rpki-client / rpki-client-portable

Portability shim for OpenBSD's rpki-client

Home Page:https://rpki-client.org

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Inclusion of APNIC AS0 TAL

robert-scheck opened this issue · comments

As per https://blog.apnic.net/2020/09/02/policy-prop-132-as0-for-unallocated-space-deployed-in-service/, APNIC provides a separate TAL covering their undelegated IPv4 and IPv6 ranges. I hereby would like to suggest the inclusion of the APNIC AS0 TAL as apnic-as0.tal into rpki-client.

It's probably not a good idea to include this by default without any opt-in, as people do not expect this.

We already need to opt-in to the ARIN TAL, any AS0 TAL should be opt-in as well imo.

Also see:
https://www.apnic.net/community/security/resource-certification/apnic-limitations-of-liability-for-rpki-2/

it is strongly recommended that the AS0 ROA is used for advisory and/ or alerting purposes only, and not for automatic filtering of BGP routes.

and the RIPE proposal regarding AS0 ROA's through the publication of SLURM files:
https://www.ripe.net/participate/policies/proposals/2019-08

Oh, I didn't notice this. Then we maybe should start writing some documentation instead (for both, ARIN and APNIC AS0).

APNIC explicitly requested all RP developers to not include the AS0 TAL. As such, we will not include their AS0 TAL.

Furthermore there are several issues with the approach, so I doubt OpenBSD will ever include these tals. The concept of AS0 TALs imho is counter-productive. The AS0 TAL idea comes from people that do not run RPKI in production environments and they fail to see the extreme damage that such concepts can bring to the connectedness of the global internet.

For extensive discussion on the AS0 TAL concept please review https://www.ripe.net/ripe/mail/archives/routing-wg/2020-June/004131.html