everything, down to libraries like rpki-rs and projects in maintenance mode like ldns.

#DNS #RPKI #BGP #OpenSource

🚨 Security release! 🚨

Routinator 0.15.2 ‘Irgendwas ist immer’ is now available, This release fixes a number of vulnerabilities and security issues identified by a security audit performed by @x41sec which was kindly funded by @sovtechfund.

We advise all users to upgrade at their earliest convenience.

https://community.nlnetlabs.nl/t/routinator-0-15-2-irgendwas-ist-immer-released/3400

#RPKI #CVE #Security #BGP #Routing

@bawuenet hat jetzt für alle Adressen #rpki - danke fürs Aktivieren @ixs

Weekend Reads

* Centrality in the DNS
https://www.potaroo.net/ispcol/2026-05/dns-centrality.html
* RPKI RP fuzzing analysis
https://arxiv.org/abs/2605.26651
* Iran Internet partial restoration
https://blog.cloudflare.com/iran-internet-partially-restored-may-2026/
* Enterprise security for the AI era
https://arxiv.org/abs/2605.22985
* Characterizing Starlink queuing configuration
https://arxiv.org/abs/2605.27717

#DNS #RPKI #Iran #AI #Starlink

La cybersécuritay, c'est compliquay. Comment la Corée du Nord a coupé sa liaison Internet en voulant la sécuriser. https://labs.ripe.net/author/romain_fontugne/from-bgp-data-to-insight-simplifying-real-time-routing-analysis/

#BGP #RPKI

🚨 More new routing insights on Radar!

- Track #RPKI ROA deployment history at a global/country/ASN level, going back 3+ years for valid prefixes & address space

https://radar.cloudflare.com/routing/rpki#rpki-roa-deployment

- Country level announced IP address space graphs now include a "Show top ASes" toggle. Stacked area graphs make it easier to identify the providers behind large address space withdrawals.

Example: https://radar.cloudflare.com/routing/ir?dateStart=2026-01-04&dateEnd=2026-01-10#announced-ip-address-space

Weekend Reads

* How crazy is .internal/DOT
https://ant.isi.edu/~hardaker/papers/2026-04-27-analyzing-dot-internal-to-dot.pdf
* RIPE NCC RPKI exploit chain
https://mxsasha.eu/posts/ripe-ncc-rpki-exploit-chain/
* Bellovin book: Don't get hacked
https://www.cs.columbia.edu/~smb/homesec/index.html
* Internet Protocol Journal May 2026
https://ipj.dreamhosters.com/wp-content/uploads/2026/04/291-ipj.pdf
* Cloudflare 2026-Q1 Internet disruptions report
https://blog.cloudflare.com/q1-2026-internet-disruption-summary/

#DNS #RPKI #RIPE #Infosec #Outages

rpki-client 9.8 released

Routing security matters to all of us (even those of us who seldom give the subject any thought), and the rpki-client project announced the release of a new version of their Resource Public Key Infrastructure (RPKI) client, with a number of improvements.

The announcement reads

• List: openbsd-announce
• Subject: rpki-client 9.8 released
• From: Sebastian Benoit

• Date: 2026-04-14 23:20:42

  rpki-client 9.8 has just been released and will be available in the rpki-client directory of any OpenBSD mirror soon.
  It is recommended
  that all users upgrade to this version for improved reliability.

  rpki-client is a FREE, easy-to-use implementation of the Resource
  Public Key Infrastructure (RPKI) for Relying Parties to facilitate
  validation of BGP announcements. The program queries the global RPKI
  repository system and validates untrusted network inputs. The program
  outputs validated ROA payloads, BGPsec Router keys, and ASPA payloads
  in configuration formats suitable for OpenBGPD and BIRD, and supports
  emitting CSV and JSON for consumption by other routing stacks.

  See RFC 6480 and RFC 6811 for a description of how RPKI and BGP Prefix
  Origin Validation help secure the global Internet routing system.

  rpki-client was primarily developed by Kristaps Dzonsons, Claudio Jeker,
  Job Snijders, Theo Buehler, Theo de Raadt, and Sebastian Benoit as part
  of the OpenBSD Project.

  This release includes the following changes to the previous release:

  • Various refactoring for improved compatibility with various libcryptoimplementations and in CA/BGPsec certificate handling.
  • Fixed an accounting issue in HTTP gzip compression detection.
  • Added a warning in extra verbose mode (-vv) about standardsnon-compliant Issuer and Subject ASN.1 string encodings.
  • Added a check for canonical encoding of ASPA eContent in alignmentwith draft-ietf-sidrops-aspa-profile-22.
  • Ensure that a repository timeout correctly stops repositoryprocessing. Thanks to Fedor Vompe from Deutsche Telekom for reporting.
  • Fixed a defect in Canonical Cache Representation ROAIPAddressFamilysort order. As a result, rpki-client 9.8 cannot parse rpki-client9.7's .ccr files and vice versa. Thanks to Bart Bakker from RIPE NCCfor reporting.
  • Fixed an issue in the parser for the locally configured constraints.Thanks to Daniel Anderson.
  • A malicious RRDP Publication Server can cause a NULL dereference.Thanks to Daniel Anderson for reporting.
  • A malicious RPKI Publication Server can cause an incorrect error exit.Thanks to Yuheng Zhang, Qi Wang, Jianjun Chen from Tsinghua University,and Teatime Lab for reporting.

Go read ALL about it here!

https://undeadly.org/cgi?action=article;sid=20260415115612

#rpki #client #resource #public #key #infrastructure #openBSD #OpenSource #programming #networking