add OpenBSD TA constraints and localhost TLS examples
This commit is contained in:
@@ -2,6 +2,9 @@
|
||||
|
||||
## 0.1.0 — Unreleased
|
||||
|
||||
- Vendor five OpenBSD TALs and constraints with pinned provenance; enable policies
|
||||
in both all5 Compose examples and add the TOML `ta-constraints-enabled` switch.
|
||||
Validation summaries identify applied policies.
|
||||
- Breaking CLI change: mandatory TOML via `validate|daemon --config FILE`;
|
||||
remove business flags, `--` forwarding and logging environment overrides.
|
||||
- Read-only configuration checking/printing and top-level version output.
|
||||
|
||||
43
README.md
43
README.md
@@ -1,25 +1,25 @@
|
||||
# Panda RPKI
|
||||
|
||||
For every field, default, constraint and complete example, see the [TOML configuration reference](docs/configuration.md)。
|
||||
|
||||
Panda RPKI is an RPKI relying party written in Rust. It synchronizes repositories
|
||||
over RRDP, validates signed objects, and exports routing data as CSV and Canonical
|
||||
Cache Representation (CCR). Run a single cycle or use the daemon for continuous operation.
|
||||
|
||||
Version 0.1.0 is an unreleased candidate, validated on Linux x86-64. Other
|
||||
platforms are not yet verified. Review the [standards and limitations](docs/conformance-matrix.md)
|
||||
and [security policy](SECURITY.md) before evaluating it for routing use.
|
||||
Configuration is provided through TOML. See the [TOML configuration reference](docs/configuration.md)
|
||||
for every field, default, constraint and complete example.
|
||||
|
||||
This build is validated on Linux x86-64. Other platforms are not yet verified.
|
||||
Review the [standards and limitations](docs/conformance-matrix.md) and [security
|
||||
policy](SECURITY.md) before evaluating it for routing use.
|
||||
|
||||
## Quick start
|
||||
|
||||
Requirements: Linux, Docker, and a TAL. A matching DER trust-anchor certificate
|
||||
may be supplied in the TOML, or Panda can refresh it from the TAL's URI. Follow
|
||||
[input preparation](docs/getting-started.md#prepare-trust-anchors) for trusted
|
||||
RIR inputs. From the project root, after placing `input/anchor.tal` (and, for a
|
||||
fixed-TA run, `input/anchor.cer`):
|
||||
Requirements: Linux and Docker. This repository includes a pinned AFRINIC TAL and
|
||||
its constraints under `tals/`, so no TAL download or `input/` setup is needed for
|
||||
this first run. A matching DER trust-anchor certificate may be supplied in the
|
||||
TOML, or Panda can refresh it from the TAL's URI. From the project root:
|
||||
|
||||
```bash
|
||||
docker build -f docker/Dockerfile -t panda-rpki:v0.1.0 .
|
||||
docker build -f docker/Dockerfile -t panda-rpki:local .
|
||||
mkdir -p state output
|
||||
cat > validate.toml <<'TOML'
|
||||
config-version = 1
|
||||
@@ -29,22 +29,26 @@ rrdp-state-dir = "/state/repository"
|
||||
ccr-out = "/output/result.ccr"
|
||||
|
||||
[[anchors]]
|
||||
id = "anchor"
|
||||
tal = "/input/anchor.tal"
|
||||
# ta = "/input/anchor.cer" # uncomment for fixed TA mode
|
||||
id = "afrinic"
|
||||
tal = "/input/afrinic.tal"
|
||||
constraints = "/input/afrinic.constraints"
|
||||
# ta = "/input/afrinic.cer" # uncomment for fixed TA mode
|
||||
TOML
|
||||
docker run --rm --read-only --tmpfs /tmp \
|
||||
--user "$(id -u):$(id -g)" \
|
||||
-v "$PWD/input:/input:ro" \
|
||||
-v "$PWD/tals:/input:ro" \
|
||||
-v "$PWD/state:/state" \
|
||||
-v "$PWD/output:/output" \
|
||||
-v "$PWD/validate.toml:/config/validate.toml:ro" \
|
||||
panda-rpki:v0.1.0 validate --config /config/validate.toml
|
||||
panda-rpki:local validate --config /config/validate.toml
|
||||
```
|
||||
|
||||
The quick start refreshes the TA certificate automatically; TAL files themselves
|
||||
remain operator-maintained. For complete single/all-five and daemon TOML files,
|
||||
see [Compose examples](docker/examples/README.md).
|
||||
see [Compose examples](docker/examples/README.md). The two all-five examples
|
||||
use the vendored [OpenBSD TALs and constraints](tals/README.md) with resource
|
||||
constraints enabled. Edit the copied policy files or set top-level
|
||||
`ta-constraints-enabled = false` to disable them.
|
||||
|
||||
Inspect `output/summary.json` and `output/vrps.csv`. Logs go to stderr.
|
||||
Reuse the state directory to allow delta updates on subsequent runs.
|
||||
@@ -61,9 +65,8 @@ For continuous operation see [Usage](docs/usage.md#continuous-operation).
|
||||
- CSV, CCR, JSON summaries and configurable text or JSON logs from TOML.
|
||||
- Daemon intervals, persistent state, run retention, timeouts and graceful stop.
|
||||
|
||||
Version 0.1.0 accepts HTTPS RRDP through its CLI. Operators supply explicit
|
||||
TALs; automatic TA refresh follows each TAL's HTTPS or rsync URI. No RTR server
|
||||
is included. See the
|
||||
The CLI accepts HTTPS RRDP. Operators supply explicit TALs; automatic TA refresh
|
||||
follows each TAL's HTTPS or rsync URI. No RTR server is included. See the
|
||||
[standards matrix](docs/conformance-matrix.md) for profiles and limitations.
|
||||
|
||||
## Documentation
|
||||
|
||||
@@ -12,7 +12,10 @@ binary distributions. Container OS package notices remain under
|
||||
|
||||
Python cryptography and OpenSSL are external test tools, not bundled source.
|
||||
Consult their installed license notices when distributing a test environment.
|
||||
No production trust-anchor or repository data is included in this source tree.
|
||||
The `tals/` directory contains unmodified OpenBSD-distributed RIR TALs and
|
||||
resource constraints. Their [provenance and checksums](tals/README.md), original
|
||||
notices and referenced terms apply separately from the source-code license.
|
||||
No RIR repository objects or private keys are bundled.
|
||||
|
||||
| Package | Locked version | Declared license |
|
||||
| --- | --- | --- |
|
||||
|
||||
@@ -1,5 +1,7 @@
|
||||
# Copy docker/examples/daemon-all5.toml and set CONFIG_FILE to its absolute path.
|
||||
# Examples use text logs and automatic TA certificate refresh; TALs stay local.
|
||||
# Copy tals/*.tal and tals/*.constraints into INPUT_DIR; constraints default on.
|
||||
# Edit the copied constraints, or set ta-constraints-enabled = false in TOML.
|
||||
# See docs/docker.md for graceful stop and config reload.
|
||||
services:
|
||||
validator:
|
||||
|
||||
@@ -1,5 +1,7 @@
|
||||
# Copy docker/examples/validate-all5.toml and set CONFIG_FILE to its absolute path.
|
||||
# Examples use text logs and automatic TA certificate refresh; TALs stay local.
|
||||
# Copy tals/*.tal and tals/*.constraints into INPUT_DIR; constraints default on.
|
||||
# Edit the copied constraints, or set ta-constraints-enabled = false in TOML.
|
||||
# See docs/docker.md for graceful stop and config reload.
|
||||
services:
|
||||
validator:
|
||||
|
||||
24
docker/compose.localhost.yaml
Normal file
24
docker/compose.localhost.yaml
Normal file
@@ -0,0 +1,24 @@
|
||||
# Host-side test repository workflow.
|
||||
# Start tests/support/serve_repository.py on the host, then run this validator
|
||||
# with FIXTURE_DIR pointing at the generated fixture and network_mode=host.
|
||||
services:
|
||||
validator:
|
||||
build:
|
||||
context: ..
|
||||
dockerfile: docker/Dockerfile
|
||||
image: "${PANDA_RPKI_IMAGE:-panda-rpki:local}"
|
||||
network_mode: host
|
||||
user: "${PUID:-1000}:${PGID:-1000}"
|
||||
read_only: true
|
||||
init: true
|
||||
tmpfs:
|
||||
- /tmp
|
||||
volumes:
|
||||
- ${CONFIG_FILE:?set CONFIG_FILE to validate-localhost.toml}:/config/validate.toml:ro
|
||||
- ${FIXTURE_DIR:?set FIXTURE_DIR to the generated test fixture}:/fixture:ro
|
||||
- ${OUTPUT_DIR:?set OUTPUT_DIR to a writable output directory}:/output
|
||||
- ${STATE_DIR:?set STATE_DIR to a writable state directory}:/state
|
||||
command:
|
||||
- validate
|
||||
- --config
|
||||
- /config/validate.toml
|
||||
@@ -7,9 +7,10 @@ startup, graceful stop and config reload.
|
||||
| File | Mode | Inputs |
|
||||
| --- | --- | --- |
|
||||
| validate.toml | Single run | /input/anchor.tal |
|
||||
| validate-all5.toml | Single run | Five named RIR TALs |
|
||||
| validate-all5.toml | Single run | Five named RIR TALs and constraints |
|
||||
| validate-localhost.toml | Single run | Generated localhost HTTPS repository and `/fixture/certs/rrdp-ca.pem` |
|
||||
| daemon.toml | Continuous | /input/anchor.tal |
|
||||
| daemon-all5.toml | Continuous | Five named RIR TALs |
|
||||
| daemon-all5.toml | Continuous | Five named RIR TALs and constraints |
|
||||
|
||||
All examples use text/info diagnostics, require-complete=true, and automatic
|
||||
TA certificate refresh (ta omitted). TAL files are never automatically updated.
|
||||
@@ -22,3 +23,36 @@ Container paths differ from native configuration paths. Validate uses
|
||||
/state/repository and /state/repository.ta-cache under the writable /state mount;
|
||||
daemon uses /data/state and /data/state.ta-cache. Existing /state databases need
|
||||
an explicit migration or separate cache mount before switching to these paths.
|
||||
|
||||
The all5 examples explicitly enable TA constraints. Copy `tals/*.tal` and
|
||||
`tals/*.constraints` from the repository into INPUT_DIR. Customize those copies
|
||||
or set top-level `ta-constraints-enabled = false` to disable all policies,
|
||||
including same-stem file discovery. See [provenance](../../tals/README.md).
|
||||
|
||||
## Local HTTPS test repository
|
||||
|
||||
`validate-localhost.toml` explicitly sets `http-root-cert` to the CA generated
|
||||
by `tests/support/generate_repository.py`. The server runs on the host at
|
||||
`localhost:8443`; the Compose example therefore uses host networking. The
|
||||
fixture and its CA are generated for the test run and are not production trust
|
||||
roots:
|
||||
|
||||
```bash
|
||||
work="$(mktemp -d)"
|
||||
python3 tests/support/generate_repository.py \
|
||||
--rrdp-host localhost --rrdp-port 8443 --output "$work/fixture"
|
||||
ln -s cases/baseline-v1/http "$work/fixture/active"
|
||||
mkdir -p "$work/output" "$work/state"
|
||||
python3 tests/support/serve_repository.py \
|
||||
"$work/fixture/active" 8443 \
|
||||
"$work/fixture/certs/rrdp-server.pem" \
|
||||
"$work/fixture/certs/rrdp-server.key" >"$work/server.log" 2>&1 &
|
||||
server_pid="$!"
|
||||
trap 'kill "$server_pid" 2>/dev/null || true; rm -rf "$work"' EXIT
|
||||
for _ in $(seq 1 50); do grep -qx ready "$work/server.log" && break; sleep 0.1; done
|
||||
grep -qx ready "$work/server.log"
|
||||
export CONFIG_FILE="$PWD/docker/examples/validate-localhost.toml"
|
||||
export FIXTURE_DIR="$work/fixture" OUTPUT_DIR="$work/output" STATE_DIR="$work/state"
|
||||
export PUID="$(id -u)" PGID="$(id -g)"
|
||||
docker compose -f docker/compose.localhost.yaml run --build --rm validator
|
||||
```
|
||||
|
||||
@@ -10,30 +10,37 @@ shutdown-grace-secs = 30
|
||||
run-timeout-secs = 1800
|
||||
require-complete = true
|
||||
ta-refresh-policy = "allow-valid-cache"
|
||||
# Set false to ignore all constraints files, including adjacent auto-discovery.
|
||||
ta-constraints-enabled = true
|
||||
log-level = "info"
|
||||
log-format = "text"
|
||||
|
||||
[[anchors]]
|
||||
id = "afrinic"
|
||||
tal = "/input/afrinic.tal"
|
||||
constraints = "/input/afrinic.constraints"
|
||||
# ta = "/input/afrinic.cer" # uncomment to pin a fixed TA certificate
|
||||
|
||||
[[anchors]]
|
||||
id = "apnic"
|
||||
tal = "/input/apnic.tal"
|
||||
constraints = "/input/apnic.constraints"
|
||||
# ta = "/input/apnic.cer" # uncomment to pin a fixed TA certificate
|
||||
|
||||
[[anchors]]
|
||||
id = "arin"
|
||||
tal = "/input/arin.tal"
|
||||
constraints = "/input/arin.constraints"
|
||||
# ta = "/input/arin.cer" # uncomment to pin a fixed TA certificate
|
||||
|
||||
[[anchors]]
|
||||
id = "lacnic"
|
||||
tal = "/input/lacnic.tal"
|
||||
constraints = "/input/lacnic.constraints"
|
||||
# ta = "/input/lacnic.cer" # uncomment to pin a fixed TA certificate
|
||||
|
||||
[[anchors]]
|
||||
id = "ripe"
|
||||
tal = "/input/ripe.tal"
|
||||
constraints = "/input/ripe.constraints"
|
||||
# ta = "/input/ripe.cer" # uncomment to pin a fixed TA certificate
|
||||
|
||||
@@ -8,30 +8,37 @@ ccr-out = "/output/result.ccr"
|
||||
run-timeout-secs = 1800
|
||||
require-complete = true
|
||||
ta-refresh-policy = "allow-valid-cache"
|
||||
# Set false to ignore all constraints files, including adjacent auto-discovery.
|
||||
ta-constraints-enabled = true
|
||||
log-level = "info"
|
||||
log-format = "text"
|
||||
|
||||
[[anchors]]
|
||||
id = "afrinic"
|
||||
tal = "/input/afrinic.tal"
|
||||
constraints = "/input/afrinic.constraints"
|
||||
# ta = "/input/afrinic.cer" # uncomment to pin a fixed TA certificate
|
||||
|
||||
[[anchors]]
|
||||
id = "apnic"
|
||||
tal = "/input/apnic.tal"
|
||||
constraints = "/input/apnic.constraints"
|
||||
# ta = "/input/apnic.cer" # uncomment to pin a fixed TA certificate
|
||||
|
||||
[[anchors]]
|
||||
id = "arin"
|
||||
tal = "/input/arin.tal"
|
||||
constraints = "/input/arin.constraints"
|
||||
# ta = "/input/arin.cer" # uncomment to pin a fixed TA certificate
|
||||
|
||||
[[anchors]]
|
||||
id = "lacnic"
|
||||
tal = "/input/lacnic.tal"
|
||||
constraints = "/input/lacnic.constraints"
|
||||
# ta = "/input/lacnic.cer" # uncomment to pin a fixed TA certificate
|
||||
|
||||
[[anchors]]
|
||||
id = "ripe"
|
||||
tal = "/input/ripe.tal"
|
||||
constraints = "/input/ripe.constraints"
|
||||
# ta = "/input/ripe.cer" # uncomment to pin a fixed TA certificate
|
||||
|
||||
21
docker/examples/validate-localhost.toml
Normal file
21
docker/examples/validate-localhost.toml
Normal file
@@ -0,0 +1,21 @@
|
||||
# Use with docker/compose.localhost.yaml or docker run --network host.
|
||||
# The fixture is mounted at /fixture and is created by
|
||||
# tests/support/generate_repository.py.
|
||||
config-version = 1
|
||||
mode = "validate"
|
||||
out = "/output"
|
||||
rrdp-state-dir = "/state/repository"
|
||||
rrdp-sync-mode = "snapshot"
|
||||
ccr-out = "/output/result.ccr"
|
||||
http-timeout-secs = 5
|
||||
# This is the CA for the fixture's HTTPS RRDP server, not an RPKI TA.
|
||||
http-root-cert = ["/fixture/certs/rrdp-ca.pem"]
|
||||
log-level = "info"
|
||||
log-format = "text"
|
||||
require-complete = true
|
||||
run-timeout-secs = 300
|
||||
|
||||
[[anchors]]
|
||||
id = "custom"
|
||||
tal = "/fixture/tal/custom.tal"
|
||||
ta = "/fixture/ta/custom-ta.cer"
|
||||
@@ -52,6 +52,7 @@ those choices do not change the built-in defaults.
|
||||
| `config-version` | Integer | Explicit `1` required | Configuration schema version, not the software version. Missing or unsupported versions are rejected. |
|
||||
| `mode` | String | Required | `validate` or `daemon`; must match the command. |
|
||||
| `anchors` | Array of tables | At least one required | Write `[[anchors]]` entries; see section 5. No automatic TAL-directory scan. |
|
||||
| `ta-constraints-enabled` | Boolean | true | Apply explicit or adjacent TA constraints files. False skips all constraints loading and enforcement, including adjacent discovery; unused missing or malformed files are ignored. |
|
||||
| `ta-refresh-policy` | String | `allow-valid-cache` | On automatic TA download failure, permit a revalidated, usable cached certificate. `require-fresh` prohibits fallback. Does not replace fixed TA files. |
|
||||
| `max-ca-depth` | Nonnegative integer | 64 | Maximum CA validation-tree depth. Zero is accepted by configuration parsing, but is a depth limit, not unlimited traversal. Usually keep 64. |
|
||||
| `http-timeout-secs` | Nonnegative integer, seconds | 300 | HTTP fetch timeout. Zero is normalized to one second, not unlimited. Does not set the whole-run or rsync timeout. |
|
||||
@@ -113,7 +114,7 @@ otherwise 3 if strict completion is enabled and any cycle was partial; otherwise
|
||||
| `id` | String | TAL filename stem | Identifier in results, logs and constraints. An explicitly empty string also falls back to the filename stem. Resolved IDs must be nonempty and unique; explicit names are preferred. |
|
||||
| `tal` | File path | Required | TAL obtained from an independently trusted source; must exist and parse during preflight. Contains certificate URIs and the trusted public key. |
|
||||
| `ta` | File path | Omitted: automatic mode | If present, selects a fixed DER TA certificate. Preflight checks binding, certificate profile/signature and validity. Network downloads do not silently replace it. |
|
||||
| `constraints` | File path | Discover same-stem `.constraints` | For ripe.tal, try ripe.constraints. Absence of that file means no additional constraints. An explicit path must exist and parse. Omitting this setting does not disable discovery; an empty string is not a disable switch. |
|
||||
| `constraints` | File path | Discover same-stem `.constraints` | For ripe.tal, try ripe.constraints. Absence of that file means no additional constraints. When ta-constraints-enabled is true, an explicit path must exist and parse. Omitting this setting does not disable discovery; an empty string is not a disable switch. Set top-level `ta-constraints-enabled = false` to disable all constraints. |
|
||||
|
||||
Automatic refresh updates the **TA certificate, never the TAL file**. Each
|
||||
validate run or daemon cycle tries the TAL's HTTPS/rsync URIs in order. There is
|
||||
@@ -292,3 +293,29 @@ produces this excerpt, not the full print output:
|
||||
| Logs still JSON | Check top-level settings, recreate the container and inspect new logs. Metadata remains JSON intentionally. |
|
||||
| Exited with code 3 | Stopped with partial aggregate results; inspect summaries/lifecycle logs rather than repeatedly stopping. |
|
||||
| Latest absent | No complete success yet; partial does not publish even when it exits 0. |
|
||||
|
||||
## TA resource constraints
|
||||
|
||||
The repository includes five OpenBSD TALs and matching constraints in
|
||||
[`tals/`](../tals/README.md), with pinned provenance and checksums. Both all5
|
||||
examples explicitly enable them. To customize one anchor, edit its constraints
|
||||
file or its `constraints = "/input/custom.constraints"` path. Paths must be
|
||||
visible inside the container; relative paths resolve against the TOML directory.
|
||||
|
||||
To disable every anchor's constraints, set this **before** `[[anchors]]`:
|
||||
|
||||
```toml
|
||||
ta-constraints-enabled = false
|
||||
```
|
||||
|
||||
This takes precedence over explicit paths and same-stem discovery. Re-enable
|
||||
with `true`; enabled explicit paths must be readable and syntactically valid.
|
||||
Absent adjacent files are allowed for custom TALs without explicit paths.
|
||||
Check/print and actual validation use the same selection rules. The summary
|
||||
records `taConstraintsEnabled` and `taConstraintsApplied` (anchor IDs and paths).
|
||||
A loaded empty file imposes no additional restrictions; enabled alone does not
|
||||
imply a file was found.
|
||||
|
||||
Each run loads a fresh immutable policy snapshot. Reusing RRDP state does not
|
||||
reuse validation results from the previous policy. Stop and recreate the daemon
|
||||
to adopt TOML changes; follow the Docker reload procedure after editing files.
|
||||
|
||||
@@ -44,12 +44,46 @@ The template mounts the TOML read-only at `/config/validate.toml` and invokes
|
||||
`panda-rpki validate --config /config/validate.toml`. Host variables only select
|
||||
mounts, image and container UID/GID; they are not read as validator settings.
