Re: [Sidrops] ASPA objects in the public RPKI

Dear Job,

Thank you for your clear explanation!
Your answer opened me up to some facts that I hadn't noticed before:
Some looking glasses only see IPv4 AS neighbors for 2 ASes, but no IPv6 AS neighbors. This observation does not prove that there are no IPv6 neighbors for such 2 ASes, instead, it shows that the capability of these looking glasses need to be improved.

Kind regards,
Shunwan

From: Sidrops [mailto:sidrops-bounces@ietf.org] On Behalf Of Job Snijders
Sent: Wednesday, December 14, 2022 12:35 PM
To: Zhuangshunwan <zhuangshunwan=40huawei.com@dmarc.ietf.org>
Cc: sidrops@ietf.org
Subject: Re: [Sidrops] ASPA objects in the public RPKI

Dear Shunwan,

Thank you for your question.

The ASPAs in the current set of valid objects apply to BOTH ipv6 and ipv4.

If they were IPv6-specific, the objects would’ve contained the “afiLimit” field with the value set to IPv6 (0002).

Kind regards,

Job

On Wed, 14 Dec 2022 at 07:18, Zhuangshunwan <zhuangshunwan=40huawei.com@dmarc.ietf.org<mailto:40huawei.com@dmarc.ietf.org>> wrote:
Hi Job,

Thanks for your sharing! I think it's a great, significant work.
As I understand it, the current ASPA objects are for AFI IPv4 and does not take into account AFI IPv6. Is my understanding wrong?

Kind regards,
Shunwan

> -----Original Message-----
> From: Sidrops [mailto:sidrops-bounces@ietf.org<mailto:sidrops-bounces@ietf.org>] On Behalf Of Job Snijders
> Sent: Friday, December 2, 2022 8:32 PM
> To: sidrops@ietf.org<mailto:sidrops@ietf.org>
> Subject: [Sidrops] ASPA objects in the public RPKI
>
> Dear all,
>
> Just FYI. Recently, the very first ASPA objects (produced by two different CA
> implementations) appeared in the public RPKI:
>
> AS 970 -
> https://console.rpki-client.org/rpki-rps.arin.net/repository/8a848adf8143bf
> 6201823bd454752be6/0/AS970.asa.html
> AS 21957 -
> https://console.rpki-client.org/rpki-rps.arin.net/repository/8a848adf8143bf
> 6201823bd454752be6/0/AS21957.asa.html
> AS 15562 -
> https://console.rpki-client.org/chloe.sobornost.net/rpki/RIPE-nljobsnijders/
> VCIb3NxttGlL0VzKekHcAGpU9Ls.asa.html
>
> CA implementers can use rpki-client 8.0 and higher to confirm object profile
> specification compliance.
>
> Kind regards,
>
> Job
>
> _______________________________________________
> Sidrops mailing list
> Sidrops@ietf.org<mailto:Sidrops@ietf.org>
> https://www.ietf.org/mailman/listinfo/sidrops