[Sidrops] RIPE NCC RPKI pilot for ASPA objects

[Erik Rozendaal <[e-mail]>]

ASPA (Autonomous System Provider Authorisation[1]) is a new RPKI
object type and the first additional object type supported by the RIPE
NCC RPKI software since its original introduction. ASPA is currently
in draft status, and we implemented draft version 11 of the object
profile [2].

We built this ASPA pilot to help the community advance the work in the
IETF SIDR Operations (SIDROPS)working group. The initial version runs
in the RIPE NCC localcert[3] pilot environment, and we plan to make it
available in the production environment soon after the ASPA proposal
reaches RFC status.

Below you can find the description of the RIPE NCC RPKI ASPA
configuration API. Please contact us at [e-mail] if
you have any questions or problems.

# ASPA configuration API

The ASPA configuration can only be retrieved and updated in this pilot
environment using the RPKI Management API[4]. We added two new API
endpoints for ASPA:

## Retrieve the current ASPA configuration

API endpoint: `GET /api/rpki/aspa`

Returns a JSON representation of your current ASPA configuration and
an `entityTag`. This `entityTag` describes the current version of the
configuration.

Example response body:

    {
      "entityTag": "\"PUwiLtHQSA9LqD5mvUW3Rp7WqPCsS28p/5a52N9AcS8=\"",
      "aspaConfigurations": [{
          "customerAsn": "AS64496",
          "providers": [
              { "providerAsn": "AS64500", "afiLimit": "ANY" }
          ]
      }]
    }

## Update the ASPA configuration

API endpoint: `PUT /api/rpki/aspa`

Atomically replaces the current ASPA configuration with the provided
configuration. You must provide the `entityTag` of your current
configuration in the `ifMatch` field. If the provided tag no longer
matches, you will get an `HTTP 412 precondition failed`[5]
response. This mechanism prevents conflicting updates of the ASPA
configuration.

After the configuration is updated, the RIPE NCC RPKI system will
update the ASPA CMS objects and publish them to the RIPE NCC RPKI
repositories. This process usually takes less than 30 minutes but may
be slower, with a long tail up to the time limit described in our CPS.

Example request body:

    {
      "ifMatch": "\"PUwiLtHQSA9LqD5mvUW3Rp7WqPCsS28p/5a52N9AcS8=\"",
      "aspaConfigurations": [{
        "customerAsn": "AS64496",
        "providers": [
            { "providerAsn":"AS64500", "afiLimit": "IPv4" }
        ]
      }]
    }

Note: it is also possible to use the HTTP `ETag`[6] response header
and `If-Match`[7] request header instead of the JSON object fields.

## ASPA configuration JSON

The ASPA configuration JSON has the following format. All fields are
required:

`aspaConfigurations`: a (possibly empty) list of ASPA configuration
objects with two fields: customerAsn and providers.

`customerAsn`: your ASN, which must be part of your certified
resources.

`providers`: a non-empty list of objects with two fields:
`providerAsn` and `afiLimit`.

`providerAsn`: the ASN of the authorised provider or internet exchange
point route server.

`afiLimit`: one of `ANY`, `IPv4`, or `IPv6` (case sensitive) to limit
the kind of traffic that is authorised.

# References

[1]: https://datatracker.ietf.org/doc/draft-ietf-sidrops-aspa-profile/
[2]: https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-aspa-verification
[3]: https://www.ripe.net/manage-ips-and-asns/resource-management/rpki/rpki-test-environment
[4]: https://www.ripe.net/support/documentation/developer-documentation/rpki-management-api
[5]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/412
[6]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag
[7]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Match