|
||||
|
||||
## All five RIRs
|
||||
## Local HTTPS test repository
|
||||
|
||||
Put the five RIR TAL files (TA certificates are optional) under `input/` and list them as named anchors in a
|
||||
TOML with `/input/...` paths. Then set `CONFIG_FILE` to that file and run:
|
||||
Use [validate-localhost.toml](../docker/examples/validate-localhost.toml) and
|
||||
[compose.localhost.yaml](../docker/compose.localhost.yaml) to run the generated
|
||||
HTTPS repository used by the regression tests. The TOML explicitly sets
|
||||
`http-root-cert = ["/fixture/certs/rrdp-ca.pem"]`; this is the generated test
|
||||
server CA, separate from the RPKI trust anchor. The validator uses host
|
||||
networking because the generated RRDP URI is `https://localhost:8443`:
|
||||
|
||||
```bash
|
||||
work="$(mktemp -d)"
|
||||
python3 tests/support/generate_repository.py \
|
||||
--rrdp-host localhost --rrdp-port 8443 --output "$work/fixture"
|
||||
ln -s cases/baseline-v1/http "$work/fixture/active"
|
||||
mkdir -p "$work/output" "$work/state"
|
||||
python3 tests/support/serve_repository.py \
|
||||
"$work/fixture/active" 8443 \
|
||||
"$work/fixture/certs/rrdp-server.pem" \
|
||||
"$work/fixture/certs/rrdp-server.key" >"$work/server.log" 2>&1 &
|
||||
server_pid="$!"
|
||||
trap 'kill "$server_pid" 2>/dev/null || true; rm -rf "$work"' EXIT
|
||||
for _ in $(seq 1 50); do grep -qx ready "$work/server.log" && break; sleep 0.1; done
|
||||
grep -qx ready "$work/server.log"
|
||||
export CONFIG_FILE="$PWD/docker/examples/validate-localhost.toml"
|
||||
export FIXTURE_DIR="$work/fixture" OUTPUT_DIR="$work/output" STATE_DIR="$work/state"
|
||||
export PUID="$(id -u)" PGID="$(id -g)"
|
||||
docker compose -f docker/compose.localhost.yaml run --build --rm validator
|
||||
```
|
||||
|
||||
## All five RIRs
|
||||
|
||||
Copy the vendored [OpenBSD TALs and constraints](../tals/README.md) into an
|
||||
operator-managed input directory. Review the retained upstream notices, including
|
||||
the ARIN disclaimer. TA certificates are optional; the examples refresh them.
|
||||
Both all5 templates enable constraints by default:
|
||||
|
||||
```bash
|
||||
mkdir -p input state/all5 output/all5
|
||||
cp tals/*.tal tals/*.constraints input/
|
||||
cp docker/examples/validate-all5.toml all5.toml
|
||||
export CONFIG_FILE="$PWD/all5.toml"
|
||||
export INPUT_DIR="$PWD/input" STATE_DIR="$PWD/state/all5" OUTPUT_DIR="$PWD/output/all5"
|
||||
docker compose -f docker/compose.all5.yaml run --build --rm validator
|
||||
@@ -116,6 +150,7 @@ These templates use automatic **TA certificate** refresh, text/info logs and
|
||||
| Compose file | Complete TOML |
|
||||
| --- | --- |
|
||||
| `compose.yaml` | [validate.toml](../docker/examples/validate.toml) |
|
||||
| `compose.localhost.yaml` | [validate-localhost.toml](../docker/examples/validate-localhost.toml) |
|
||||
| `compose.all5.yaml` | [validate-all5.toml](../docker/examples/validate-all5.toml) |
|
||||
| `compose.daemon.yaml` | [daemon.toml](../docker/examples/daemon.toml) |
|
||||
| `compose.all5-daemon.yaml` | [daemon-all5.toml](../docker/examples/daemon-all5.toml) |
|
||||
@@ -123,6 +158,8 @@ These templates use automatic **TA certificate** refresh, text/info logs and
|
||||
For example, from the repository root:
|
||||
|
||||
```bash
|
||||
mkdir -p input
|
||||
cp tals/*.tal tals/*.constraints input/
|
||||
cp docker/examples/daemon-all5.toml daemon.toml
|
||||
export CONFIG_FILE="$PWD/daemon.toml"
|
||||
export INPUT_DIR="$PWD/input" DAEMON_DIR="$PWD/daemon-state"
|
||||
@@ -187,3 +224,16 @@ The controller logs are in `docker compose logs`; child diagnostics are in
|
||||
format. JSON summary/metadata files remain JSON even with text diagnostics.
|
||||
`latest` exists only after a complete success; partial runs do not create or
|
||||
replace it, including the first run after upgrading an old state root.
|
||||
|
||||
## Change or disable constraints
|
||||
|
||||
Edit the copied `input/<rir>.constraints` files, or set an anchor's `constraints`
|
||||
to a different file under `/input`. Set top-level `ta-constraints-enabled = false`
|
||||
to disable all policies, including same-stem auto-discovery. The all5 examples
|
||||
use `true` and explicit paths so missing files fail configuration checks.
|
||||
|
||||
Use the stop/check/print/force-recreate steps above after editing. Validate-only
|
||||
runs read the configuration and policies afresh on each invocation. Do not
|
||||
copy vendored files over customized input files during an image upgrade; merge
|
||||
upstream updates deliberately and retain backups. No online TAL or policy
|
||||
update is performed by the validator.
|
||||
|
||||
@@ -6,7 +6,11 @@ Panda RPKI requires a TAL for each configured anchor. The TAL supplies the
|
||||
trusted public key and its certificate URI. You may pin a matching DER-encoded
|
||||
TA certificate in TOML, or omit `ta` and let Panda fetch, validate and cache the
|
||||
current certificate on each run. A certificate alone is not a substitute for an
|
||||
independently obtained TAL. No RIR inputs are bundled with this project.
|
||||
independently obtained TAL. The repository includes a pinned OpenBSD snapshot of all five TALs and resource
|
||||
constraints in [`tals/`](../tals/README.md); TA certificates are not bundled.
|
||||
The all5 Compose examples use these policies by default. Copy the ten files
|
||||
to your managed input directory, inspect their provenance, and follow the
|
||||
[Docker instructions](docker.md#all-five-rirs).
|
||||
|
||||
## Automatic and fixed certificate modes
|
||||
|
||||
|
||||
@@ -10,6 +10,7 @@ also needs a valid, matching ripe.cer. No live inputs are bundled here.
|
||||
| [validate-minimal.toml](validate-minimal.toml) | Minimal automatic TA; built-in defaults |
|
||||
| [validate-full.toml](validate-full.toml) | Common/validate settings, strict completion, successful publication |
|
||||
| [validate-fixed.toml](validate-fixed.toml) | Fixed TA certificate |
|
||||
| [validate-localhost.toml](validate-localhost.toml) | Generated localhost HTTPS repository with an explicit HTTP CA |
|
||||
| [daemon-all5.toml](daemon-all5.toml) | Five automatic TAs, continuous operation |
|
||||
| [daemon-three.toml](daemon-three.toml) | Five automatic TAs, three cycles with independent state |
|
||||
|
||||
@@ -30,3 +31,29 @@ one exists.
|
||||
Full/daemon examples explicitly choose require-complete=true and
|
||||
run-timeout-secs=1800; built-in defaults are false and 0. Use the
|
||||
[Docker examples](../../docker/examples/README.md) for container paths.
|
||||
|
||||
## Local HTTPS test repository
|
||||
|
||||
`validate-localhost.toml` is a runnable example for the generated repository
|
||||
used by the regression tests. It explicitly sets `http-root-cert` to the test
|
||||
CA and uses a fixed RPKI TA so the run does not depend on an external TA
|
||||
endpoint. Copy it beside the generated fixture because its paths are relative
|
||||
to the configuration file:
|
||||
|
||||
```bash
|
||||
work="$(mktemp -d)"
|
||||
cp examples/config/validate-localhost.toml "$work/validate.toml"
|
||||
python3 tests/support/generate_repository.py \
|
||||
--rrdp-host localhost --rrdp-port 8443 --output "$work/fixture"
|
||||
ln -s cases/baseline-v1/http "$work/fixture/active"
|
||||
mkdir -p "$work/output/localhost" "$work/state/localhost"
|
||||
python3 tests/support/serve_repository.py \
|
||||
"$work/fixture/active" 8443 \
|
||||
"$work/fixture/certs/rrdp-server.pem" \
|
||||
"$work/fixture/certs/rrdp-server.key" >"$work/server.log" 2>&1 &
|
||||
server_pid="$!"
|
||||
trap 'kill "$server_pid" 2>/dev/null || true; rm -rf "$work"' EXIT
|
||||
for _ in $(seq 1 50); do grep -qx ready "$work/server.log" && break; sleep 0.1; done
|
||||
grep -qx ready "$work/server.log"
|
||||
target/release/panda-rpki validate --config "$work/validate.toml"
|
||||
```
|
||||
|
||||
20
examples/config/validate-localhost.toml
Normal file
20
examples/config/validate-localhost.toml
Normal file
@@ -0,0 +1,20 @@
|
||||
# Copy this file into a temporary test directory next to the generated fixture.
|
||||
# The fixture is created by tests/support/generate_repository.py.
|
||||
config-version = 1
|
||||
mode = "validate"
|
||||
out = "output/localhost"
|
||||
rrdp-state-dir = "state/localhost"
|
||||
rrdp-sync-mode = "snapshot"
|
||||
ccr-out = "output/localhost/result.ccr"
|
||||
http-timeout-secs = 5
|
||||
# This is the CA for the fixture's HTTPS RRDP server, not an RPKI TA.
|
||||
http-root-cert = ["fixture/certs/rrdp-ca.pem"]
|
||||
log-level = "info"
|
||||
log-format = "text"
|
||||
require-complete = true
|
||||
run-timeout-secs = 300
|
||||
|
||||
[[anchors]]
|
||||
id = "custom"
|
||||
tal = "fixture/tal/custom.tal"
|
||||
ta = "fixture/ta/custom-ta.cer"
|
||||
@@ -21,6 +21,7 @@ pub struct Config {
|
||||
pub mode: String,
|
||||
pub anchors: Vec<Anchor>,
|
||||
pub ta_refresh_policy: String,
|
||||
pub ta_constraints_enabled: bool,
|
||||
pub max_ca_depth: usize,
|
||||
pub http_timeout_secs: u64,
|
||||
pub http_root_cert: Vec<PathBuf>,
|
||||
@@ -51,6 +52,7 @@ impl Default for Config {
|
||||
mode: String::new(),
|
||||
anchors: Vec::new(),
|
||||
ta_refresh_policy: "allow-valid-cache".into(),
|
||||
ta_constraints_enabled: true,
|
||||
max_ca_depth: 64,
|
||||
http_timeout_secs: 300,
|
||||
http_root_cert: Vec::new(),
|
||||
@@ -270,17 +272,13 @@ impl Config {
|
||||
&std::fs::read(ta).map_err(|e| format!("read TA: {e}"))?,
|
||||
)?;
|
||||
}
|
||||
let constraints = anchor
|
||||
.constraints
|
||||
.clone()
|
||||
.unwrap_or_else(|| anchor.tal.with_extension("constraints"));
|
||||
if anchor.constraints.is_some() || constraints.exists() {
|
||||
crate::ta_constraints::TaConstraintsByTal::load_for_tals(
|
||||
&[anchor.input(anchor.ta.as_deref().unwrap_or(&anchor.tal))],
|
||||
&[format!("{}={}", anchor.id, constraints.display())],
|
||||
)?;
|
||||
}
|
||||
}
|
||||
let inputs: Vec<_> = self
|
||||
.anchors
|
||||
.iter()
|
||||
.map(|anchor| anchor.input(anchor.ta.as_deref().unwrap_or(&anchor.tal)))
|
||||
.collect();
|
||||
self.load_constraints(&inputs)?;
|
||||
for path in &self.http_root_cert {
|
||||
reqwest::Certificate::from_pem(
|
||||
&std::fs::read(path).map_err(|e| format!("read HTTP root: {e}"))?,
|
||||
@@ -323,6 +321,29 @@ impl Config {
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Use the same policy selection for config inspection and actual validation.
|
||||
/// Explicit disable takes precedence over paths and adjacent-file discovery.
|
||||
pub(crate) fn load_constraints(
|
||||
&self,
|
||||
inputs: &[crate::scheduler::types::TalInputSpec],
|
||||
) -> Result<crate::ta_constraints::TaConstraintsByTal, String> {
|
||||
if !self.ta_constraints_enabled {
|
||||
return Ok(crate::ta_constraints::TaConstraintsByTal::default());
|
||||
}
|
||||
let overrides: Vec<String> = self
|
||||
.anchors
|
||||
.iter()
|
||||
.filter(|anchor| inputs.iter().any(|input| input.tal_id == anchor.id))
|
||||
.filter_map(|anchor| {
|
||||
anchor
|
||||
.constraints
|
||||
.as_ref()
|
||||
.map(|path| format!("{}={}", anchor.id, path.display()))
|
||||
})
|
||||
.collect();
|
||||
crate::ta_constraints::TaConstraintsByTal::load_for_tals(inputs, &overrides)
|
||||
}
|
||||
|
||||
pub(crate) fn child_config(
|
||||
&self,
|
||||
out: &Path,
|
||||
@@ -389,3 +410,62 @@ fn collect_sources(
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn constraints_selection_disable_override_and_reload() {
|
||||
let dir = tempfile::tempdir().unwrap();
|
||||
let tal = dir.path().join("test.tal");
|
||||
let adjacent = tal.with_extension("constraints");
|
||||
std::fs::write(&adjacent, "allow 192.0.2.0/24\n").unwrap();
|
||||
let mut config = Config {
|
||||
anchors: vec![Anchor {
|
||||
id: "test".into(),
|
||||
tal,
|
||||
ta: None,
|
||||
constraints: None,
|
||||
}],
|
||||
..Default::default()
|
||||
};
|
||||
let inputs = vec![config.anchors[0].input(&config.anchors[0].tal)];
|
||||
assert!(
|
||||
config
|
||||
.load_constraints(&inputs)
|
||||
.unwrap()
|
||||
.for_tal("test")
|
||||
.is_some()
|
||||
);
|
||||
// Read fresh policy on each invocation, even with unchanged TAL/state.
|
||||
std::fs::write(&adjacent, "invalid policy").unwrap();
|
||||
assert!(config.load_constraints(&inputs).is_err());
|
||||
let explicit = dir.path().join("custom.constraints");
|
||||
std::fs::write(&explicit, "deny 192.0.2.0/24\n").unwrap();
|
||||
config.anchors[0].constraints = Some(explicit.clone());
|
||||
assert_eq!(
|
||||
config
|
||||
.load_constraints(&inputs)
|
||||
.unwrap()
|
||||
.for_tal("test")
|
||||
.unwrap()
|
||||
.source(),
|
||||
explicit
|
||||
);
|
||||
std::fs::remove_file(explicit).unwrap();
|
||||
assert!(config.load_constraints(&inputs).is_err());
|
||||
config.ta_constraints_enabled = false;
|
||||
assert!(config.load_constraints(&inputs).unwrap().is_empty());
|
||||
config.anchors[0].constraints = None;
|
||||
assert!(config.load_constraints(&inputs).unwrap().is_empty());
|
||||
let child: Config = toml::from_str(
|
||||
&config
|
||||
.child_config(dir.path(), dir.path(), "delta")
|
||||
.unwrap(),
|
||||
)
|
||||
.unwrap();
|
||||
assert!(!child.ta_constraints_enabled);
|
||||
assert!(child.load_constraints(&inputs).unwrap().is_empty());
|
||||
}
|
||||
}
|
||||
|
||||
@@ -90,18 +90,15 @@ fn execute(config: &Config, run_id: &str) -> Result<i32, String> {
|
||||
observer.finish(false);
|
||||
return Err("all trust anchors failed".into());
|
||||
}
|
||||
let overrides: Vec<String> = config
|
||||
.anchors
|
||||
let constraints = config.load_constraints(&inputs)?;
|
||||
let applied_constraints: Vec<Value> = inputs
|
||||
.iter()
|
||||
.filter(|a| inputs.iter().any(|i| i.tal_id == a.id))
|
||||
.filter_map(|a| {
|
||||
a.constraints
|
||||
.as_ref()
|
||||
.map(|p| format!("{}={}", a.id, p.display()))
|
||||
.filter_map(|input| {
|
||||
constraints
|
||||
.for_tal(&input.tal_id)
|
||||
.map(|policy| json!({"id": input.tal_id, "path": policy.source()}))
|
||||
})
|
||||
.collect();
|
||||
let constraints =
|
||||
crate::ta_constraints::TaConstraintsByTal::load_for_tals(&inputs, &overrides)?;
|
||||
// All runtime artifacts are first written under an isolated attempt directory.
|
||||
let staging = tempfile::Builder::new()
|
||||
.prefix(".validation-")
|
||||
@@ -148,6 +145,8 @@ fn execute(config: &Config, run_id: &str) -> Result<i32, String> {
|
||||
} else {
|
||||
"success"
|
||||
};
|
||||
summary["taConstraintsEnabled"] = json!(config.ta_constraints_enabled);
|
||||
summary["taConstraintsApplied"] = json!(applied_constraints);
|
||||
summary["resultStatus"] = json!(status);
|
||||
summary["taFailedCount"] = json!(failed);
|
||||
summary["taCacheFallbackCount"] = json!(cached);
|
||||
|
||||
42
tals/README.md
Normal file
42
tals/README.md
Normal file
@@ -0,0 +1,42 @@
|
||||
# RIR trust anchors and resource constraints
|
||||
|
||||
These five TALs and five matching constraints files are unmodified copies from
|
||||
[OpenBSD src/etc/rpki](https://github.com/openbsd/src/tree/c10aa57bf0a6504676d00e24f531b5a0f3fa19de/etc/rpki).
|
||||
|
||||
- Upstream repository: https://github.com/openbsd/src
|
||||
- Pinned commit: `c10aa57bf0a6504676d00e24f531b5a0f3fa19de`
|
||||
- Retrieved: 2026-09-18 (UTC)
|
||||
- Integrity: `cd tals && sha256sum --check SHA256SUMS`
|
||||
|
||||
Upstream comments, attribution and terms are retained in each original file.
|
||||
In particular, read the ARIN disclaimer in `arin.tal`
|
||||
before using it. These third-party data files are not relicensed under the
|
||||
Panda RPKI source-code license. See OpenBSD's [copyright policy](https://www.openbsd.org/policy.html)
|
||||
for its distribution policy; the per-file notices and referenced terms remain applicable.
|
||||
|
||||
The files contain trust-anchor locators and local resource policy, not TA
|
||||
certificates. Automatic TA certificate refresh does not update these files.
|
||||
Constraints limit resources accepted for signed objects beneath the matching
|
||||
anchor; review upstream changes before adopting them.
|
||||
|
||||
## Use and customization
|
||||
|
||||
Copy the ten files into a directory you manage and set Compose `INPUT_DIR` to
|
||||
that directory. Both all5 TOML examples explicitly enable constraints and use
|
||||
`/input/<rir>.constraints`. Edit those files or set an anchor's `constraints`
|
||||
path to another file under the input mount. To disable the policy globally,
|
||||
set top-level `ta-constraints-enabled = false` before `[[anchors]]`.
|
||||
See [configuration](../docs/configuration.md) and [Docker instructions](../docs/docker.md)
|
||||
for validation and stop/check/recreate steps. Files are re-read for each
|
||||
validation run; a running validation uses its loaded policy snapshot.
|
||||
|
||||
## Updating the vendored snapshot
|
||||
|
||||
1. Select and record a full OpenBSD commit SHA; fetch all ten files from that
|
||||
same commit's `etc/rpki/` directory (never mix floating master revisions).
|
||||
2. Preserve bytes, filenames and notices; review TAL keys/URIs and every policy
|
||||
change, including per-file notices. Update this provenance and `SHA256SUMS`.
|
||||
3. Run `cargo test --locked` and configuration checks for both all5 templates,
|
||||
then validate output differences before deploying.
|
||||
4. Update operator-managed copies explicitly. Image upgrades must not overwrite
|
||||
a user's edited constraints; keep backups to roll back policy changes.
|
||||
10
tals/SHA256SUMS
Normal file
10
tals/SHA256SUMS
Normal file
@@ -0,0 +1,10 @@
|
||||
2838ef30ea27ce5705abf5f5adb131d8c35b1f50858338a2f3c84bb207c2fa35 afrinic.tal
|
||||
9c9dfc8fa60e1876d505e129e325d3d23b545cc31f13782753e1b8ffb44b7ab2 afrinic.constraints
|
||||
472e551f7c551c2e999e582b7c9437d3bee4900fe53afff62aeb28d4940ade94 apnic.tal
|
||||
38143f26afb91dee28c87d759a31d9d91daba459238fc434f30f10d7f4d2cf3b apnic.constraints
|
||||
446d1456518637541d6c22e8c1163e5a5751268e1fb2d075338ec8d49b3d8ed8 arin.tal
|
||||
13b2005035e4efa3f12b485b3618b2c54661135c58610dd237f71ac3c7896f37 arin.constraints
|
||||
45e6364b845b21d006bbe6dbea0f418a809117ff2feebfc23f731fb5e0cf718e lacnic.tal
|
||||
a8742507fc068fc7f74b0c8dc4153c2faedc29534bf52d356f0fd5d8a8abcd75 lacnic.constraints
|
||||
59ca27ef93f23682749fcefe7c6d70fbc723343549ff9e4d3996acaff79817fb ripe.tal
|
||||
c14154c3d0f43de96dc34c716f6fe86d4009ec67ed6bc1f54b5a7448ea1edbf3 ripe.constraints
|
||||
630
tals/afrinic.constraints
Normal file
630
tals/afrinic.constraints
Normal file
@@ -0,0 +1,630 @@
|
||||
# $OpenBSD: afrinic.constraints,v 1.4 2026/03/11 21:46:36 job Exp $
|
||||
|
||||
# From https://www.iana.org/assignments/ipv4-address-space/
|
||||
allow 41.0.0.0/8
|
||||
allow 102.0.0.0/8
|
||||
allow 105.0.0.0/8
|
||||
|
||||
allow 154.0.0.0/16
|
||||
allow 154.16.0.0/16
|
||||
allow 154.65.0.0 - 154.255.255.255
|
||||
allow 196.0.0.0 - 196.1.0.255
|
||||
allow 196.1.4.0/24
|
||||
allow 196.1.7.0 - 196.1.63.255
|
||||
allow 196.1.71.0/24
|
||||
allow 196.1.74.0 - 196.1.103.255
|
||||
allow 196.1.115.0 - 196.1.133.255
|
||||
allow 196.1.137.0/24
|
||||
allow 196.1.143.0 - 196.1.159.255
|
||||
allow 196.1.176.0 - 196.1.255.255
|
||||
allow 196.2.2.0/23
|
||||
allow 196.2.8.0 - 196.2.255.255
|
||||
allow 196.3.14.0/23
|
||||
allow 196.3.57.0 - 196.3.64.255
|
||||
allow 196.3.90.0/24
|
||||
allow 196.3.92.0 - 196.3.94.255
|
||||
allow 196.3.96.0/21
|
||||
allow 196.3.105.0/24
|
||||
allow 196.3.107.0 - 196.3.131.255
|
||||
allow 196.3.148.0/22
|
||||
allow 196.3.154.0 - 196.3.183.255
|
||||
allow 196.3.224.0 - 196.4.45.255
|
||||
allow 196.4.71.0 - 196.11.171.255
|
||||
allow 196.11.174.0 - 196.11.239.255
|
||||
allow 196.11.248.0/21
|
||||
allow 196.12.10.0 - 196.12.31.255
|
||||
allow 196.12.128.0/19
|
||||
allow 196.12.192.0 - 196.15.15.255
|
||||
allow 196.15.64.0 - 196.26.255.255
|
||||
allow 196.27.64.0 - 196.28.47.255
|
||||
allow 196.28.64.0 - 196.29.63.255
|
||||
allow 196.29.96.0 - 196.31.255.255
|
||||
allow 196.32.8.0 - 196.32.31.255
|
||||
allow 196.32.96.0/19
|
||||
allow 196.32.160.0 - 196.39.255.255
|
||||
allow 196.40.96.0 - 196.41.255.255
|
||||
allow 196.42.64.0 - 196.216.0.255
|
||||
allow 196.216.2.0 - 197.255.255.255
|
||||
|
||||
# From https://www.iana.org/assignments/ipv6-address-space/
|
||||
allow 2001:4200::/23
|
||||
allow 2c00::/12
|
||||
|
||||
# From https://www.iana.org/assignments/as-numbers/
|
||||
allow 36864 - 37887
|
||||
allow 327680 - 330751
|
||||
|
||||
# From https://www.iana.org/assignments/ipv4-recovered-address-space
|
||||
allow 45.96.0.0 - 45.111.255.255
|
||||
allow 45.192.0.0 - 45.222.255.255
|
||||
allow 45.240.0.0 - 45.247.255.255
|
||||
allow 66.251.128.0 - 66.251.191.255
|
||||
allow 139.26.0.0 - 139.26.255.255
|
||||
allow 146.196.128.0 - 146.196.255.255
|
||||
# 154.16.0.0 - 154.16.255.255 # already contained within 154/8
|
||||
allow 160.19.36.0 - 160.19.39.255
|
||||
allow 160.19.60.0 - 160.19.63.255
|
||||
allow 160.19.96.0 - 160.19.103.255
|
||||
allow 160.19.112.0 - 160.19.143.255
|
||||
allow 160.19.152.0 - 160.19.155.255
|
||||
allow 160.19.188.0 - 160.19.191.255
|
||||
allow 160.19.192.0 - 160.19.199.255
|
||||
allow 160.19.232.0 - 160.19.239.255
|
||||
allow 160.20.24.0 - 160.20.31.255
|
||||
allow 160.20.112.0 - 160.20.115.255
|
||||
allow 160.20.213.0 - 160.20.213.255
|
||||
allow 160.20.217.0 - 160.20.217.255
|
||||
allow 160.20.221.0 - 160.20.221.255
|
||||
allow 160.20.226.0 - 160.20.227.255
|
||||
allow 160.20.252.0 - 160.20.255.255
|
||||
allow 160.238.11.0 - 160.238.11.255
|
||||
allow 160.238.48.0 - 160.238.49.255
|
||||
allow 160.238.50.0 - 160.238.50.255
|
||||
allow 160.238.57.0 - 160.238.57.255
|
||||
allow 160.238.101.0 - 160.238.101.255
|
||||
allow 161.123.0.0 - 161.123.255.255
|
||||
allow 164.160.0.0 - 164.160.255.255
|
||||
allow 192.12.110.0 - 192.12.111.255
|
||||
allow 192.12.116.0 - 192.12.117.255
|
||||
allow 192.47.36.0 - 192.47.36.255
|
||||
allow 192.51.240.0 - 192.51.240.255
|
||||
allow 192.70.200.0 - 192.70.201.255
|
||||
allow 192.75.236.0 - 192.75.236.255
|
||||
allow 192.83.208.0 - 192.83.215.255
|
||||
allow 192.91.200.0 - 192.91.200.255
|
||||
allow 192.142.0.0 - 192.143.255.255
|
||||
allow 192.145.128.0 - 192.145.191.255
|
||||
allow 192.145.230.0 - 192.145.230.255
|
||||
allow 204.8.204.0 - 204.8.207.255
|
||||
allow 208.85.156.0 - 208.85.159.255
|
||||
|
||||
# From https://web.archive.org/web/20131120040037/http://www.ripe.net/lir-services/resource-management/erx/transferred-resources
|
||||
# From https://afrinic.net/fr/library/policies/220-erx-transfer
|
||||
allow 2561
|
||||
allow 3208
|
||||
allow 5536
|
||||
allow 6127
|
||||
allow 6713
|
||||
allow 6879
|
||||
allow 8524
|
||||
allow 8770
|
||||
allow 9129
|
||||
allow 11380
|
||||
allow 12455
|
||||
allow 12556
|
||||
allow 13224
|
||||
allow 15399
|
||||
allow 13569
|
||||
allow 15475
|
||||
allow 15706
|
||||
allow 15804
|
||||
allow 15825
|
||||
allow 15834
|
||||
allow 15964
|
||||
allow 16058
|
||||
allow 16214
|
||||
allow 16284
|
||||
allow 16853
|
||||
allow 16907
|
||||
allow 17652
|
||||
allow 19676
|
||||
allow 20294
|
||||
allow 20484
|
||||
allow 20858
|
||||
allow 20928
|
||||
allow 21003
|
||||
allow 21152
|
||||
allow 21242
|
||||
allow 21271
|
||||
allow 21278
|
||||
allow 21280
|
||||
allow 21391
|
||||
allow 21452
|
||||
allow 23549
|
||||
allow 23889
|
||||
allow 24736
|
||||
allow 24757
|
||||
allow 24788
|
||||
allow 24801
|
||||
allow 24835
|
||||
allow 24863
|
||||
allow 24878
|
||||
allow 24987
|
||||
allow 25163
|
||||
allow 25250
|
||||
allow 25362
|
||||
allow 25364
|
||||
allow 25543
|
||||
allow 25568
|
||||
allow 25576
|
||||
allow 28683
|
||||
allow 28698
|
||||
allow 28913
|
||||
allow 29091
|
||||
allow 29338
|
||||
allow 29340
|
||||
allow 29428
|
||||
allow 29495
|
||||
allow 29544
|
||||
allow 29571
|
||||
allow 29614
|
||||
allow 29674
|
||||
allow 30896
|
||||
allow 31065
|
||||
allow 31245
|
||||
allow 31619
|
||||
allow 83.143.24.0 - 83.143.31.255
|
||||
allow 84.205.96.0 - 84.205.127.255
|
||||
allow 131.176.0.0 - 131.176.255.255
|
||||
allow 163.121.0.0 - 163.121.255.255
|
||||
allow 165.231.0.0 - 165.231.255.255
|
||||
allow 192.52.232.0 - 192.52.232.255
|
||||
allow 193.17.215.0 - 193.17.215.255
|
||||
allow 193.19.232.0 - 193.19.235.255
|
||||
allow 193.41.146.0 - 193.41.147.255
|
||||
allow 193.108.23.0 - 193.108.23.255
|
||||
allow 193.108.28.0 - 193.108.28.255
|
||||
allow 193.109.66.0 - 193.109.67.255
|
||||
allow 193.110.104.0 - 193.110.105.255
|
||||
allow 193.194.128.0 - 193.194.128.255
|
||||
allow 193.227.128.0 - 193.227.128.255
|
||||
allow 194.9.64.0 - 194.9.65.255
|
||||
allow 194.9.82.0 - 194.9.83.255
|
||||
allow 195.24.80.0 - 195.24.87.255
|
||||
allow 195.39.218.0 - 195.39.219.255
|
||||
allow 195.234.120.0 - 195.234.123.255
|
||||
allow 195.234.168.0 - 195.234.168.255
|
||||
allow 195.234.185.0 - 195.234.185.255
|
||||
allow 195.234.252.0 - 195.234.255.255
|
||||
|
||||
# From https://www.ripe.net/participate/internet-governance/internet-technical-community/the-rir-system/afrinic/ripe-ncc-to-afrinic-transition
|
||||
allow 30980
|
||||
allow 30982 - 30999
|
||||
|
||||
# From https://afrinic.net/ast/pdf/afrinic-whois-audit-report-full-20210121.pdf
|
||||
# 12.3 Appendix A3
|
||||
allow 193.188.7.0/24
|
||||
allow 193.189.0.0/18
|
||||
allow 193.189.128.0/24
|
||||
allow 193.194.160.0/19
|
||||
allow 193.221.218.0/24
|
||||
|
||||
# From https://ftp.arin.net/afrinic/afrinic-transfers-by-resource.txt
|
||||
# Feb 21, 2005
|
||||
allow 1228 - 1232
|
||||
allow 2018
|
||||
allow 2905
|
||||
allow 3067
|
||||
allow 3068
|
||||
allow 3741
|
||||
allow 4178
|
||||
allow 4571
|
||||
allow 5713
|
||||
allow 5734
|
||||
allow 6083
|
||||
allow 6089
|
||||
allow 6149
|
||||
allow 6180
|
||||
allow 6187
|
||||
allow 6351
|
||||
allow 6529
|
||||
allow 6560
|
||||
allow 6968
|
||||
allow 7020
|
||||
allow 7154
|
||||
allow 7231
|
||||
allow 7390
|
||||
allow 7420
|
||||
allow 7460
|
||||
allow 7971
|
||||
allow 7972
|
||||
allow 8094
|
||||
allow 10247
|
||||
allow 10262
|
||||
allow 10331
|
||||
allow 10393
|
||||
allow 10474
|
||||
allow 10505
|
||||
allow 10540
|
||||
allow 10575
|
||||
allow 10798
|
||||
allow 10803
|
||||
allow 10898
|
||||
allow 10922
|
||||
allow 11125
|
||||
allow 11157
|
||||
allow 11201
|
||||
allow 11259
|
||||
allow 11265
|
||||
allow 11569
|
||||
allow 11645
|
||||
allow 11744
|
||||
allow 11845
|
||||
allow 11909
|
||||
allow 12091
|
||||
allow 12143
|
||||
allow 12258
|
||||
allow 13402
|
||||
allow 13519
|
||||
allow 13854
|
||||
allow 14029
|
||||
allow 14115
|
||||
allow 14331
|
||||
allow 14360
|
||||
allow 14429
|
||||
allow 14516
|
||||
allow 14988
|
||||
allow 15022
|
||||
allow 15159
|
||||
allow 16416
|
||||
allow 16547
|
||||
allow 16630
|
||||
allow 16637
|
||||
allow 16800
|
||||
allow 17148
|
||||
allow 17220
|
||||
allow 17260
|
||||
allow 17312
|
||||
allow 17400
|
||||
allow 18775
|
||||
allow 18922
|
||||
allow 18931
|
||||
allow 19136
|
||||
allow 19232
|
||||
allow 19711
|
||||
allow 19832
|
||||
allow 19847
|
||||
allow 20011
|
||||
allow 20086
|
||||
allow 20095
|
||||
allow 20180
|
||||
allow 20459
|
||||
allow 21739
|
||||
allow 21819
|
||||
allow 22354
|
||||
allow 22355
|
||||
allow 22386
|
||||
allow 22572
|
||||
allow 22690
|
||||
allow 22735
|
||||
allow 22750
|
||||
allow 22939
|
||||
allow 23058
|
||||
allow 25695
|
||||
allow 25726
|
||||
allow 25793
|
||||
allow 25818
|
||||
allow 26106
|
||||
allow 26130
|
||||
allow 26422
|
||||
allow 26625
|
||||
allow 26754
|
||||
allow 27576
|
||||
allow 27598
|
||||
allow 29918
|
||||
allow 29975
|
||||
allow 30073
|
||||
allow 30306
|
||||
allow 30429
|
||||
allow 30619
|
||||
allow 31810
|
||||
allow 31856
|
||||
allow 31960
|
||||
allow 32017
|
||||
allow 32279
|
||||
allow 32398
|
||||
allow 32437
|
||||
allow 32653
|
||||
allow 32714
|
||||
allow 32717
|
||||
allow 32842
|
||||
allow 32860
|
||||
allow 33567
|
||||
allow 33579
|
||||
allow 33762 - 33791
|
||||
allow 64.57.112.0 - 64.57.127.255
|
||||
allow 66.8.0.0 - 66.8.127.255
|
||||
allow 66.18.64.0 - 66.18.95.255
|
||||
allow 69.63.64.0 - 69.63.79.255
|
||||
allow 69.67.32.0 - 69.67.47.255
|
||||
allow 137.158.0.0 - 137.158.255.255
|
||||
allow 137.214.0.0 - 137.214.255.255
|
||||
allow 137.215.0.0 - 137.215.255.255
|
||||
allow 139.53.0.0 - 139.53.255.255
|
||||
allow 143.128.0.0 - 143.128.255.255
|
||||
allow 143.160.0.0 - 143.160.255.255
|
||||
allow 146.64.0.0 - 146.64.255.255
|
||||
allow 146.141.0.0 - 146.141.255.255
|
||||
allow 146.182.0.0 - 146.182.255.255
|
||||
allow 146.230.0.0 - 146.230.255.255
|
||||
allow 146.231.0.0 - 146.231.255.255
|
||||
allow 146.232.0.0 - 146.232.255.255
|
||||
allow 147.110.0.0 - 147.110.255.255
|
||||
allow 152.106.0.0 - 152.106.255.255
|
||||
allow 152.107.0.0 - 152.107.255.255
|
||||
allow 152.108.0.0 - 152.108.255.255
|
||||
allow 152.109.0.0 - 152.109.255.255
|
||||
allow 152.110.0.0 - 152.110.255.255
|
||||
allow 152.111.0.0 - 152.111.255.255
|
||||
allow 152.112.0.0 - 152.112.255.255
|
||||
allow 155.159.0.0 - 155.159.255.255
|
||||
allow 155.232.0.0 - 155.232.255.255
|
||||
allow 155.233.0.0 - 155.233.255.255
|
||||
allow 155.234.0.0 - 155.234.255.255
|
||||
allow 155.235.0.0 - 155.235.255.255
|
||||
allow 155.236.0.0 - 155.236.255.255
|
||||
allow 155.237.0.0 - 155.237.255.255
|
||||
allow 155.238.0.0 - 155.238.255.255
|
||||
allow 155.239.0.0 - 155.239.255.255
|
||||
allow 155.240.0.0 - 155.240.255.255
|
||||
allow 156.8.0.0 - 156.8.255.255
|
||||
allow 160.115.0.0 - 160.115.255.255
|
||||
allow 160.116.0.0 - 160.116.255.255
|
||||
allow 160.117.0.0 - 160.117.255.255
|
||||
allow 160.118.0.0 - 160.118.255.255
|
||||
allow 160.119.0.0 - 160.119.255.255
|
||||
allow 160.120.0.0 - 160.120.255.255
|
||||
allow 160.121.0.0 - 160.121.255.255
|
||||
allow 160.122.0.0 - 160.122.255.255
|
||||
allow 160.123.0.0 - 160.123.255.255
|
||||
allow 160.124.0.0 - 160.124.255.255
|
||||
allow 163.195.0.0 - 163.195.255.255
|
||||
allow 163.196.0.0 - 163.196.255.255
|
||||
allow 163.197.0.0 - 163.197.255.255
|
||||
allow 163.198.0.0 - 163.198.255.255
|
||||
allow 163.199.0.0 - 163.199.255.255
|
||||
allow 163.200.0.0 - 163.200.255.255
|
||||
allow 163.201.0.0 - 163.201.255.255
|
||||
allow 163.202.0.0 - 163.202.255.255
|
||||
allow 163.203.0.0 - 163.203.255.255
|
||||
allow 164.88.0.0 - 164.88.255.255
|
||||
allow 164.146.0.0 - 164.151.255.255
|
||||
allow 164.155.0.0 - 164.155.255.255
|
||||
allow 165.3.0.0 - 165.5.255.255
|
||||
allow 165.8.0.0 - 165.11.255.255
|
||||
allow 165.25.0.0 - 165.25.255.255
|
||||
allow 165.143.0.0 - 165.149.255.255
|
||||
allow 165.165.0.0 - 165.165.255.255
|
||||
allow 165.180.0.0 - 165.180.255.255
|
||||
allow 165.233.0.0 - 165.233.255.255
|
||||
allow 166.85.0.0 - 166.85.255.255
|
||||
allow 168.76.0.0 - 168.76.255.255
|
||||
allow 168.80.0.0 - 168.81.255.255
|
||||
allow 168.89.0.0 - 168.89.255.255
|
||||
allow 168.128.0.0 - 168.128.255.255
|
||||
allow 168.142.0.0 - 168.142.255.255
|
||||
allow 168.155.0.0 - 168.155.255.255
|
||||
allow 168.164.0.0 - 168.164.255.255
|
||||
allow 168.167.0.0 - 168.167.255.255
|
||||
allow 168.172.0.0 - 168.172.255.255
|
||||
allow 168.206.0.0 - 168.206.255.255
|
||||
allow 168.209.0.0 - 168.210.255.255
|
||||
allow 169.129.0.0 - 169.129.255.255
|
||||
allow 169.202.0.0 - 169.202.255.255
|
||||
allow 192.33.10.0 - 192.33.10.255
|
||||
allow 192.42.99.0 - 192.42.99.255
|
||||
allow 192.48.253.0 - 192.48.253.255
|
||||
allow 192.68.138.0 - 192.68.138.255
|
||||
allow 192.70.237.0 - 192.70.237.255
|
||||
allow 192.82.142.0 - 192.82.142.255
|
||||
allow 192.84.244.0 - 192.84.244.255
|
||||
allow 192.94.61.0 - 192.94.61.255
|
||||
allow 192.94.210.0 - 192.94.210.255
|
||||
allow 192.94.240.0 - 192.94.240.255
|
||||
allow 192.94.241.0 - 192.94.241.255
|
||||
allow 192.94.246.0 - 192.94.246.255
|
||||
allow 192.96.0.0 - 192.96.255.255
|
||||
allow 192.100.1.0 - 192.100.1.255
|
||||
allow 192.101.142.0 - 192.101.142.255
|
||||
allow 192.102.9.0 - 192.102.9.255
|
||||
allow 192.133.250.0 - 192.133.250.255
|
||||
allow 192.136.55.0 - 192.136.55.255
|
||||
allow 192.136.56.0 - 192.136.56.255
|
||||
allow 192.136.57.0 - 192.136.57.255
|
||||
allow 192.157.190.0 - 192.157.190.255
|
||||
allow 192.188.164.0 - 192.188.167.255
|
||||
allow 192.189.75.0 - 192.189.75.255
|
||||
allow 192.189.139.0 - 192.189.140.255
|
||||
allow 192.231.237.0 - 192.231.237.255
|
||||
allow 192.231.254.0 - 192.231.254.255
|
||||
allow 192.245.148.0 - 192.245.148.255
|
||||
allow 192.251.202.0 - 192.251.202.255
|
||||
allow 198.54.0.0 - 198.54.255.255
|
||||
allow 200.16.8.0 - 200.16.15.255
|
||||
allow 204.12.128.0 - 204.12.143.255
|
||||
allow 204.87.179.0 - 204.87.179.255
|
||||
allow 204.152.14.0 - 204.152.15.255
|
||||
allow 204.235.32.0 - 204.235.43.255
|
||||
allow 205.159.79.0 - 205.159.79.255
|
||||
allow 206.223.136.0 - 206.223.136.255
|
||||
allow 209.203.0.0 - 209.203.63.255
|
||||
allow 209.212.96.0 - 209.212.127.255
|
||||
allow 216.236.176.0 - 216.236.191.255
|
||||
|
||||
# From rpki.afrinic.net/repository/04E8B0D80F4D11E0B657D8931367AE7D/apnic-to-afrinic.cer
|
||||
# CN=APNICTOAFRINIC/serialNumber=6F1A103E1427FF03483ABFD9E34DACBE1524FF8B
|
||||
# Not Before: Mar 30 14:17:08 2020 GMT / Not After : Mar 30 00:00:00 2025 GMT
|
||||
# SHA256:B6w5P1mkoNyJtM99GfGLaaKkGfSkQ6+4eC4tPijBLyM=
|
||||
allow 202.123.0.0/19
|
||||
|
||||
# From rpki.afrinic.net/repository/04E8B0D80F4D11E0B657D8931367AE7D/ripe-to-afrinic.cer
|
||||
# CN=RIPETOAFRINIC/serialNumber=7F7AC180897983E29E937C0A187803C072755545
|
||||
# Not Before: Mar 30 14:17:12 2020 GMT / Not After : Mar 30 00:00:00 2025 GMT
|
||||
# SHA256:64eh2w7qQrFQVPaQrRJ4kA83gUgE3EDvm0D0AWHCXHM=
|
||||
allow 62.8.64.0/19
|
||||
allow 62.12.96.0/19
|
||||
allow 62.24.96.0/19
|
||||
allow 62.61.192.0/18
|
||||
allow 62.68.32.0/19
|
||||
allow 62.68.224.0/19
|
||||
allow 62.114.0.0/16
|
||||
allow 62.117.32.0/19
|
||||
allow 62.135.0.0/17
|
||||
allow 62.139.0.0/16
|
||||
allow 62.140.64.0/18
|
||||
allow 62.173.32.0/19
|
||||
allow 62.193.64.0/18
|
||||
allow 62.193.160.0/19
|
||||
allow 62.240.32.0/19
|
||||
allow 62.240.96.0/19
|
||||
allow 62.241.128.0/19
|
||||
allow 62.251.128.0/17
|
||||
allow 77.220.0.0/19
|
||||
allow 80.67.128.0/20
|
||||
allow 80.72.96.0/20
|
||||
allow 80.75.160.0/19
|
||||
allow 80.87.64.0/19
|
||||
allow 80.88.0.0/20
|
||||
allow 80.95.0.0/20
|
||||
allow 80.240.192.0/20
|
||||
allow 80.246.0.0/20
|
||||
allow 80.248.0.0/20
|
||||
allow 80.248.64.0/20
|
||||
allow 80.249.64.0/20
|
||||
allow 80.250.32.0/20
|
||||
allow 81.4.0.0/18
|
||||
allow 81.10.0.0/17
|
||||
allow 81.21.96.0/20
|
||||
allow 81.22.64.0/19
|
||||
allow 81.26.64.0/20
|
||||
allow 81.29.96.0/20
|
||||
allow 81.91.224.0/20
|
||||
allow 81.192.0.0/16
|
||||
allow 82.101.128.0/18
|
||||
allow 82.128.0.0/17
|
||||
allow 82.129.128.0/17
|
||||
allow 82.151.64.0/19
|
||||
allow 82.201.128.0/17
|
||||
allow 84.36.0.0/16
|
||||
allow 84.233.0.0/17
|
||||
allow 87.255.96.0/19
|
||||
allow 193.95.0.0/17
|
||||
allow 193.108.214.0/24
|
||||
allow 193.108.252.0/22
|
||||
allow 193.189.64.0 - 193.189.65.255
|
||||
allow 193.194.1.0 - 193.194.5.255
|
||||
allow 193.194.32.0 - 193.194.95.255
|
||||
allow 193.227.0.0/18
|
||||
allow 194.6.224.0/24
|
||||
allow 194.79.96.0/19
|
||||
allow 194.204.192.0/18
|
||||
allow 195.24.192.0/19
|
||||
allow 195.43.0.0/19
|
||||
allow 195.166.224.0/19
|
||||
allow 195.202.64.0/19
|
||||
allow 195.246.32.0/19
|
||||
allow 212.0.128.0/19
|
||||
allow 212.12.224.0/19
|
||||
allow 212.22.160.0/19
|
||||
allow 212.49.64.0/19
|
||||
allow 212.52.128.0/19
|
||||
allow 212.60.64.0/19
|
||||
allow 212.85.192.0/19
|
||||
allow 212.88.96.0/19
|
||||
allow 212.96.0.0/19
|
||||
allow 212.100.64.0/19
|
||||
allow 212.103.160.0/19
|
||||
allow 212.122.224.0/19
|
||||
allow 212.217.0.0/17
|
||||
allow 213.55.64.0/18
|
||||
allow 213.131.64.0/19
|
||||
allow 213.136.96.0/19
|
||||
allow 213.147.64.0/19
|
||||
allow 213.150.96.0/19
|
||||
allow 213.150.160.0 - 213.150.223.255
|
||||
allow 213.152.64.0/19
|
||||
allow 213.154.32.0 - 213.154.95.255
|
||||
allow 213.158.160.0/19
|
||||
allow 213.172.128.0/19
|
||||
allow 213.179.160.0/19
|
||||
allow 213.181.224.0/19
|
||||
allow 213.193.32.0/19
|
||||
allow 213.212.192.0/18
|
||||
allow 213.247.0.0/19
|
||||
allow 213.255.128.0/19
|
||||
allow 217.14.80.0/20
|
||||
allow 217.20.224.0/20
|
||||
allow 217.21.112.0/20
|
||||
allow 217.29.128.0/20
|
||||
allow 217.29.208.0/20
|
||||
allow 217.52.0.0/14
|
||||
allow 217.64.96.0/20
|
||||
allow 217.77.64.0/20
|
||||
allow 217.78.64.0/20
|
||||
allow 217.117.0.0/20
|
||||
allow 217.139.0.0/16
|
||||
allow 217.170.144.0/20
|
||||
allow 217.199.144.0/20
|
||||
|
||||
# From rpki.afrinic.net/repository/04E8B0D80F4D11E0B657D8931367AE7D/arin-to-afrinic.cer
|
||||
# CN=ARINTOAFRINIC/serialNumber=B87C5A75F3D957413AB998646946D4541D511455
|
||||
# Not Before: Mar 30 14:17:09 2020 GMT / Not After : Mar 30 00:00:00 2025 GMT
|
||||
# SHA256:wmJV3qcwiPcLtEMLBcvvyjs4V1Lz690bK3b8cv5v8F8=
|
||||
allow 129.0.0.0/16
|
||||
allow 129.18.0.0/16
|
||||
allow 129.45.0.0/16
|
||||
allow 129.56.0.0/16
|
||||
allow 129.122.0.0/16
|
||||
allow 129.140.0.0/16
|
||||
allow 129.205.0.0/16
|
||||
allow 129.232.0.0/16
|
||||
allow 137.63.0.0 - 137.64.255.255
|
||||
allow 137.115.0.0/16
|
||||
allow 137.171.0.0/16
|
||||
allow 137.196.0.0/16
|
||||
allow 137.255.0.0/16
|
||||
allow 155.0.0.0/16
|
||||
allow 155.11.0.0 - 155.12.255.255
|
||||
allow 155.89.0.0/16
|
||||
allow 155.93.0.0/16
|
||||
allow 155.196.0.0/16
|
||||
allow 155.251.0.0/16
|
||||
allow 155.255.0.0 - 156.0.255.255
|
||||
allow 156.38.0.0/16
|
||||
allow 156.155.0.0 - 156.255.255.255
|
||||
allow 160.0.0.0/16
|
||||
allow 160.77.0.0/16
|
||||
allow 160.89.0.0 - 160.90.255.255
|
||||
allow 160.105.0.0/16
|
||||
allow 160.113.0.0/16
|
||||
allow 160.152.0.0/16
|
||||
allow 160.154.0.0 - 160.179.255.255
|
||||
allow 160.181.0.0 - 160.184.255.255
|
||||
allow 160.224.0.0 - 160.226.255.255
|
||||
allow 160.242.0.0/16
|
||||
allow 160.255.0.0/16
|
||||
allow 165.0.0.0/16
|
||||
allow 165.16.0.0/16
|
||||
allow 165.49.0.0 - 165.63.255.255
|
||||
allow 165.73.0.0/16
|
||||
allow 165.90.0.0/16
|
||||
allow 165.169.0.0/16
|
||||
allow 165.210.0.0/15
|
||||
allow 165.255.0.0/16
|
||||
allow 168.211.0.0 - 168.211.255.255
|
||||
allow 168.253.0.0/16
|
||||
allow 169.0.0.0/15
|
||||
allow 169.159.0.0/16
|
||||
allow 169.239.0.0/16
|
||||
allow 169.255.0.0/16
|
||||
allow 192.109.242.0/24
|
||||
10
tals/afrinic.tal
Normal file
10
tals/afrinic.tal
Normal file
@@ -0,0 +1,10 @@
|
||||
rsync://rpki.afrinic.net/repository/AfriNIC.cer
|
||||
https://rpki.afrinic.net/repository/AfriNIC.cer
|
||||
|
||||
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxsAqAhWIO+ON2Ef9oRDM
|
||||
pKxv+AfmSLIdLWJtjrvUyDxJPBjgR+kVrOHUeTaujygFUp49tuN5H2C1rUuQavTH
|
||||
vve6xNF5fU3OkTcqEzMOZy+ctkbde2SRMVdvbO22+TH9gNhKDc9l7Vu01qU4LeJH
|
||||
k3X0f5uu5346YrGAOSv6AaYBXVgXxa0s9ZvgqFpim50pReQe/WI3QwFKNgpPzfQL
|
||||
6Y7fDPYdYaVOXPXSKtx7P4s4KLA/ZWmRL/bobw/i2fFviAGhDrjqqqum+/9w1hEl
|
||||
L/vqihVnV18saKTnLvkItA/Bf5i11Yhw2K7qv573YWxyuqCknO/iYLTR1DToBZcZ
|
||||
UQIDAQAB
|
||||
983
tals/apnic.constraints
Normal file
983
tals/apnic.constraints
Normal file
@@ -0,0 +1,983 @@
|
||||
# $OpenBSD: apnic.constraints,v 1.8 2026/07/09 12:29:52 job Exp $
|
||||
|
||||
# From https://www.iana.org/assignments/ipv6-unicast-address-assignments
|
||||
allow 2001:200::/23
|
||||
allow 2001:c00::/23
|
||||
allow 2001:e00::/23
|
||||
allow 2001:4400::/23
|
||||
allow 2001:8000::/19
|
||||
allow 2001:a000::/20
|
||||
allow 2001:b000::/20
|
||||
allow 2400::/12
|
||||
allow 2410::/12
|
||||
|
||||
# IX Assignments
|
||||
allow 2001:7fa::/32
|
||||
|
||||
# LACNIC ASNs cannot be transferred to APNIC
|
||||
# From https://www.iana.org/assignments/as-numbers/as-numbers.xhtml
|
||||
deny 27648 - 28671
|
||||
deny 52224 - 53247
|
||||
deny 61440 - 61951
|
||||
deny 64099 - 64197
|
||||
deny 262144 - 275868
|
||||
|
||||
# LACNIC ASNs cannot be transferred to APNIC
|
||||
# From nro-delegated-stats 20240417
|
||||
deny 278
|
||||
deny 676
|
||||
deny 1251
|
||||
deny 1292
|
||||
deny 1296
|
||||
deny 1797
|
||||
deny 1831
|
||||
deny 1840
|
||||
deny 1916
|
||||
deny 2146
|
||||
deny 2277
|
||||
deny 2549
|
||||
deny 2638
|
||||
deny 2708
|
||||
deny 2715 - 2716
|
||||
deny 2739
|
||||
deny 2904
|
||||
deny 3132
|
||||
deny 3141
|
||||
deny 3449
|
||||
deny 3454
|
||||
deny 3484
|
||||
deny 3487
|
||||
deny 3496
|
||||
deny 3548
|
||||
deny 3551
|
||||
deny 3556
|
||||
deny 3596 - 3597
|
||||
deny 3603
|
||||
deny 3631 - 3632
|
||||
deny 3636
|
||||
deny 3640
|
||||
deny 3790
|
||||
deny 3816
|
||||
deny 3905
|
||||
deny 3968
|
||||
deny 4141
|
||||
deny 4209
|
||||
deny 4230
|
||||
deny 4242
|
||||
deny 4244
|
||||
deny 4270
|
||||
deny 4387
|
||||
deny 4493
|
||||
deny 4535
|
||||
deny 4914
|
||||
deny 4926
|
||||
deny 4944
|
||||
deny 4964
|
||||
deny 4967
|
||||
deny 4995
|
||||
deny 5005
|
||||
deny 5633
|
||||
deny 5639
|
||||
deny 5648
|
||||
deny 5692
|
||||
deny 5708
|
||||
deny 5722
|
||||
deny 5745
|
||||
deny 5772
|
||||
deny 6057
|
||||
deny 6063 - 6065
|
||||
deny 6084
|
||||
deny 6121
|
||||
deny 6125
|
||||
deny 6133
|
||||
deny 6135
|
||||
deny 6147 - 6148
|
||||
deny 6193
|
||||
deny 6240
|
||||
deny 6306
|
||||
deny 6332
|
||||
deny 6342
|
||||
deny 6400
|
||||
deny 6429
|
||||
deny 6458
|
||||
deny 6471
|
||||
deny 6487
|
||||
deny 6495
|
||||
deny 6503
|
||||
deny 6505
|
||||
deny 6535
|
||||
deny 6543
|
||||
deny 6545
|
||||
deny 6568
|
||||
deny 6590
|
||||
deny 6927
|
||||
deny 6945
|
||||
deny 6957
|
||||
deny 7002
|
||||
deny 7004 - 7005
|
||||
deny 7038
|
||||
deny 7048 - 7049
|
||||
deny 7056
|
||||
deny 7063
|
||||
deny 7080
|
||||
deny 7087
|
||||
deny 7103
|
||||
deny 7120
|
||||
deny 7125
|
||||
deny 7137
|
||||
deny 7149
|
||||
deny 7157
|
||||
deny 7162
|
||||
deny 7167
|
||||
deny 7173
|
||||
deny 7184
|
||||
deny 7195
|
||||
deny 7199
|
||||
deny 7236
|
||||
deny 7298
|
||||
deny 7303
|
||||
deny 7313
|
||||
deny 7315
|
||||
deny 7325
|
||||
deny 7340
|
||||
deny 7365
|
||||
deny 7399
|
||||
deny 7408
|
||||
deny 7414
|
||||
deny 7417 - 7418
|
||||
deny 7428
|
||||
deny 7437 - 7438
|
||||
deny 7465
|
||||
deny 7727
|
||||
deny 7738
|
||||
deny 7803
|
||||
deny 7864
|
||||
deny 7890
|
||||
deny 7906
|
||||
deny 7908
|
||||
deny 7910
|
||||
deny 7927
|
||||
deny 7934
|
||||
deny 7953
|
||||
deny 7965
|
||||
deny 7974
|
||||
deny 7980
|
||||
deny 7984
|
||||
deny 7993 - 7995
|
||||
deny 7997
|
||||
deny 8007
|
||||
deny 8024
|
||||
deny 8026
|
||||
deny 8048
|
||||
deny 8053 - 8056
|
||||
deny 8065 - 8066
|
||||
deny 8096
|
||||
deny 8140 - 8141
|
||||
deny 8151
|
||||
deny 8163
|
||||
deny 8167
|
||||
deny 8178
|
||||
deny 10269
|
||||
deny 10277
|
||||
deny 10285
|
||||
deny 10293
|
||||
deny 10299
|
||||
deny 10301
|
||||
deny 10318
|
||||
deny 10362
|
||||
deny 10391
|
||||
deny 10412
|
||||
deny 10417
|
||||
deny 10420
|
||||
deny 10429
|
||||
deny 10436
|
||||
deny 10452
|
||||
deny 10454
|
||||
deny 10463
|
||||
deny 10476
|
||||
deny 10479
|
||||
deny 10481
|
||||
deny 10495
|
||||
deny 10502
|
||||
deny 10531
|
||||
deny 10560
|
||||
deny 10569
|
||||
deny 10586
|
||||
deny 10600
|
||||
deny 10605 - 10606
|
||||
deny 10617
|
||||
deny 10620
|
||||
deny 10624
|
||||
deny 10630
|
||||
deny 10640
|
||||
deny 10649
|
||||
deny 10670 - 10671
|
||||
deny 10688
|
||||
deny 10691
|
||||
deny 10697
|
||||
deny 10704
|
||||
deny 10706
|
||||
deny 10715
|
||||
deny 10733
|
||||
deny 10757
|
||||
deny 10778
|
||||
deny 10785
|
||||
deny 10795
|
||||
deny 10824
|
||||
deny 10834
|
||||
deny 10841
|
||||
deny 10847
|
||||
deny 10875
|
||||
deny 10881
|
||||
deny 10895
|
||||
deny 10897
|
||||
deny 10906
|
||||
deny 10938
|
||||
deny 10954
|
||||
deny 10964
|
||||
deny 10983
|
||||
deny 10986
|
||||
deny 10992
|
||||
deny 11008
|
||||
deny 11014
|
||||
deny 11053
|
||||
deny 11058
|
||||
deny 11063
|
||||
deny 11081
|
||||
deny 11083
|
||||
deny 11087
|
||||
deny 11097
|
||||
deny 11136
|
||||
deny 11172
|
||||
deny 11193
|
||||
deny 11237
|
||||
deny 11242
|
||||
deny 11254
|
||||
deny 11256
|
||||
deny 11271
|
||||
deny 11284
|
||||
deny 11295
|
||||
deny 11311
|
||||
deny 11315
|
||||
deny 11335
|
||||
deny 11338
|
||||
deny 11340
|
||||
deny 11356
|
||||
deny 11373
|
||||
deny 11390
|
||||
deny 11392
|
||||
deny 11411
|
||||
deny 11415
|
||||
deny 11419
|
||||
deny 11431 - 11432
|
||||
deny 11447
|
||||
deny 11450 - 11451
|
||||
deny 11497 - 11498
|
||||
deny 11503
|
||||
deny 11514
|
||||
deny 11519
|
||||
deny 11556
|
||||
deny 11562
|
||||
deny 11571
|
||||
deny 11581
|
||||
deny 11585
|
||||
deny 11592
|
||||
deny 11599
|
||||
deny 11617
|
||||
deny 11642
|
||||
deny 11644
|
||||
deny 11664
|
||||
deny 11673
|
||||
deny 11677
|
||||
deny 11694
|
||||
deny 11706
|
||||
deny 11750 - 11752
|
||||
deny 11786
|
||||
deny 11800 - 11802
|
||||
deny 11815 - 11816
|
||||
deny 11830
|
||||
deny 11835
|
||||
deny 11844
|
||||
deny 11888
|
||||
deny 11896
|
||||
deny 11921
|
||||
deny 11947
|
||||
deny 11960
|
||||
deny 11993
|
||||
deny 12034
|
||||
deny 12066
|
||||
deny 12127
|
||||
deny 12135 - 12136
|
||||
deny 12140
|
||||
deny 12146
|
||||
deny 12150
|
||||
deny 12248
|
||||
deny 12252
|
||||
deny 12264
|
||||
deny 13316
|
||||
deny 13318
|
||||
deny 13320
|
||||
deny 13353
|
||||
deny 13357
|
||||
deny 13381
|
||||
deny 13424
|
||||
deny 13440
|
||||
deny 13459
|
||||
deny 13474
|
||||
deny 13489
|
||||
deny 13495
|
||||
deny 13514
|
||||
deny 13521 - 13522
|
||||
deny 13544
|
||||
deny 13579
|
||||
deny 13584 - 13585
|
||||
deny 13591
|
||||
deny 13643
|
||||
deny 13679
|
||||
deny 13682
|
||||
deny 13761
|
||||
deny 13774
|
||||
deny 13835
|
||||
deny 13874
|
||||
deny 13878
|
||||
deny 13914
|
||||
deny 13929
|
||||
deny 13934 - 13936
|
||||
deny 13991
|
||||
deny 13999 - 14000
|
||||
deny 14026
|
||||
deny 14030
|
||||
deny 14069
|
||||
deny 14080
|
||||
deny 14084
|
||||
deny 14087
|
||||
deny 14111
|
||||
deny 14117
|
||||
deny 14122
|
||||
deny 14178 - 14179
|
||||
deny 14186 - 14187
|
||||
deny 14202
|
||||
deny 14204
|
||||
deny 14231 - 14232
|
||||
deny 14234
|
||||
deny 14249 - 14250
|
||||
deny 14259
|
||||
deny 14282
|
||||
deny 14285 - 14286
|
||||
deny 14316
|
||||
deny 14318
|
||||
deny 14339
|
||||
deny 14346
|
||||
deny 14377
|
||||
deny 14420
|
||||
deny 14457
|
||||
deny 14463
|
||||
deny 14522
|
||||
deny 14535
|
||||
deny 14553
|
||||
deny 14560
|
||||
deny 14571
|
||||
deny 14624
|
||||
deny 14650
|
||||
deny 14664
|
||||
deny 14674
|
||||
deny 14692
|
||||
deny 14708 - 14709
|
||||
deny 14723
|
||||
deny 14754
|
||||
deny 14759
|
||||
deny 14769
|
||||
deny 14795
|
||||
deny 14840
|
||||
deny 14845
|
||||
deny 14867 - 14868
|
||||
deny 14886
|
||||
deny 14966
|
||||
deny 14970
|
||||
deny 15030
|
||||
deny 15034
|
||||
deny 15064
|
||||
deny 15066
|
||||
deny 15075
|
||||
deny 15078
|
||||
deny 15107
|
||||
deny 15125
|
||||
deny 15151
|
||||
deny 15180
|
||||
deny 15201
|
||||
deny 15208
|
||||
deny 15236
|
||||
deny 15241
|
||||
deny 15246
|
||||
deny 15252
|
||||
deny 15256
|
||||
deny 15274
|
||||
deny 15311
|
||||
deny 16397
|
||||
deny 16418
|
||||
deny 16471
|
||||
deny 16506
|
||||
deny 16522
|
||||
deny 16528
|
||||
deny 16531
|
||||
deny 16592
|
||||
deny 16594
|
||||
deny 16596
|
||||
deny 16606 - 16607
|
||||
deny 16629
|
||||
deny 16663
|
||||
deny 16685
|
||||
deny 16689
|
||||
deny 16701
|
||||
deny 16712
|
||||
deny 16732
|
||||
deny 16735 - 16736
|
||||
deny 16742
|
||||
deny 16762
|
||||
deny 16772
|
||||
deny 16780
|
||||
deny 16814
|
||||
deny 16847
|
||||
deny 16849
|
||||
deny 16864
|
||||
deny 16874
|
||||
deny 16885
|
||||
deny 16891
|
||||
deny 16906
|
||||
deny 16911
|
||||
deny 16960
|
||||
deny 16973
|
||||
deny 16975
|
||||
deny 16990
|
||||
deny 17069
|
||||
deny 17072
|
||||
deny 17079
|
||||
deny 17086
|
||||
deny 17108
|
||||
deny 17126
|
||||
deny 17147
|
||||
deny 17182
|
||||
deny 17205
|
||||
deny 17208
|
||||
deny 17222
|
||||
deny 17249 - 17250
|
||||
deny 17255
|
||||
deny 17257
|
||||
deny 17287
|
||||
deny 17329
|
||||
deny 17376
|
||||
deny 17379
|
||||
deny 17399
|
||||
deny 17401
|
||||
deny 18449
|
||||
deny 18455
|
||||
deny 18466
|
||||
deny 18479
|
||||
deny 18492
|
||||
deny 18496
|
||||
deny 18532
|
||||
deny 18547
|
||||
deny 18576
|
||||
deny 18579
|
||||
deny 18592
|
||||
deny 18644
|
||||
deny 18667
|
||||
deny 18678
|
||||
deny 18734
|
||||
deny 18739
|
||||
deny 18782
|
||||
deny 18809
|
||||
deny 18822
|
||||
deny 18836
|
||||
deny 18840
|
||||
deny 18846
|
||||
deny 18869
|
||||
deny 18881
|
||||
deny 18941
|
||||
deny 18998
|
||||
deny 19033
|
||||
deny 19037 - 19038
|
||||
deny 19064
|
||||
deny 19077
|
||||
deny 19089 - 19090
|
||||
deny 19109
|
||||
deny 19114
|
||||
deny 19132
|
||||
deny 19169
|
||||
deny 19180
|
||||
deny 19182
|
||||
deny 19192
|
||||
deny 19196
|
||||
deny 19200
|
||||
deny 19228
|
||||
deny 19244
|
||||
deny 19259
|
||||
deny 19278
|
||||
deny 19315
|
||||
deny 19332
|
||||
deny 19338
|
||||
deny 19361
|
||||
deny 19373
|
||||
deny 19411
|
||||
deny 19422
|
||||
deny 19429
|
||||
deny 19447
|
||||
deny 19519
|
||||
deny 19553
|
||||
deny 19582 - 19583
|
||||
deny 19611
|
||||
deny 19632
|
||||
deny 19688
|
||||
deny 19723
|
||||
deny 19731
|
||||
deny 19763
|
||||
deny 19767
|
||||
deny 19863
|
||||
deny 19873
|
||||
deny 19889
|
||||
deny 19960
|
||||
deny 19978
|
||||
deny 19989 - 19990
|
||||
deny 20002
|
||||
deny 20015
|
||||
deny 20032
|
||||
deny 20043 - 20044
|
||||
deny 20106
|
||||
deny 20116 - 20117
|
||||
deny 20121
|
||||
deny 20142
|
||||
deny 20173
|
||||
deny 20191
|
||||
deny 20207
|
||||
deny 20232
|
||||
deny 20244
|
||||
deny 20255 - 20256
|
||||
deny 20266
|
||||
deny 20297
|
||||
deny 20299
|
||||
deny 20305
|
||||
deny 20312
|
||||
deny 20321
|
||||
deny 20345
|
||||
deny 20361
|
||||
deny 20363
|
||||
deny 20418
|
||||
deny 21506
|
||||
deny 21520
|
||||
deny 21571
|
||||
deny 21574 - 21575
|
||||
deny 21578
|
||||
deny 21590
|
||||
deny 21599
|
||||
deny 21603
|
||||
deny 21612
|
||||
deny 21614
|
||||
deny 21674
|
||||
deny 21692
|
||||
deny 21741
|
||||
deny 21753
|
||||
deny 21756
|
||||
deny 21765
|
||||
deny 21768
|
||||
deny 21824
|
||||
deny 21826
|
||||
deny 21838
|
||||
deny 21862
|
||||
deny 21883
|
||||
deny 21888
|
||||
deny 21911
|
||||
deny 21917
|
||||
deny 21980
|
||||
deny 22010 - 22011
|
||||
deny 22019
|
||||
deny 22047
|
||||
deny 22055
|
||||
deny 22080
|
||||
deny 22085
|
||||
deny 22092
|
||||
deny 22122
|
||||
deny 22128 - 22129
|
||||
deny 22133
|
||||
deny 22148
|
||||
deny 22177
|
||||
deny 22185
|
||||
deny 22227
|
||||
deny 22250
|
||||
deny 22305
|
||||
deny 22313
|
||||
deny 22341
|
||||
deny 22356
|
||||
deny 22368
|
||||
deny 22371
|
||||
deny 22381 - 22382
|
||||
deny 22407
|
||||
deny 22411
|
||||
deny 22431
|
||||
deny 22453
|
||||
deny 22501
|
||||
deny 22508
|
||||
deny 22515
|
||||
deny 22529
|
||||
deny 22541
|
||||
deny 22548
|
||||
deny 22566
|
||||
deny 22628
|
||||
deny 22661
|
||||
deny 22678
|
||||
deny 22689
|
||||
deny 22698 - 22699
|
||||
deny 22706
|
||||
deny 22724
|
||||
deny 22726
|
||||
deny 22745
|
||||
deny 22798
|
||||
deny 22818 - 22819
|
||||
deny 22833
|
||||
deny 22860
|
||||
deny 22869
|
||||
deny 22876
|
||||
deny 22882
|
||||
deny 22884
|
||||
deny 22889
|
||||
deny 22894
|
||||
deny 22908
|
||||
deny 22924
|
||||
deny 22927
|
||||
deny 22975
|
||||
deny 23002
|
||||
deny 23007
|
||||
deny 23020
|
||||
deny 23031
|
||||
deny 23074
|
||||
deny 23091
|
||||
deny 23105 - 23106
|
||||
deny 23113
|
||||
deny 23128
|
||||
deny 23140
|
||||
deny 23201 - 23202
|
||||
deny 23216
|
||||
deny 23243
|
||||
deny 23246
|
||||
deny 23289
|
||||
deny 23353
|
||||
deny 23360
|
||||
deny 23382 - 23383
|
||||
deny 23416
|
||||
deny 23487 - 23488
|
||||
deny 23495
|
||||
deny 23541
|
||||
deny 25607
|
||||
deny 25620
|
||||
deny 25701
|
||||
deny 25705
|
||||
deny 25718
|
||||
deny 25734
|
||||
deny 25812
|
||||
deny 25832
|
||||
deny 25908
|
||||
deny 25927
|
||||
deny 25933
|
||||
deny 25998
|
||||
deny 26048
|
||||
deny 26061
|
||||
deny 26090
|
||||
deny 26104 - 26105
|
||||
deny 26107
|
||||
deny 26112
|
||||
deny 26118 - 26119
|
||||
deny 26136
|
||||
deny 26162
|
||||
deny 26173
|
||||
deny 26194
|
||||
deny 26210
|
||||
deny 26218
|
||||
deny 26317
|
||||
deny 26418
|
||||
deny 26426
|
||||
deny 26434
|
||||
deny 26473
|
||||
deny 26505
|
||||
deny 26592 - 26623
|
||||
|
||||
# AFRINIC IPv4 resources cannot be transferred to APNIC
|
||||
# From https://www.iana.org/assignments/ipv4-address-space/
|
||||
deny 41.0.0.0/8
|
||||
deny 102.0.0.0/8
|
||||
deny 105.0.0.0/8
|
||||
deny 154.0.0.0/16
|
||||
deny 154.16.0.0/16
|
||||
deny 154.65.0.0 - 154.255.255.255
|
||||
deny 196.0.0.0 - 196.1.0.255
|
||||
deny 196.1.4.0/24
|
||||
deny 196.1.7.0 - 196.1.63.255
|
||||
deny 196.1.71.0/24
|
||||
deny 196.1.74.0 - 196.1.103.255
|
||||
deny 196.1.115.0 - 196.1.133.255
|
||||
deny 196.1.137.0/24
|
||||
deny 196.1.143.0 - 196.1.159.255
|
||||
deny 196.1.176.0 - 196.1.255.255
|
||||
deny 196.2.2.0/23
|
||||
deny 196.2.8.0 - 196.2.255.255
|
||||
deny 196.3.14.0/23
|
||||
deny 196.3.57.0 - 196.3.64.255
|
||||
deny 196.3.90.0/24
|
||||
deny 196.3.92.0 - 196.3.94.255
|
||||
deny 196.3.96.0/21
|
||||
deny 196.3.105.0/24
|
||||
deny 196.3.107.0 - 196.3.131.255
|
||||
deny 196.3.148.0/22
|
||||
deny 196.3.154.0 - 196.3.183.255
|
||||
deny 196.3.224.0 - 196.4.45.255
|
||||
deny 196.4.71.0 - 196.11.171.255
|
||||
deny 196.11.174.0 - 196.11.239.255
|
||||
deny 196.11.248.0/21
|
||||
deny 196.12.10.0 - 196.12.31.255
|
||||
deny 196.12.128.0/19
|
||||
deny 196.12.192.0 - 196.15.15.255
|
||||
deny 196.15.64.0 - 196.26.255.255
|
||||
deny 196.27.64.0 - 196.28.47.255
|
||||
deny 196.28.64.0 - 196.29.63.255
|
||||
deny 196.29.96.0 - 196.31.255.255
|
||||
deny 196.32.8.0 - 196.32.31.255
|
||||
deny 196.32.96.0/19
|
||||
deny 196.32.160.0 - 196.39.255.255
|
||||
deny 196.40.96.0 - 196.41.255.255
|
||||
deny 196.42.64.0 - 196.216.0.255
|
||||
deny 196.216.2.0 - 197.255.255.255
|
||||
|
||||
# AFRINIC ASNs cannot be transferred to APNIC
|
||||
# From https://www.iana.org/assignments/as-numbers/
|
||||
deny 36864 - 37887
|
||||
deny 327680 - 330751
|
||||
|
||||
# AFRINIC ASNs cannot be transferred to APNIC
|
||||
# From nro-delegated-stats 20240417
|
||||
deny 1228 - 1232
|
||||
deny 2018
|
||||
deny 2561
|
||||
deny 2905
|
||||
deny 3067 - 3068
|
||||
deny 3208
|
||||
deny 3741
|
||||
deny 4178
|
||||
deny 4571
|
||||
deny 5536
|
||||
deny 5713
|
||||
deny 5734
|
||||
deny 6083
|
||||
deny 6089
|
||||
deny 6127
|
||||
deny 6149
|
||||
deny 6180
|
||||
deny 6187
|
||||
deny 6351
|
||||
deny 6529
|
||||
deny 6560
|
||||
deny 6713
|
||||
deny 6879
|
||||
deny 6968
|
||||
deny 7020
|
||||
deny 7154
|
||||
deny 7231
|
||||
deny 7390
|
||||
deny 7420
|
||||
deny 7460
|
||||
deny 7971 - 7972
|
||||
deny 8094
|
||||
deny 8524
|
||||
deny 8770
|
||||
deny 9129
|
||||
deny 10247
|
||||
deny 10262
|
||||
deny 10331
|
||||
deny 10393
|
||||
deny 10474
|
||||
deny 10505
|
||||
deny 10540
|
||||
deny 10575
|
||||
deny 10798
|
||||
deny 10803
|
||||
deny 10898
|
||||
deny 11125
|
||||
deny 11157
|
||||
deny 11201
|
||||
deny 11259
|
||||
deny 11265
|
||||
deny 11380
|
||||
deny 11569
|
||||
deny 11645
|
||||
deny 11744
|
||||
deny 11845
|
||||
deny 11909
|
||||
deny 12091
|
||||
deny 12143
|
||||
deny 12258
|
||||
deny 12455
|
||||
deny 12556
|
||||
deny 13224
|
||||
deny 13402
|
||||
deny 13519
|
||||
deny 13569
|
||||
deny 13854
|
||||
deny 14029
|
||||
deny 14115
|
||||
deny 14331
|
||||
deny 14429
|
||||
deny 14516
|
||||
deny 14988
|
||||
deny 15022
|
||||
deny 15159
|
||||
deny 15399
|
||||
deny 15475
|
||||
deny 15706
|
||||
deny 15804
|
||||
deny 15825
|
||||
deny 15834
|
||||
deny 15964
|
||||
deny 16058
|
||||
deny 16214
|
||||
deny 16284
|
||||
deny 16416
|
||||
deny 16547
|
||||
deny 16630
|
||||
deny 16637
|
||||
deny 16800
|
||||
deny 16853
|
||||
deny 16907
|
||||
deny 17148
|
||||
deny 17220
|
||||
deny 17260
|
||||
deny 17312
|
||||
deny 17400
|
||||
deny 17652
|
||||
deny 18775
|
||||
deny 18922
|
||||
deny 18931
|
||||
deny 19136
|
||||
deny 19232
|
||||
deny 19676
|
||||
deny 19711
|
||||
deny 19832
|
||||
deny 19847
|
||||
deny 20011
|
||||
deny 20086
|
||||
deny 20095
|
||||
deny 20180
|
||||
deny 20294
|
||||
deny 20459
|
||||
deny 20484
|
||||
deny 20858
|
||||
deny 20928
|
||||
deny 21003
|
||||
deny 21152
|
||||
deny 21242
|
||||
deny 21271
|
||||
deny 21278
|
||||
deny 21280
|
||||
deny 21391
|
||||
deny 21452
|
||||
deny 21739
|
||||
deny 21819
|
||||
deny 22354 - 22355
|
||||
deny 22386
|
||||
deny 22572
|
||||
deny 22690
|
||||
deny 22735
|
||||
deny 22750
|
||||
deny 22939
|
||||
deny 23058
|
||||
deny 23549
|
||||
deny 23889
|
||||
deny 24736
|
||||
deny 24757
|
||||
deny 24788
|
||||
deny 24801
|
||||
deny 24835
|
||||
deny 24863
|
||||
deny 24878
|
||||
deny 24987
|
||||
deny 25163
|
||||
deny 25250
|
||||
deny 25362
|
||||
deny 25364
|
||||
deny 25543
|
||||
deny 25568
|
||||
deny 25576
|
||||
deny 25695
|
||||
deny 25726
|
||||
deny 25793
|
||||
deny 25818
|
||||
deny 26106
|
||||
deny 26130
|
||||
deny 26422
|
||||
deny 26625
|
||||
deny 26754
|
||||
deny 27576
|
||||
deny 27598
|
||||
deny 28683
|
||||
deny 28698
|
||||
deny 28913
|
||||
deny 29091
|
||||
deny 29338
|
||||
deny 29340
|
||||
deny 29428
|
||||
deny 29495
|
||||
deny 29544
|
||||
deny 29571
|
||||
deny 29614
|
||||
deny 29674
|
||||
deny 29918
|
||||
deny 29975
|
||||
deny 30073
|
||||
deny 30306
|
||||
deny 30429
|
||||
deny 30619
|
||||
deny 30896
|
||||
deny 30980
|
||||
deny 30982 - 30999
|
||||
deny 31065
|
||||
deny 31245
|
||||
deny 31619
|
||||
deny 31810
|
||||
deny 31856
|
||||
deny 31960
|
||||
deny 32017
|
||||
deny 32279
|
||||
deny 32398
|
||||
deny 32437
|
||||
deny 32653
|
||||
deny 32714
|
||||
deny 32717
|
||||
deny 32842
|
||||
deny 32860
|
||||
deny 33567
|
||||
deny 33579
|
||||
deny 33762 - 33791
|
||||
|
||||
# Private use IPv4 & IPv6 addresses and ASNs
|
||||
deny 0.0.0.0/8 # RFC 1122 Local Identification
|
||||
deny 10.0.0.0/8 # RFC 1918 private space
|
||||
deny 100.64.0.0/10 # RFC 6598 Carrier Grade NAT
|
||||
deny 127.0.0.0/8 # RFC 1122 localhost
|
||||
deny 169.254.0.0/16 # RFC 3927 link local
|
||||
deny 172.16.0.0/12 # RFC 1918 private space
|
||||
deny 192.0.2.0/24 # RFC 5737 TEST-NET-1
|
||||
deny 192.88.99.0/24 # RFC 7526 6to4 anycast relay
|
||||
deny 192.168.0.0/16 # RFC 1918 private space
|
||||
deny 198.18.0.0/15 # RFC 2544 benchmarking
|
||||
deny 198.51.100.0/24 # RFC 5737 TEST-NET-2
|
||||
deny 203.0.113.0/24 # RFC 5737 TEST-NET-3
|
||||
deny 224.0.0.0/4 # Multicast
|
||||
deny 240.0.0.0/4 # Reserved
|
||||
deny 23456 # RFC 4893 AS_TRANS
|
||||
deny 64496 - 64511 # RFC 5398
|
||||
deny 64512 - 65534 # RFC 6996
|
||||
deny 65535 # RFC 7300
|
||||
deny 65536 - 65551 # RFC 5398
|
||||
deny 65552 - 131071 # IANA Reserved
|
||||
deny 4200000000 - 4294967294 # RFC 6996
|
||||
deny 4294967295 # RFC 7300
|
||||
|
||||
# APNIC supports IPv4 and ASN transfers: allow the complement of what is denied
|
||||
allow 0.0.0.0/0
|
||||
allow 1 - 4199999999
|
||||
10
tals/apnic.tal
Normal file
10
tals/apnic.tal
Normal file
@@ -0,0 +1,10 @@
|
||||
https://rpki.apnic.net/repository/apnic-rpki-root-iana-origin.cer
|
||||
rsync://rpki.apnic.net/repository/apnic-rpki-root-iana-origin.cer
|
||||
|
||||
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx9RWSL61YAAYumEiU8z8
|
||||
qH2ETVIL01ilxZlzIL9JYSORMN5Cmtf8V2JblIealSqgOTGjvSjEsiV73s67zYQI
|
||||
7C/iSOb96uf3/s86NqbxDiFQGN8qG7RNcdgVuUlAidl8WxvLNI8VhqbAB5uSg/Mr
|
||||
LeSOvXRja041VptAxIhcGzDMvlAJRwkrYK/Mo8P4E2rSQgwqCgae0ebY1CsJ3Cjf
|
||||
i67C1nw7oXqJJovvXJ4apGmEv8az23OLC6Ki54Ul/E6xk227BFttqFV3YMtKx42H
|
||||
cCcDVZZy01n7JjzvO8ccaXmHIgR7utnqhBRNNq5Xc5ZhbkrUsNtiJmrZzVlgU6Ou
|
||||
0wIDAQAB
|
||||
981
tals/arin.constraints
Normal file
981
tals/arin.constraints
Normal file
@@ -0,0 +1,981 @@
|
||||
# $OpenBSD: arin.constraints,v 1.7 2026/07/09 12:29:52 job Exp $
|
||||
|
||||
# From https://www.iana.org/assignments/ipv6-unicast-address-assignments
|
||||
allow 2001:400::/23
|
||||
allow 2001:1800::/23
|
||||
allow 2001:4800::/23
|
||||
allow 2600::/12
|
||||
allow 2610::/23
|
||||
allow 2620::/23
|
||||
allow 2630::/12
|
||||
|
||||
# AS112 Project
|
||||
allow 2001:4:112::/48
|
||||
|
||||
# LACNIC ASNs cannot be transferred to ARIN
|
||||
# From https://www.iana.org/assignments/as-numbers/as-numbers.xhtml
|
||||
deny 27648 - 28671
|
||||
deny 52224 - 53247
|
||||
deny 61440 - 61951
|
||||
deny 64099 - 64197
|
||||
deny 262144 - 275868
|
||||
|
||||
# LACNIC ASNs cannot be transferred to ARIN
|
||||
# From nro-delegated-stats 20240417
|
||||
deny 278
|
||||
deny 676
|
||||
deny 1251
|
||||
deny 1292
|
||||
deny 1296
|
||||
deny 1797
|
||||
deny 1831
|
||||
deny 1840
|
||||
deny 1916
|
||||
deny 2146
|
||||
deny 2277
|
||||
deny 2549
|
||||
deny 2638
|
||||
deny 2708
|
||||
deny 2715 - 2716
|
||||
deny 2739
|
||||
deny 2904
|
||||
deny 3132
|
||||
deny 3141
|
||||
deny 3449
|
||||
deny 3454
|
||||
deny 3484
|
||||
deny 3487
|
||||
deny 3496
|
||||
deny 3548
|
||||
deny 3551
|
||||
deny 3556
|
||||
deny 3596 - 3597
|
||||
deny 3603
|
||||
deny 3631 - 3632
|
||||
deny 3636
|
||||
deny 3640
|
||||
deny 3790
|
||||
deny 3816
|
||||
deny 3905
|
||||
deny 3968
|
||||
deny 4141
|
||||
deny 4209
|
||||
deny 4230
|
||||
deny 4242
|
||||
deny 4244
|
||||
deny 4270
|
||||
deny 4387
|
||||
deny 4493
|
||||
deny 4535
|
||||
deny 4914
|
||||
deny 4926
|
||||
deny 4944
|
||||
deny 4964
|
||||
deny 4967
|
||||
deny 4995
|
||||
deny 5005
|
||||
deny 5633
|
||||
deny 5639
|
||||
deny 5648
|
||||
deny 5692
|
||||
deny 5708
|
||||
deny 5722
|
||||
deny 5745
|
||||
deny 5772
|
||||
deny 6057
|
||||
deny 6063 - 6065
|
||||
deny 6084
|
||||
deny 6121
|
||||
deny 6125
|
||||
deny 6133
|
||||
deny 6135
|
||||
deny 6147 - 6148
|
||||
deny 6193
|
||||
deny 6240
|
||||
deny 6306
|
||||
deny 6332
|
||||
deny 6342
|
||||
deny 6400
|
||||
deny 6429
|
||||
deny 6458
|
||||
deny 6471
|
||||
deny 6487
|
||||
deny 6495
|
||||
deny 6503
|
||||
deny 6505
|
||||
deny 6535
|
||||
deny 6543
|
||||
deny 6545
|
||||
deny 6568
|
||||
deny 6590
|
||||
deny 6927
|
||||
deny 6945
|
||||
deny 6957
|
||||
deny 7002
|
||||
deny 7004 - 7005
|
||||
deny 7038
|
||||
deny 7048 - 7049
|
||||
deny 7056
|
||||
deny 7063
|
||||
deny 7080
|
||||
deny 7087
|
||||
deny 7103
|
||||
deny 7120
|
||||
deny 7125
|
||||
deny 7137
|
||||
deny 7149
|
||||
deny 7157
|
||||
deny 7162
|
||||
deny 7167
|
||||
deny 7173
|
||||
deny 7184
|
||||
deny 7195
|
||||
deny 7199
|
||||
deny 7236
|
||||
deny 7298
|
||||
deny 7303
|
||||
deny 7313
|
||||
deny 7315
|
||||
deny 7325
|
||||
deny 7340
|
||||
deny 7365
|
||||
deny 7399
|
||||
deny 7408
|
||||
deny 7414
|
||||
deny 7417 - 7418
|
||||
deny 7428
|
||||
deny 7437 - 7438
|
||||
deny 7465
|
||||
deny 7727
|
||||
deny 7738
|
||||
deny 7803
|
||||
deny 7864
|
||||
deny 7890
|
||||
deny 7906
|
||||
deny 7908
|
||||
deny 7910
|
||||
deny 7927
|
||||
deny 7934
|
||||
deny 7953
|
||||
deny 7965
|
||||
deny 7974
|
||||
deny 7980
|
||||
deny 7984
|
||||
deny 7993 - 7995
|
||||
deny 7997
|
||||
deny 8007
|
||||
deny 8024
|
||||
deny 8026
|
||||
deny 8048
|
||||
deny 8053 - 8056
|
||||
deny 8065 - 8066
|
||||
deny 8096
|
||||
deny 8140 - 8141
|
||||
deny 8151
|
||||
deny 8163
|
||||
deny 8167
|
||||
deny 8178
|
||||
deny 10269
|
||||
deny 10277
|
||||
deny 10285
|
||||
deny 10293
|
||||
deny 10299
|
||||
deny 10301
|
||||
deny 10318
|
||||
deny 10362
|
||||
deny 10391
|
||||
deny 10412
|
||||
deny 10417
|
||||
deny 10420
|
||||
deny 10429
|
||||
deny 10436
|
||||
deny 10452
|
||||
deny 10454
|
||||
deny 10463
|
||||
deny 10476
|
||||
deny 10479
|
||||
deny 10481
|
||||
deny 10495
|
||||
deny 10502
|
||||
deny 10531
|
||||
deny 10560
|
||||
deny 10569
|
||||
deny 10586
|
||||
deny 10600
|
||||
deny 10605 - 10606
|
||||
deny 10617
|
||||
deny 10620
|
||||
deny 10624
|
||||
deny 10630
|
||||
deny 10640
|
||||
deny 10649
|
||||
deny 10670 - 10671
|
||||
deny 10688
|
||||
deny 10691
|
||||
deny 10697
|
||||
deny 10704
|
||||
deny 10706
|
||||
deny 10715
|
||||
deny 10733
|
||||
deny 10757
|
||||
deny 10778
|
||||
deny 10785
|
||||
deny 10795
|
||||
deny 10824
|
||||
deny 10834
|
||||
deny 10841
|
||||
deny 10847
|
||||
deny 10875
|
||||
deny 10881
|
||||
deny 10895
|
||||
deny 10897
|
||||
deny 10906
|
||||
deny 10938
|
||||
deny 10954
|
||||
deny 10964
|
||||
deny 10983
|
||||
deny 10986
|
||||
deny 10992
|
||||
deny 11008
|
||||
deny 11014
|
||||
deny 11053
|
||||
deny 11058
|
||||
deny 11063
|
||||
deny 11081
|
||||
deny 11083
|
||||
deny 11087
|
||||
deny 11097
|
||||
deny 11136
|
||||
deny 11172
|
||||
deny 11193
|
||||
deny 11237
|
||||
deny 11242
|
||||
deny 11254
|
||||
deny 11256
|
||||
deny 11271
|
||||
deny 11284
|
||||
deny 11295
|
||||
deny 11311
|
||||
deny 11315
|
||||
deny 11335
|
||||
deny 11338
|
||||
deny 11340
|
||||
deny 11356
|
||||
deny 11373
|
||||
deny 11390
|
||||
deny 11392
|
||||
deny 11411
|
||||
deny 11415
|
||||
deny 11419
|
||||
deny 11431 - 11432
|
||||
deny 11447
|
||||
deny 11450 - 11451
|
||||
deny 11497 - 11498
|
||||
deny 11503
|
||||
deny 11514
|
||||
deny 11519
|
||||
deny 11556
|
||||
deny 11562
|
||||
deny 11571
|
||||
deny 11581
|
||||
deny 11585
|
||||
deny 11592
|
||||
deny 11599
|
||||
deny 11617
|
||||
deny 11642
|
||||
deny 11644
|
||||
deny 11664
|
||||
deny 11673
|
||||
deny 11677
|
||||
deny 11694
|
||||
deny 11706
|
||||
deny 11750 - 11752
|
||||
deny 11786
|
||||
deny 11800 - 11802
|
||||
deny 11815 - 11816
|
||||
deny 11830
|
||||
deny 11835
|
||||
deny 11844
|
||||
deny 11888
|
||||
deny 11896
|
||||
deny 11921
|
||||
deny 11947
|
||||
deny 11960
|
||||
deny 11993
|
||||
deny 12034
|
||||
deny 12066
|
||||
deny 12127
|
||||
deny 12135 - 12136
|
||||
deny 12140
|
||||
deny 12146
|
||||
deny 12150
|
||||
deny 12248
|
||||
deny 12252
|
||||
deny 12264
|
||||
deny 13316
|
||||
deny 13318
|
||||
deny 13320
|
||||
deny 13353
|
||||
deny 13357
|
||||
deny 13381
|
||||
deny 13424
|
||||
deny 13440
|
||||
deny 13459
|
||||
deny 13474
|
||||
deny 13489
|
||||
deny 13495
|
||||
deny 13514
|
||||
deny 13521 - 13522
|
||||
deny 13544
|
||||
deny 13579
|
||||
deny 13584 - 13585
|
||||
deny 13591
|
||||
deny 13643
|
||||
deny 13679
|
||||
deny 13682
|
||||
deny 13761
|
||||
deny 13774
|
||||
deny 13835
|
||||
deny 13874
|
||||
deny 13878
|
||||
deny 13914
|
||||
deny 13929
|
||||
deny 13934 - 13936
|
||||
deny 13991
|
||||
deny 13999 - 14000
|
||||
deny 14026
|
||||
deny 14030
|
||||
deny 14069
|
||||
deny 14080
|
||||
deny 14084
|
||||
deny 14087
|
||||
deny 14111
|
||||
deny 14117
|
||||
deny 14122
|
||||
deny 14178 - 14179
|
||||
deny 14186 - 14187
|
||||
deny 14202
|
||||
deny 14204
|
||||
deny 14231 - 14232
|
||||
deny 14234
|
||||
deny 14249 - 14250
|
||||
deny 14259
|
||||
deny 14282
|
||||
deny 14285 - 14286
|
||||
deny 14316
|
||||
deny 14318
|
||||
deny 14339
|
||||
deny 14346
|
||||
deny 14377
|
||||
deny 14420
|
||||
deny 14457
|
||||
deny 14463
|
||||
deny 14522
|
||||
deny 14535
|
||||
deny 14553
|
||||
deny 14560
|
||||
deny 14571
|
||||
deny 14624
|
||||
deny 14650
|
||||
deny 14664
|
||||
deny 14674
|
||||
deny 14692
|
||||
deny 14708 - 14709
|
||||
deny 14723
|
||||
deny 14754
|
||||
deny 14759
|
||||
deny 14769
|
||||
deny 14795
|
||||
deny 14840
|
||||
deny 14845
|
||||
deny 14867 - 14868
|
||||
deny 14886
|
||||
deny 14966
|
||||
deny 14970
|
||||
deny 15030
|
||||
deny 15034
|
||||
deny 15064
|
||||
deny 15066
|
||||
deny 15075
|
||||
deny 15078
|
||||
deny 15107
|
||||
deny 15125
|
||||
deny 15151
|
||||
deny 15180
|
||||
deny 15201
|
||||
deny 15208
|
||||
deny 15236
|
||||
deny 15241
|
||||
deny 15246
|
||||
deny 15252
|
||||
deny 15256
|
||||
deny 15274
|
||||
deny 15311
|
||||
deny 16397
|
||||
deny 16418
|
||||
deny 16471
|
||||
deny 16506
|
||||
deny 16522
|
||||
deny 16528
|
||||
deny 16531
|
||||
deny 16592
|
||||
deny 16594
|
||||
deny 16596
|
||||
deny 16606 - 16607
|
||||
deny 16629
|
||||
deny 16663
|
||||
deny 16685
|
||||
deny 16689
|
||||
deny 16701
|
||||
deny 16712
|
||||
deny 16732
|
||||
deny 16735 - 16736
|
||||
deny 16742
|
||||
deny 16762
|
||||
deny 16772
|
||||
deny 16780
|
||||
deny 16814
|
||||
deny 16847
|
||||
deny 16849
|
||||
deny 16864
|
||||
deny 16874
|
||||
deny 16885
|
||||
deny 16891
|
||||
deny 16906
|
||||
deny 16911
|
||||
deny 16960
|
||||
deny 16973
|
||||
deny 16975
|
||||
deny 16990
|
||||
deny 17069
|
||||
deny 17072
|
||||
deny 17079
|
||||
deny 17086
|
||||
deny 17108
|
||||
deny 17126
|
||||
deny 17147
|
||||
deny 17182
|
||||
deny 17205
|
||||
deny 17208
|
||||
deny 17222
|
||||
deny 17249 - 17250
|
||||
deny 17255
|
||||
deny 17257
|
||||
deny 17287
|
||||
deny 17329
|
||||
deny 17376
|
||||
deny 17379
|
||||
deny 17399
|
||||
deny 17401
|
||||
deny 18449
|
||||
deny 18455
|
||||
deny 18466
|
||||
deny 18479
|
||||
deny 18492
|
||||
deny 18496
|
||||
deny 18532
|
||||
deny 18547
|
||||
deny 18576
|
||||
deny 18579
|
||||
deny 18592
|
||||
deny 18644
|
||||
deny 18667
|
||||
deny 18678
|
||||
deny 18734
|
||||
deny 18739
|
||||
deny 18782
|
||||
deny 18809
|
||||
deny 18822
|
||||
deny 18836
|
||||
deny 18840
|
||||
deny 18846
|
||||
deny 18869
|
||||
deny 18881
|
||||
deny 18941
|
||||
deny 18998
|
||||
deny 19033
|
||||
deny 19037 - 19038
|
||||
deny 19064
|
||||
deny 19077
|
||||
deny 19089 - 19090
|
||||
deny 19109
|
||||
deny 19114
|
||||
deny 19132
|
||||
deny 19169
|
||||
deny 19180
|
||||
deny 19182
|
||||
deny 19192
|
||||
deny 19196
|
||||
deny 19200
|
||||
deny 19228
|
||||
deny 19244
|
||||
deny 19259
|
||||
deny 19278
|
||||
deny 19315
|
||||
deny 19332
|
||||
deny 19338
|
||||
deny 19361
|
||||
deny 19373
|
||||
deny 19411
|
||||
deny 19422
|
||||
deny 19429
|
||||
deny 19447
|
||||
deny 19519
|
||||
deny 19553
|
||||
deny 19582 - 19583
|
||||
deny 19611
|
||||
deny 19632
|
||||
deny 19688
|
||||
deny 19723
|
||||
deny 19731
|
||||
deny 19763
|
||||
deny 19767
|
||||
deny 19863
|
||||
deny 19873
|
||||
deny 19889
|
||||
deny 19960
|
||||
deny 19978
|
||||
deny 19989 - 19990
|
||||
deny 20002
|
||||
deny 20015
|
||||
deny 20032
|
||||
deny 20043 - 20044
|
||||
deny 20106
|
||||
deny 20116 - 20117
|
||||
deny 20121
|
||||
deny 20142
|
||||
deny 20173
|
||||
deny 20191
|
||||
deny 20207
|
||||
deny 20232
|
||||
deny 20244
|
||||
deny 20255 - 20256
|
||||
deny 20266
|
||||
deny 20297
|
||||
deny 20299
|
||||
deny 20305
|
||||
deny 20312
|
||||
deny 20321
|
||||
deny 20345
|
||||
deny 20361
|
||||
deny 20363
|
||||
deny 20418
|
||||
deny 21506
|
||||
deny 21520
|
||||
deny 21571
|
||||
deny 21574 - 21575
|
||||
deny 21578
|
||||
deny 21590
|
||||
deny 21599
|
||||
deny 21603
|
||||
deny 21612
|
||||
deny 21614
|
||||
deny 21674
|
||||
deny 21692
|
||||
deny 21741
|
||||
deny 21753
|
||||
deny 21756
|
||||
deny 21765
|
||||
deny 21768
|
||||
deny 21824
|
||||
deny 21826
|
||||
deny 21838
|
||||
deny 21862
|
||||
deny 21883
|
||||
deny 21888
|
||||
deny 21911
|
||||
deny 21917
|
||||
deny 21980
|
||||
deny 22010 - 22011
|
||||
deny 22019
|
||||
deny 22047
|
||||
deny 22055
|
||||
deny 22080
|
||||
deny 22085
|
||||
deny 22092
|
||||
deny 22122
|
||||
deny 22128 - 22129
|
||||
deny 22133
|
||||
deny 22148
|
||||
deny 22177
|
||||
deny 22185
|
||||
deny 22227
|
||||
deny 22250
|
||||
deny 22305
|
||||
deny 22313
|
||||
deny 22341
|
||||
deny 22356
|
||||
deny 22368
|
||||
deny 22371
|
||||
deny 22381 - 22382
|
||||
deny 22407
|
||||
deny 22411
|
||||
deny 22431
|
||||
deny 22453
|
||||
deny 22501
|
||||
deny 22508
|
||||
deny 22515
|
||||
deny 22529
|
||||
deny 22541
|
||||
deny 22548
|
||||
deny 22566
|
||||
deny 22628
|
||||
deny 22661
|
||||
deny 22678
|
||||
deny 22689
|
||||
deny 22698 - 22699
|
||||
deny 22706
|
||||
deny 22724
|
||||
deny 22726
|
||||
deny 22745
|
||||
deny 22798
|
||||
deny 22818 - 22819
|
||||
deny 22833
|
||||
deny 22860
|
||||
deny 22869
|
||||
deny 22876
|
||||
deny 22882
|
||||
deny 22884
|
||||
deny 22889
|
||||
deny 22894
|
||||
deny 22908
|
||||
deny 22924
|
||||
deny 22927
|
||||
deny 22975
|
||||
deny 23002
|
||||
deny 23007
|
||||
deny 23020
|
||||
deny 23031
|
||||
deny 23074
|
||||
deny 23091
|
||||
deny 23105 - 23106
|
||||
deny 23113
|
||||
deny 23128
|
||||
deny 23140
|
||||
deny 23201 - 23202
|
||||
deny 23216
|
||||
deny 23243
|
||||
deny 23246
|
||||
deny 23289
|
||||
deny 23353
|
||||
deny 23360
|
||||
deny 23382 - 23383
|
||||
deny 23416
|
||||
deny 23487 - 23488
|
||||
deny 23495
|
||||
deny 23541
|
||||
deny 25607
|
||||
deny 25620
|
||||
deny 25701
|
||||
deny 25705
|
||||
deny 25718
|
||||
deny 25734
|
||||
deny 25812
|
||||
deny 25832
|
||||
deny 25908
|
||||
deny 25927
|
||||
deny 25933
|
||||
deny 25998
|
||||
deny 26048
|
||||
deny 26061
|
||||
deny 26090
|
||||
deny 26104 - 26105
|
||||
deny 26107
|
||||
deny 26112
|
||||
deny 26118 - 26119
|
||||
deny 26136
|
||||
deny 26162
|
||||
deny 26173
|
||||
deny 26194
|
||||
deny 26210
|
||||
deny 26218
|
||||
deny 26317
|
||||
deny 26418
|
||||
deny 26426
|
||||
deny 26434
|
||||
deny 26473
|
||||
deny 26505
|
||||
deny 26592 - 26623
|
||||
|
||||
# AFRINIC IPv4 resources cannot be transferred to ARIN
|
||||
# From https://www.iana.org/assignments/ipv4-address-space/
|
||||
deny 41.0.0.0/8
|
||||
deny 102.0.0.0/8
|
||||
deny 105.0.0.0/8
|
||||
deny 154.0.0.0/16
|
||||
deny 154.16.0.0/16
|
||||
deny 154.65.0.0 - 154.255.255.255
|
||||
deny 196.0.0.0 - 196.1.0.255
|
||||
deny 196.1.4.0/24
|
||||
deny 196.1.7.0 - 196.1.63.255
|
||||
deny 196.1.71.0/24
|
||||
deny 196.1.74.0 - 196.1.103.255
|
||||
deny 196.1.115.0 - 196.1.133.255
|
||||
deny 196.1.137.0/24
|
||||
deny 196.1.143.0 - 196.1.159.255
|
||||
deny 196.1.176.0 - 196.1.255.255
|
||||
deny 196.2.2.0/23
|
||||
deny 196.2.8.0 - 196.2.255.255
|
||||
deny 196.3.14.0/23
|
||||
deny 196.3.57.0 - 196.3.64.255
|
||||
deny 196.3.90.0/24
|
||||
deny 196.3.92.0 - 196.3.94.255
|
||||
deny 196.3.96.0/21
|
||||
deny 196.3.105.0/24
|
||||
deny 196.3.107.0 - 196.3.131.255
|
||||
deny 196.3.148.0/22
|
||||
deny 196.3.154.0 - 196.3.183.255
|
||||
deny 196.3.224.0 - 196.4.45.255
|
||||
deny 196.4.71.0 - 196.11.171.255
|
||||
deny 196.11.174.0 - 196.11.239.255
|
||||
deny 196.11.248.0/21
|
||||
deny 196.12.10.0 - 196.12.31.255
|
||||
deny 196.12.128.0/19
|
||||
deny 196.12.192.0 - 196.15.15.255
|
||||
deny 196.15.64.0 - 196.26.255.255
|
||||
deny 196.27.64.0 - 196.28.47.255
|
||||
deny 196.28.64.0 - 196.29.63.255
|
||||
deny 196.29.96.0 - 196.31.255.255
|
||||
deny 196.32.8.0 - 196.32.31.255
|
||||
deny 196.32.96.0/19
|
||||
deny 196.32.160.0 - 196.39.255.255
|
||||
deny 196.40.96.0 - 196.41.255.255
|
||||
deny 196.42.64.0 - 196.216.0.255
|
||||
deny 196.216.2.0 - 197.255.255.255
|
||||
|
||||
# AFRINIC ASNs cannot be transferred to ARIN
|
||||
# From https://www.iana.org/assignments/as-numbers/
|
||||
deny 36864 - 37887
|
||||
deny 327680 - 330751
|
||||
|
||||
# AFRINIC ASNs cannot be transferred to ARIN
|
||||
# From nro-delegated-stats 20240417
|
||||
deny 1228 - 1232
|
||||
deny 2018
|
||||
deny 2561
|
||||
deny 2905
|
||||
deny 3067 - 3068
|
||||
deny 3208
|
||||
deny 3741
|
||||
deny 4178
|
||||
deny 4571
|
||||
deny 5536
|
||||
deny 5713
|
||||
deny 5734
|
||||
deny 6083
|
||||
deny 6089
|
||||
deny 6127
|
||||
deny 6149
|
||||
deny 6180
|
||||
deny 6187
|
||||
deny 6351
|
||||
deny 6529
|
||||
deny 6560
|
||||
deny 6713
|
||||
deny 6879
|
||||
deny 6968
|
||||
deny 7020
|
||||
deny 7154
|
||||
deny 7231
|
||||
deny 7390
|
||||
deny 7420
|
||||
deny 7460
|
||||
deny 7971 - 7972
|
||||
deny 8094
|
||||
deny 8524
|
||||
deny 8770
|
||||
deny 9129
|
||||
deny 10247
|
||||
deny 10262
|
||||
deny 10331
|
||||
deny 10393
|
||||
deny 10474
|
||||
deny 10505
|
||||
deny 10540
|
||||
deny 10575
|
||||
deny 10798
|
||||
deny 10803
|
||||
deny 10898
|
||||
deny 11125
|
||||
deny 11157
|
||||
deny 11201
|
||||
deny 11259
|
||||
deny 11265
|
||||
deny 11380
|
||||
deny 11569
|
||||
deny 11645
|
||||
deny 11744
|
||||
deny 11845
|
||||
deny 11909
|
||||
deny 12091
|
||||
deny 12143
|
||||
deny 12258
|
||||
deny 12455
|
||||
deny 12556
|
||||
deny 13224
|
||||
deny 13402
|
||||
deny 13519
|
||||
deny 13569
|
||||
deny 13854
|
||||
deny 14029
|
||||
deny 14115
|
||||
deny 14331
|
||||
deny 14429
|
||||
deny 14516
|
||||
deny 14988
|
||||
deny 15022
|
||||
deny 15159
|
||||
deny 15399
|
||||
deny 15475
|
||||
deny 15706
|
||||
deny 15804
|
||||
deny 15825
|
||||
deny 15834
|
||||
deny 15964
|
||||
deny 16058
|
||||
deny 16214
|
||||
deny 16284
|
||||
deny 16416
|
||||
deny 16547
|
||||
deny 16630
|
||||
deny 16637
|
||||
deny 16800
|
||||
deny 16853
|
||||
deny 16907
|
||||
deny 17148
|
||||
deny 17220
|
||||
deny 17260
|
||||
deny 17312
|
||||
deny 17400
|
||||
deny 17652
|
||||
deny 18775
|
||||
deny 18922
|
||||
deny 18931
|
||||
deny 19136
|
||||
deny 19232
|
||||
deny 19676
|
||||
deny 19711
|
||||
deny 19832
|
||||
deny 19847
|
||||
deny 20011
|
||||
deny 20086
|
||||
deny 20095
|
||||
deny 20180
|
||||
deny 20294
|
||||
deny 20459
|
||||
deny 20484
|
||||
deny 20858
|
||||
deny 20928
|
||||
deny 21003
|
||||
deny 21152
|
||||
deny 21242
|
||||
deny 21271
|
||||
deny 21278
|
||||
deny 21280
|
||||
deny 21391
|
||||
deny 21452
|
||||
deny 21739
|
||||
deny 21819
|
||||
deny 22354 - 22355
|
||||
deny 22386
|
||||
deny 22572
|
||||
deny 22690
|
||||
deny 22735
|
||||
deny 22750
|
||||
deny 22939
|
||||
deny 23058
|
||||
deny 23549
|
||||
deny 23889
|
||||
deny 24736
|
||||
deny 24757
|
||||
deny 24788
|
||||
deny 24801
|
||||
deny 24835
|
||||
deny 24863
|
||||
deny 24878
|
||||
deny 24987
|
||||
deny 25163
|
||||
deny 25250
|
||||
deny 25362
|
||||
deny 25364
|
||||
deny 25543
|
||||
deny 25568
|
||||
deny 25576
|
||||
deny 25695
|
||||
deny 25726
|
||||
deny 25793
|
||||
deny 25818
|
||||
deny 26106
|
||||
deny 26130
|
||||
deny 26422
|
||||
deny 26625
|
||||
deny 26754
|
||||
deny 27576
|
||||
deny 27598
|
||||
deny 28683
|
||||
deny 28698
|
||||
deny 28913
|
||||
deny 29091
|
||||
deny 29338
|
||||
deny 29340
|
||||
deny 29428
|
||||
deny 29495
|
||||
deny 29544
|
||||
deny 29571
|
||||
deny 29614
|
||||
deny 29674
|
||||
deny 29918
|
||||
deny 29975
|
||||
deny 30073
|
||||
deny 30306
|
||||
deny 30429
|
||||
deny 30619
|
||||
deny 30896
|
||||
deny 30980
|
||||
deny 30982 - 30999
|
||||
deny 31065
|
||||
deny 31245
|
||||
deny 31619
|
||||
deny 31810
|
||||
deny 31856
|
||||
deny 31960
|
||||
deny 32017
|
||||
deny 32279
|
||||
deny 32398
|
||||
deny 32437
|
||||
deny 32653
|
||||
deny 32714
|
||||
deny 32717
|
||||
deny 32842
|
||||
deny 32860
|
||||
deny 33567
|
||||
deny 33579
|
||||
deny 33762 - 33791
|
||||
|
||||
# Private use IPv4 & IPv6 addresses and ASNs
|
||||
deny 0.0.0.0/8 # RFC 1122 Local Identification
|
||||
deny 10.0.0.0/8 # RFC 1918 private space
|
||||
deny 100.64.0.0/10 # RFC 6598 Carrier Grade NAT
|
||||
deny 127.0.0.0/8 # RFC 1122 localhost
|
||||
deny 169.254.0.0/16 # RFC 3927 link local
|
||||
deny 172.16.0.0/12 # RFC 1918 private space
|
||||
deny 192.0.2.0/24 # RFC 5737 TEST-NET-1
|
||||
deny 192.88.99.0/24 # RFC 7526 6to4 anycast relay
|
||||
deny 192.168.0.0/16 # RFC 1918 private space
|
||||
deny 198.18.0.0/15 # RFC 2544 benchmarking
|
||||
deny 198.51.100.0/24 # RFC 5737 TEST-NET-2
|
||||
deny 203.0.113.0/24 # RFC 5737 TEST-NET-3
|
||||
deny 224.0.0.0/4 # Multicast
|
||||
deny 240.0.0.0/4 # Reserved
|
||||
deny 23456 # RFC 4893 AS_TRANS
|
||||
deny 64496 - 64511 # RFC 5398
|
||||
deny 64512 - 65534 # RFC 6996
|
||||
deny 65535 # RFC 7300
|
||||
deny 65536 - 65551 # RFC 5398
|
||||
deny 65552 - 131071 # IANA Reserved
|
||||
deny 4200000000 - 4294967294 # RFC 6996
|
||||
deny 4294967295 # RFC 7300
|
||||
|
||||
# ARIN supports IPv4 and ASN transfers: allow the complement of what is denied
|
||||
allow 0.0.0.0/0
|
||||
allow 1 - 4199999999
|
||||
20
tals/arin.tal
Normal file
20
tals/arin.tal
Normal file
@@ -0,0 +1,20 @@
|
||||
# THIS TRUST ANCHOR LOCATOR IS PROVIDED BY THE AMERICAN REGISTRY FOR
|
||||
# INTERNET NUMBERS (ARIN) "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
|
||||
# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||
# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
|
||||
# IN NO EVENT SHALL ARIN BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
# OF THIS PUBLIC KEY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
https://rrdp.arin.net/arin-rpki-ta.cer
|
||||
rsync://rpki.arin.net/repository/arin-rpki-ta.cer
|
||||
|
||||
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3lZPjbHvMRV5sDDqfLc/685th5Fn
|
||||
reHMJjg8pEZUbG8Y8TQxSBsDebbsDpl3Ov3Cj1WtdrJ3CIfQODCPrrJdOBSrMATeUbPC+JlN
|
||||
f2SRP3UB+VJFgtTj0RN8cEYIuhBW5t6AxQbHhdNQH+A1F/OJdw0q9da2U29Lx85nfFxvnC1E
|
||||
pK9CbLJS4m37+RlpNbT1cba+b+loXpx0Qcb1C4UpJCGDy7uNf5w6/+l7RpATAHqqsX4qCtww
|
||||
DYlbHzp2xk9owF3mkCxzl0HwncO+sEHHeaL3OjtwdIGrRGeHi2Mpt+mvWHhtQqVG+51MHTyg
|
||||
+nIjWFKKGx1Q9+KDx4wJStwveQIDAQAB
|
||||
753
tals/lacnic.constraints
Normal file
753
tals/lacnic.constraints
Normal file
@@ -0,0 +1,753 @@
|
||||
# $OpenBSD: lacnic.constraints,v 1.8 2025/11/23 00:29:18 tb Exp $
|
||||
|
||||
# From https://www.iana.org/assignments/ipv6-unicast-address-assignments
|
||||
allow 2001:1200::/23
|
||||
allow 2800::/12
|
||||
|
||||
# From https://www.iana.org/assignments/as-numbers/
|
||||
allow 27648 - 28671
|
||||
allow 52224 - 53247
|
||||
allow 61440 - 61951
|
||||
allow 64099 - 64197
|
||||
allow 262144 - 275868
|
||||
|
||||
# From nro-delegated-stats 20240417
|
||||
allow 278
|
||||
allow 676
|
||||
allow 1251
|
||||
allow 1292
|
||||
allow 1296
|
||||
allow 1797
|
||||
allow 1831
|
||||
allow 1840
|
||||
allow 1916
|
||||
allow 2146
|
||||
allow 2277
|
||||
allow 2549
|
||||
allow 2638
|
||||
allow 2708
|
||||
allow 2715 - 2716
|
||||
allow 2739
|
||||
allow 2904
|
||||
allow 3132
|
||||
allow 3141
|
||||
allow 3449
|
||||
allow 3454
|
||||
allow 3484
|
||||
allow 3487
|
||||
allow 3496
|
||||
allow 3548
|
||||
allow 3551
|
||||
allow 3556
|
||||
allow 3596 - 3597
|
||||
allow 3603
|
||||
allow 3631 - 3632
|
||||
allow 3636
|
||||
allow 3640
|
||||
allow 3790
|
||||
allow 3816
|
||||
allow 3905
|
||||
allow 3968
|
||||
allow 4141
|
||||
allow 4209
|
||||
allow 4230
|
||||
allow 4242
|
||||
allow 4244
|
||||
allow 4270
|
||||
allow 4387
|
||||
allow 4493
|
||||
allow 4535
|
||||
allow 4914
|
||||
allow 4926
|
||||
allow 4944
|
||||
allow 4964
|
||||
allow 4967
|
||||
allow 4995
|
||||
allow 5005
|
||||
allow 5633
|
||||
allow 5639
|
||||
allow 5648
|
||||
allow 5692
|
||||
allow 5708
|
||||
allow 5722
|
||||
allow 5745
|
||||
allow 5772
|
||||
allow 6057
|
||||
allow 6063 - 6065
|
||||
allow 6084
|
||||
allow 6121
|
||||
allow 6125
|
||||
allow 6133
|
||||
allow 6135
|
||||
allow 6147 - 6148
|
||||
allow 6193
|
||||
allow 6240
|
||||
allow 6306
|
||||
allow 6332
|
||||
allow 6342
|
||||
allow 6400
|
||||
allow 6429
|
||||
allow 6458
|
||||
allow 6471
|
||||
allow 6487
|
||||
allow 6495
|
||||
allow 6503
|
||||
allow 6505
|
||||
allow 6535
|
||||
allow 6543
|
||||
allow 6545
|
||||
allow 6568
|
||||
allow 6590
|
||||
allow 6927
|
||||
allow 6945
|
||||
allow 6957
|
||||
allow 7002
|
||||
allow 7004 - 7005
|
||||
allow 7038
|
||||
allow 7048 - 7049
|
||||
allow 7056
|
||||
allow 7063
|
||||
allow 7080
|
||||
allow 7087
|
||||
allow 7103
|
||||
allow 7120
|
||||
allow 7125
|
||||
allow 7137
|
||||
allow 7149
|
||||
allow 7157
|
||||
allow 7162
|
||||
allow 7167
|
||||
allow 7173
|
||||
allow 7184
|
||||
allow 7195
|
||||
allow 7199
|
||||
allow 7236
|
||||
allow 7298
|
||||
allow 7303
|
||||
allow 7313
|
||||
allow 7315
|
||||
allow 7325
|
||||
allow 7340
|
||||
allow 7365
|
||||
allow 7399
|
||||
allow 7408
|
||||
allow 7414
|
||||
allow 7417 - 7418
|
||||
allow 7428
|
||||
allow 7437 - 7438
|
||||
allow 7465
|
||||
allow 7727
|
||||
allow 7738
|
||||
allow 7803
|
||||
allow 7864
|
||||
allow 7890
|
||||
allow 7906
|
||||
allow 7908
|
||||
allow 7910
|
||||
allow 7927
|
||||
allow 7934
|
||||
allow 7953
|
||||
allow 7965
|
||||
allow 7974
|
||||
allow 7980
|
||||
allow 7984
|
||||
allow 7993 - 7995
|
||||
allow 7997
|
||||
allow 8007
|
||||
allow 8024
|
||||
allow 8026
|
||||
allow 8048
|
||||
allow 8053 - 8056
|
||||
allow 8065 - 8066
|
||||
allow 8096
|
||||
allow 8140 - 8141
|
||||
allow 8151
|
||||
allow 8163
|
||||
allow 8167
|
||||
allow 8178
|
||||
allow 10269
|
||||
allow 10277
|
||||
allow 10285
|
||||
allow 10293
|
||||
allow 10299
|
||||
allow 10301
|
||||
allow 10318
|
||||
allow 10362
|
||||
allow 10391
|
||||
allow 10412
|
||||
allow 10417
|
||||
allow 10420
|
||||
allow 10429
|
||||
allow 10436
|
||||
allow 10452
|
||||
allow 10454
|
||||
allow 10463
|
||||
allow 10476
|
||||
allow 10479
|
||||
allow 10481
|
||||
allow 10495
|
||||
allow 10502
|
||||
allow 10531
|
||||
allow 10560
|
||||
allow 10569
|
||||
allow 10586
|
||||
allow 10600
|
||||
allow 10605 - 10606
|
||||
allow 10617
|
||||
allow 10620
|
||||
allow 10624
|
||||
allow 10630
|
||||
allow 10640
|
||||
allow 10649
|
||||
allow 10670 - 10671
|
||||
allow 10688
|
||||
allow 10691
|
||||
allow 10697
|
||||
allow 10704
|
||||
allow 10706
|
||||
allow 10715
|
||||
allow 10733
|
||||
allow 10757
|
||||
allow 10778
|
||||
allow 10785
|
||||
allow 10795
|
||||
allow 10824
|
||||
allow 10834
|
||||
allow 10841
|
||||
allow 10847
|
||||
allow 10875
|
||||
allow 10881
|
||||
allow 10895
|
||||
allow 10897
|
||||
allow 10906
|
||||
allow 10938
|
||||
allow 10954
|
||||
allow 10964
|
||||
allow 10983
|
||||
allow 10986
|
||||
allow 10992
|
||||
allow 11008
|
||||
allow 11014
|
||||
allow 11053
|
||||
allow 11058
|
||||
allow 11063
|
||||
allow 11081
|
||||
allow 11083
|
||||
allow 11087
|
||||
allow 11097
|
||||
allow 11136
|
||||
allow 11172
|
||||
allow 11193
|
||||
allow 11237
|
||||
allow 11242
|
||||
allow 11254
|
||||
allow 11256
|
||||
allow 11271
|
||||
allow 11284
|
||||
allow 11295
|
||||
allow 11311
|
||||
allow 11315
|
||||
allow 11335
|
||||
allow 11338
|
||||
allow 11340
|
||||
allow 11356
|
||||
allow 11373
|
||||
allow 11390
|
||||
allow 11392
|
||||
allow 11411
|
||||
allow 11415
|
||||
allow 11419
|
||||
allow 11431 - 11432
|
||||
allow 11447
|
||||
allow 11450 - 11451
|
||||
allow 11497 - 11498
|
||||
allow 11503
|
||||
allow 11514
|
||||
allow 11519
|
||||
allow 11556
|
||||
allow 11562
|
||||
allow 11571
|
||||
allow 11581
|
||||
allow 11585
|
||||
allow 11592
|
||||
allow 11599
|
||||
allow 11617
|
||||
allow 11642
|
||||
allow 11644
|
||||
allow 11664
|
||||
allow 11673
|
||||
allow 11677
|
||||
allow 11694
|
||||
allow 11706
|
||||
allow 11750 - 11752
|
||||
allow 11786
|
||||
allow 11800 - 11802
|
||||
allow 11815 - 11816
|
||||
allow 11830
|
||||
allow 11835
|
||||
allow 11844
|
||||
allow 11888
|
||||
allow 11896
|
||||
allow 11921
|
||||
allow 11947
|
||||
allow 11960
|
||||
allow 11993
|
||||
allow 12034
|
||||
allow 12066
|
||||
allow 12127
|
||||
allow 12135 - 12136
|
||||
allow 12140
|
||||
allow 12146
|
||||
allow 12150
|
||||
allow 12248
|
||||
allow 12252
|
||||
allow 12264
|
||||
allow 13316
|
||||
allow 13318
|
||||
allow 13320
|
||||
allow 13353
|
||||
allow 13357
|
||||
allow 13381
|
||||
allow 13424
|
||||
allow 13440
|
||||
allow 13459
|
||||
allow 13474
|
||||
allow 13489
|
||||
allow 13495
|
||||
allow 13514
|
||||
allow 13521 - 13522
|
||||
allow 13544
|
||||
allow 13579
|
||||
allow 13584 - 13585
|
||||
allow 13591
|
||||
allow 13643
|
||||
allow 13679
|
||||
allow 13682
|
||||
allow 13761
|
||||
allow 13774
|
||||
allow 13835
|
||||
allow 13874
|
||||
allow 13878
|
||||
allow 13914
|
||||
allow 13929
|
||||
allow 13934 - 13936
|
||||
allow 13991
|
||||
allow 13999 - 14000
|
||||
allow 14026
|
||||
allow 14030
|
||||
allow 14069
|
||||
allow 14080
|
||||
allow 14084
|
||||
allow 14087
|
||||
allow 14111
|
||||
allow 14117
|
||||
allow 14122
|
||||
allow 14178 - 14179
|
||||
allow 14186 - 14187
|
||||
allow 14202
|
||||
allow 14204
|
||||
allow 14231 - 14232
|
||||
allow 14234
|
||||
allow 14249 - 14250
|
||||
allow 14259
|
||||
allow 14282
|
||||
allow 14285 - 14286
|
||||
allow 14316
|
||||
allow 14318
|
||||
allow 14339
|
||||
allow 14346
|
||||
allow 14377
|
||||
allow 14420
|
||||
allow 14457
|
||||
allow 14463
|
||||
allow 14522
|
||||
allow 14535
|
||||
allow 14553
|
||||
allow 14560
|
||||
allow 14571
|
||||
allow 14624
|
||||
allow 14650
|
||||
allow 14664
|
||||
allow 14674
|
||||
allow 14692
|
||||
allow 14708 - 14709
|
||||
allow 14723
|
||||
allow 14754
|
||||
allow 14759
|
||||
allow 14769
|
||||
allow 14795
|
||||
allow 14840
|
||||
allow 14845
|
||||
allow 14867 - 14868
|
||||
allow 14886
|
||||
allow 14966
|
||||
allow 14970
|
||||
allow 15030
|
||||
allow 15034
|
||||
allow 15064
|
||||
allow 15066
|
||||
allow 15075
|
||||
allow 15078
|
||||
allow 15107
|
||||
allow 15125
|
||||
allow 15151
|
||||
allow 15180
|
||||
allow 15201
|
||||
allow 15208
|
||||
allow 15236
|
||||
allow 15241
|
||||
allow 15246
|
||||
allow 15252
|
||||
allow 15256
|
||||
allow 15274
|
||||
allow 15311
|
||||
allow 16397
|
||||
allow 16418
|
||||
allow 16471
|
||||
allow 16506
|
||||
allow 16522
|
||||
allow 16528
|
||||
allow 16531
|
||||
allow 16592
|
||||
allow 16594
|
||||
allow 16596
|
||||
allow 16606 - 16607
|
||||
allow 16629
|
||||
allow 16663
|
||||
allow 16685
|
||||
allow 16689
|
||||
allow 16701
|
||||
allow 16712
|
||||
allow 16732
|
||||
allow 16735 - 16736
|
||||
allow 16742
|
||||
allow 16762
|
||||
allow 16772
|
||||
allow 16780
|
||||
allow 16814
|
||||
allow 16847
|
||||
allow 16849
|
||||
allow 16864
|
||||
allow 16874
|
||||
allow 16885
|
||||
allow 16891
|
||||
allow 16906
|
||||
allow 16911
|
||||
allow 16960
|
||||
allow 16973
|
||||
allow 16975
|
||||
allow 16990
|
||||
allow 17069
|
||||
allow 17072
|
||||
allow 17079
|
||||
allow 17086
|
||||
allow 17108
|
||||
allow 17126
|
||||
allow 17147
|
||||
allow 17182
|
||||
allow 17205
|
||||
allow 17208
|
||||
allow 17222
|
||||
allow 17249 - 17250
|
||||
allow 17255
|
||||
allow 17257
|
||||
allow 17287
|
||||
allow 17329
|
||||
allow 17376
|
||||
allow 17379
|
||||
allow 17399
|
||||
allow 17401
|
||||
allow 18449
|
||||
allow 18455
|
||||
allow 18466
|
||||
allow 18479
|
||||
allow 18492
|
||||
allow 18496
|
||||
allow 18532
|
||||
allow 18547
|
||||
allow 18576
|
||||
allow 18579
|
||||
allow 18592
|
||||
allow 18644
|
||||
allow 18667
|
||||
allow 18678
|
||||
allow 18734
|
||||
allow 18739
|
||||
allow 18782
|
||||
allow 18809
|
||||
allow 18822
|
||||
allow 18836
|
||||
allow 18840
|
||||
allow 18846
|
||||
allow 18869
|
||||
allow 18881
|
||||
allow 18941
|
||||
allow 18998
|
||||
allow 19033
|
||||
allow 19037 - 19038
|
||||
allow 19064
|
||||
allow 19077
|
||||
allow 19089 - 19090
|
||||
allow 19109
|
||||
allow 19114
|
||||
allow 19132
|
||||
allow 19169
|
||||
allow 19180
|
||||
allow 19182
|
||||
allow 19192
|
||||
allow 19196
|
||||
allow 19200
|
||||
allow 19228
|
||||
allow 19244
|
||||
allow 19259
|
||||
allow 19278
|
||||
allow 19315
|
||||
allow 19332
|
||||
allow 19338
|
||||
allow 19361
|
||||
allow 19373
|
||||
allow 19411
|
||||
allow 19422
|
||||
allow 19429
|
||||
allow 19447
|
||||
allow 19519
|
||||
allow 19553
|
||||
allow 19582 - 19583
|
||||
allow 19611
|
||||
allow 19632
|
||||
allow 19688
|
||||
allow 19723
|
||||
allow 19731
|
||||
allow 19763
|
||||
allow 19767
|
||||
allow 19863
|
||||
allow 19873
|
||||
allow 19889
|
||||
allow 19960
|
||||
allow 19978
|
||||
allow 19989 - 19990
|
||||
allow 20002
|
||||
allow 20015
|
||||
allow 20032
|
||||
allow 20043 - 20044
|
||||
allow 20106
|
||||
allow 20116 - 20117
|
||||
allow 20121
|
||||
allow 20142
|
||||
allow 20173
|
||||
allow 20191
|
||||
allow 20207
|
||||
allow 20232
|
||||
allow 20244
|
||||
allow 20255 - 20256
|
||||
allow 20266
|
||||
allow 20297
|
||||
allow 20299
|
||||
allow 20305
|
||||
allow 20312
|
||||
allow 20321
|
||||
allow 20345
|
||||
allow 20361
|
||||
allow 20363
|
||||
allow 20418
|
||||
allow 21506
|
||||
allow 21520
|
||||
allow 21571
|
||||
allow 21574 - 21575
|
||||
allow 21578
|
||||
allow 21590
|
||||
allow 21599
|
||||
allow 21603
|
||||
allow 21612
|
||||
allow 21614
|
||||
allow 21674
|
||||
allow 21692
|
||||
allow 21741
|
||||
allow 21753
|
||||
allow 21756
|
||||
allow 21765
|
||||
allow 21768
|
||||
allow 21824
|
||||
allow 21826
|
||||
allow 21838
|
||||
allow 21862
|
||||
allow 21883
|
||||
allow 21888
|
||||
allow 21911
|
||||
allow 21917
|
||||
allow 21980
|
||||
allow 22010 - 22011
|
||||
allow 22019
|
||||
allow 22047
|
||||
allow 22055
|
||||
allow 22080
|
||||
allow 22085
|
||||
allow 22092
|
||||
allow 22122
|
||||
allow 22128 - 22129
|
||||
allow 22133
|
||||
allow 22148
|
||||
allow 22177
|
||||
allow 22185
|
||||
allow 22227
|
||||
allow 22250
|
||||
allow 22305
|
||||
allow 22313
|
||||
allow 22341
|
||||
allow 22356
|
||||
allow 22368
|
||||
allow 22371
|
||||
allow 22381 - 22382
|
||||
allow 22407
|
||||
allow 22411
|
||||
allow 22431
|
||||
allow 22453
|
||||
allow 22501
|
||||
allow 22508
|
||||
allow 22515
|
||||
allow 22529
|
||||
allow 22541
|
||||
allow 22548
|
||||
allow 22566
|
||||
allow 22628
|
||||
allow 22661
|
||||
allow 22678
|
||||
allow 22689
|
||||
allow 22698 - 22699
|
||||
allow 22706
|
||||
allow 22724
|
||||
allow 22726
|
||||
allow 22745
|
||||
allow 22798
|
||||
allow 22818 - 22819
|
||||
allow 22833
|
||||
allow 22860
|
||||
allow 22869
|
||||
allow 22876
|
||||
allow 22882
|
||||
allow 22884
|
||||
allow 22889
|
||||
allow 22894
|
||||
allow 22908
|
||||
allow 22924
|
||||
allow 22927
|
||||
allow 22975
|
||||
allow 23002
|
||||
allow 23007
|
||||
allow 23020
|
||||
allow 23031
|
||||
allow 23074
|
||||
allow 23091
|
||||
allow 23105 - 23106
|
||||
allow 23113
|
||||
allow 23128
|
||||
allow 23140
|
||||
allow 23201 - 23202
|
||||
allow 23216
|
||||
allow 23243
|
||||
allow 23246
|
||||
allow 23289
|
||||
allow 23353
|
||||
allow 23360
|
||||
allow 23382 - 23383
|
||||
allow 23416
|
||||
allow 23487 - 23488
|
||||
allow 23495
|
||||
allow 23541
|
||||
allow 25607
|
||||
allow 25620
|
||||
allow 25701
|
||||
allow 25705
|
||||
allow 25718
|
||||
allow 25734
|
||||
allow 25812
|
||||
allow 25832
|
||||
allow 25908
|
||||
allow 25927
|
||||
allow 25933
|
||||
allow 25998
|
||||
allow 26048
|
||||
allow 26061
|
||||
allow 26090
|
||||
allow 26104 - 26105
|
||||
allow 26107
|
||||
allow 26112
|
||||
allow 26118 - 26119
|
||||
allow 26136
|
||||
allow 26162
|
||||
allow 26173
|
||||
allow 26194
|
||||
allow 26210
|
||||
allow 26218
|
||||
allow 26317
|
||||
allow 26418
|
||||
allow 26426
|
||||
allow 26434
|
||||
allow 26473
|
||||
allow 26505
|
||||
allow 26592 - 26623
|
||||
|
||||
# AFRINIC Internet Number Resources cannot be transferred
|
||||
# From https://www.iana.org/assignments/ipv4-address-space/
|
||||
deny 41.0.0.0/8
|
||||
deny 102.0.0.0/8
|
||||
deny 105.0.0.0/8
|
||||
deny 154.0.0.0/16
|
||||
deny 154.16.0.0/16
|
||||
deny 154.65.0.0 - 154.255.255.255
|
||||
deny 196.0.0.0 - 196.1.0.255
|
||||
deny 196.1.4.0/24
|
||||
deny 196.1.7.0 - 196.1.63.255
|
||||
deny 196.1.71.0/24
|
||||
deny 196.1.74.0 - 196.1.103.255
|
||||
deny 196.1.115.0 - 196.1.133.255
|
||||
deny 196.1.137.0/24
|
||||
deny 196.1.143.0 - 196.1.159.255
|
||||
deny 196.1.176.0 - 196.1.255.255
|
||||
deny 196.2.2.0/23
|
||||
deny 196.2.8.0 - 196.2.255.255
|
||||
deny 196.3.14.0/23
|
||||
deny 196.3.57.0 - 196.3.64.255
|
||||
deny 196.3.90.0/24
|
||||
deny 196.3.92.0 - 196.3.94.255
|
||||
deny 196.3.96.0/21
|
||||
deny 196.3.105.0/24
|
||||
deny 196.3.107.0 - 196.3.131.255
|
||||
deny 196.3.148.0/22
|
||||
deny 196.3.154.0 - 196.3.183.255
|
||||
deny 196.3.224.0 - 196.4.45.255
|
||||
deny 196.4.71.0 - 196.11.171.255
|
||||
deny 196.11.174.0 - 196.11.239.255
|
||||
deny 196.11.248.0/21
|
||||
deny 196.12.10.0 - 196.12.31.255
|
||||
deny 196.12.128.0/19
|
||||
deny 196.12.192.0 - 196.15.15.255
|
||||
deny 196.15.64.0 - 196.26.255.255
|
||||
deny 196.27.64.0 - 196.28.47.255
|
||||
deny 196.28.64.0 - 196.29.63.255
|
||||
deny 196.29.96.0 - 196.31.255.255
|
||||
deny 196.32.8.0 - 196.32.31.255
|
||||
deny 196.32.96.0/19
|
||||
deny 196.32.160.0 - 196.39.255.255
|
||||
deny 196.40.96.0 - 196.41.255.255
|
||||
deny 196.42.64.0 - 196.216.0.255
|
||||
deny 196.216.2.0 - 197.255.255.255
|
||||
|
||||
# Private use IPv4 & IPv6 addresses and ASNs
|
||||
deny 0.0.0.0/8 # RFC 1122 Local Identification
|
||||
deny 10.0.0.0/8 # RFC 1918 private space
|
||||
deny 100.64.0.0/10 # RFC 6598 Carrier Grade NAT
|
||||
deny 127.0.0.0/8 # RFC 1122 localhost
|
||||
deny 169.254.0.0/16 # RFC 3927 link local
|
||||
deny 172.16.0.0/12 # RFC 1918 private space
|
||||
deny 192.0.2.0/24 # RFC 5737 TEST-NET-1
|
||||
deny 192.88.99.0/24 # RFC 7526 6to4 anycast relay
|
||||
deny 192.168.0.0/16 # RFC 1918 private space
|
||||
deny 198.18.0.0/15 # RFC 2544 benchmarking
|
||||
deny 198.51.100.0/24 # RFC 5737 TEST-NET-2
|
||||
deny 203.0.113.0/24 # RFC 5737 TEST-NET-3
|
||||
deny 224.0.0.0/4 # Multicast
|
||||
deny 240.0.0.0/4 # Reserved
|
||||
|
||||
# LACNIC supports only IPv4 transfers: allow the complement of what is denied
|
||||
allow 0.0.0.0/0
|
||||
10
tals/lacnic.tal
Normal file
10
tals/lacnic.tal
Normal file
@@ -0,0 +1,10 @@
|
||||
https://rrdp.lacnic.net/ta/rta-lacnic-rpki.cer
|
||||
rsync://repository.lacnic.net/rpki/lacnic/rta-lacnic-rpki.cer
|
||||
|
||||
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqZEzhYK0+PtDOPfub/KR
|
||||
c3MeWx3neXx4/wbnJWGbNAtbYqXg3uU5J4HFzPgk/VIppgSKAhlO0H60DRP48by9
|
||||
gr5/yDHu2KXhOmnMg46sYsUIpfgtBS9+VtrqWziJfb+pkGtuOWeTnj6zBmBNZKK+
|
||||
5AlMCW1WPhrylIcB+XSZx8tk9GS/3SMQ+YfMVwwAyYjsex14Uzto4GjONALE5oh1
|
||||
M3+glRQduD6vzSwOD+WahMbc9vCOTED+2McLHRKgNaQf0YJ9a1jG9oJIvDkKXEqd
|
||||
fqDRktwyoD74cV57bW3tBAexB7GglITbInyQAsmdngtfg2LUMrcROHHP86QPZINj
|
||||
DQIDAQAB
|
||||
985
tals/ripe.constraints
Normal file
985
tals/ripe.constraints
Normal file
@@ -0,0 +1,985 @@
|
||||
# $OpenBSD: ripe.constraints,v 1.6 2026/07/09 12:29:52 job Exp $
|
||||
|
||||
# From https://www.iana.org/assignments/ipv6-unicast-address-assignments
|
||||
allow 2001:600::/23
|
||||
allow 2001:800::/22
|
||||
allow 2001:1400::/22
|
||||
allow 2001:1a00::/23
|
||||
allow 2001:1c00::/22
|
||||
allow 2001:2000::/19
|
||||
allow 2001:4000::/23
|
||||
allow 2001:4600::/23
|
||||
allow 2001:4a00::/23
|
||||
allow 2001:4c00::/23
|
||||
allow 2001:5000::/20
|
||||
allow 2003::/18
|
||||
allow 2a00::/12
|
||||
allow 2a10::/12
|
||||
|
||||
# LACNIC ASNs cannot be transferred to RIPE NCC
|
||||
# From https://www.iana.org/assignments/as-numbers/
|
||||
deny 27648 - 28671
|
||||
deny 52224 - 53247
|
||||
deny 61440 - 61951
|
||||
deny 64099 - 64197
|
||||
deny 262144 - 275868
|
||||
|
||||
# LACNIC ASNs cannot be transferred to RIPE NCC
|
||||
# From nro-delegated-stats 20240417
|
||||
deny 278
|
||||
deny 676
|
||||
deny 1251
|
||||
deny 1292
|
||||
deny 1296
|
||||
deny 1797
|
||||
deny 1831
|
||||
deny 1840
|
||||
deny 1916
|
||||
deny 2146
|
||||
deny 2277
|
||||
deny 2549
|
||||
deny 2638
|
||||
deny 2708
|
||||
deny 2715 - 2716
|
||||
deny 2739
|
||||
deny 2904
|
||||
deny 3132
|
||||
deny 3141
|
||||
deny 3449
|
||||
deny 3454
|
||||
deny 3484
|
||||
deny 3487
|
||||
deny 3496
|
||||
deny 3548
|
||||
deny 3551
|
||||
deny 3556
|
||||
deny 3596 - 3597
|
||||
deny 3603
|
||||
deny 3631 - 3632
|
||||
deny 3636
|
||||
deny 3640
|
||||
deny 3790
|
||||
deny 3816
|
||||
deny 3905
|
||||
deny 3968
|
||||
deny 4141
|
||||
deny 4209
|
||||
deny 4230
|
||||
deny 4242
|
||||
deny 4244
|
||||
deny 4270
|
||||
deny 4387
|
||||
deny 4493
|
||||
deny 4535
|
||||
deny 4914
|
||||
deny 4926
|
||||
deny 4944
|
||||
deny 4964
|
||||
deny 4967
|
||||
deny 4995
|
||||
deny 5005
|
||||
deny 5633
|
||||
deny 5639
|
||||
deny 5648
|
||||
deny 5692
|
||||
deny 5708
|
||||
deny 5722
|
||||
deny 5745
|
||||
deny 5772
|
||||
deny 6057
|
||||
deny 6063 - 6065
|
||||
deny 6084
|
||||
deny 6121
|
||||
deny 6125
|
||||
deny 6133
|
||||
deny 6135
|
||||
deny 6147 - 6148
|
||||
deny 6193
|
||||
deny 6240
|
||||
deny 6306
|
||||
deny 6332
|
||||
deny 6342
|
||||
deny 6400
|
||||
deny 6429
|
||||
deny 6458
|
||||
deny 6471
|
||||
deny 6487
|
||||
deny 6495
|
||||
deny 6503
|
||||
deny 6505
|
||||
deny 6535
|
||||
deny 6543
|
||||
deny 6545
|
||||
deny 6568
|
||||
deny 6590
|
||||
deny 6927
|
||||
deny 6945
|
||||
deny 6957
|
||||
deny 7002
|
||||
deny 7004 - 7005
|
||||
deny 7038
|
||||
deny 7048 - 7049
|
||||
deny 7056
|
||||
deny 7063
|
||||
deny 7080
|
||||
deny 7087
|
||||
deny 7103
|
||||
deny 7120
|
||||
deny 7125
|
||||
deny 7137
|
||||
deny 7149
|
||||
deny 7157
|
||||
deny 7162
|
||||
deny 7167
|
||||
deny 7173
|
||||
deny 7184
|
||||
deny 7195
|
||||
deny 7199
|
||||
deny 7236
|
||||
deny 7298
|
||||
deny 7303
|
||||
deny 7313
|
||||
deny 7315
|
||||
deny 7325
|
||||
deny 7340
|
||||
deny 7365
|
||||
deny 7399
|
||||
deny 7408
|
||||
deny 7414
|
||||
deny 7417 - 7418
|
||||
deny 7428
|
||||
deny 7437 - 7438
|
||||
deny 7465
|
||||
deny 7727
|
||||
deny 7738
|
||||
deny 7803
|
||||
deny 7864
|
||||
deny 7890
|
||||
deny 7906
|
||||
deny 7908
|
||||
deny 7910
|
||||
deny 7927
|
||||
deny 7934
|
||||
deny 7953
|
||||
deny 7965
|
||||
deny 7974
|
||||
deny 7980
|
||||
deny 7984
|
||||
deny 7993 - 7995
|
||||
deny 7997
|
||||
deny 8007
|
||||
deny 8024
|
||||
deny 8026
|
||||
deny 8048
|
||||
deny 8053 - 8056
|
||||
deny 8065 - 8066
|
||||
deny 8096
|
||||
deny 8140 - 8141
|
||||
deny 8151
|
||||
deny 8163
|
||||
deny 8167
|
||||
deny 8178
|
||||
deny 10269
|
||||
deny 10277
|
||||
deny 10285
|
||||
deny 10293
|
||||
deny 10299
|
||||
deny 10301
|
||||
deny 10318
|
||||
deny 10362
|
||||
deny 10391
|
||||
deny 10412
|
||||
deny 10417
|
||||
deny 10420
|
||||
deny 10429
|
||||
deny 10436
|
||||
deny 10452
|
||||
deny 10454
|
||||
deny 10463
|
||||
deny 10476
|
||||
deny 10479
|
||||
deny 10481
|
||||
deny 10495
|
||||
deny 10502
|
||||
deny 10531
|
||||
deny 10560
|
||||
deny 10569
|
||||
deny 10586
|
||||
deny 10600
|
||||
deny 10605 - 10606
|
||||
deny 10617
|
||||
deny 10620
|
||||
deny 10624
|
||||
deny 10630
|
||||
deny 10640
|
||||
deny 10649
|
||||
deny 10670 - 10671
|
||||
deny 10688
|
||||
deny 10691
|
||||
deny 10697
|
||||
deny 10704
|
||||
deny 10706
|
||||
deny 10715
|
||||
deny 10733
|
||||
deny 10757
|
||||
deny 10778
|
||||
deny 10785
|
||||
deny 10795
|
||||
deny 10824
|
||||
deny 10834
|
||||
deny 10841
|
||||
deny 10847
|
||||
deny 10875
|
||||
deny 10881
|
||||
deny 10895
|
||||
deny 10897
|
||||
deny 10906
|
||||
deny 10938
|
||||
deny 10954
|
||||
deny 10964
|
||||
deny 10983
|
||||
deny 10986
|
||||
deny 10992
|
||||
deny 11008
|
||||
deny 11014
|
||||
deny 11053
|
||||
deny 11058
|
||||
deny 11063
|
||||
deny 11081
|
||||
deny 11083
|
||||
deny 11087
|
||||
deny 11097
|
||||
deny 11136
|
||||
deny 11172
|
||||
deny 11193
|
||||
deny 11237
|
||||
deny 11242
|
||||
deny 11254
|
||||
deny 11256
|
||||
deny 11271
|
||||
deny 11284
|
||||
deny 11295
|
||||
deny 11311
|
||||
deny 11315
|
||||
deny 11335
|
||||
deny 11338
|
||||
deny 11340
|
||||
deny 11356
|
||||
deny 11373
|
||||
deny 11390
|
||||
deny 11392
|
||||
deny 11411
|
||||
deny 11415
|
||||
deny 11419
|
||||
deny 11431 - 11432
|
||||
deny 11447
|
||||
deny 11450 - 11451
|
||||
deny 11497 - 11498
|
||||
deny 11503
|
||||
deny 11514
|
||||
deny 11519
|
||||
deny 11556
|
||||
deny 11562
|
||||
deny 11571
|
||||
deny 11581
|
||||
deny 11585
|
||||
deny 11592
|
||||
deny 11599
|
||||
deny 11617
|
||||
deny 11642
|
||||
deny 11644
|
||||
deny 11664
|
||||
deny 11673
|
||||
deny 11677
|
||||
deny 11694
|
||||
deny 11706
|
||||
deny 11750 - 11752
|
||||
deny 11786
|
||||
deny 11800 - 11802
|
||||
deny 11815 - 11816
|
||||
deny 11830
|
||||
deny 11835
|
||||
deny 11844
|
||||
deny 11888
|
||||
deny 11896
|
||||
deny 11921
|
||||
deny 11947
|
||||
deny 11960
|
||||
deny 11993
|
||||
deny 12034
|
||||
deny 12066
|
||||
deny 12127
|
||||
deny 12135 - 12136
|
||||
deny 12140
|
||||
deny 12146
|
||||
deny 12150
|
||||
deny 12248
|
||||
deny 12252
|
||||
deny 12264
|
||||
deny 13316
|
||||
deny 13318
|
||||
deny 13320
|
||||
deny 13353
|
||||
deny 13357
|
||||
deny 13381
|
||||
deny 13424
|
||||
deny 13440
|
||||
deny 13459
|
||||
deny 13474
|
||||
deny 13489
|
||||
deny 13495
|
||||
deny 13514
|
||||
deny 13521 - 13522
|
||||
deny 13544
|
||||
deny 13579
|
||||
deny 13584 - 13585
|
||||
deny 13591
|
||||
deny 13643
|
||||
deny 13679
|
||||
deny 13682
|
||||
deny 13761
|
||||
deny 13774
|
||||
deny 13835
|
||||
deny 13874
|
||||
deny 13878
|
||||
deny 13914
|
||||
deny 13929
|
||||
deny 13934 - 13936
|
||||
deny 13991
|
||||
deny 13999 - 14000
|
||||
deny 14026
|
||||
deny 14030
|
||||
deny 14069
|
||||
deny 14080
|
||||
deny 14084
|
||||
deny 14087
|
||||
deny 14111
|
||||
deny 14117
|
||||
deny 14122
|
||||
deny 14178 - 14179
|
||||
deny 14186 - 14187
|
||||
deny 14202
|
||||
deny 14204
|
||||
deny 14231 - 14232
|
||||
deny 14234
|
||||
deny 14249 - 14250
|
||||
deny 14259
|
||||
deny 14282
|
||||
deny 14285 - 14286
|
||||
deny 14316
|
||||
deny 14318
|
||||
deny 14339
|
||||
deny 14346
|
||||
deny 14377
|
||||
deny 14420
|
||||
deny 14457
|
||||
deny 14463
|
||||
deny 14522
|
||||
deny 14535
|
||||
deny 14553
|
||||
deny 14560
|
||||
deny 14571
|
||||
deny 14624
|
||||
deny 14650
|
||||
deny 14664
|
||||
deny 14674
|
||||
deny 14692
|
||||
deny 14708 - 14709
|
||||
deny 14723
|
||||
deny 14754
|
||||
deny 14759
|
||||
deny 14769
|
||||
deny 14795
|
||||
deny 14840
|
||||
deny 14845
|
||||
deny 14867 - 14868
|
||||
deny 14886
|
||||
deny 14966
|
||||
deny 14970
|
||||
deny 15030
|
||||
deny 15034
|
||||
deny 15064
|
||||
deny 15066
|
||||
deny 15075
|
||||
deny 15078
|
||||
deny 15107
|
||||
deny 15125
|
||||
deny 15151
|
||||
deny 15180
|
||||
deny 15201
|
||||
deny 15208
|
||||
deny 15236
|
||||
deny 15241
|
||||
deny 15246
|
||||
deny 15252
|
||||
deny 15256
|
||||
deny 15274
|
||||
deny 15311
|
||||
deny 16397
|
||||
deny 16418
|
||||
deny 16471
|
||||
deny 16506
|
||||
deny 16522
|
||||
deny 16528
|
||||
deny 16531
|
||||
deny 16592
|
||||
deny 16594
|
||||
deny 16596
|
||||
deny 16606 - 16607
|
||||
deny 16629
|
||||
deny 16663
|
||||
deny 16685
|
||||
deny 16689
|
||||
deny 16701
|
||||
deny 16712
|
||||
deny 16732
|
||||
deny 16735 - 16736
|
||||
deny 16742
|
||||
deny 16762
|
||||
deny 16772
|
||||
deny 16780
|
||||
deny 16814
|
||||
deny 16847
|
||||
deny 16849
|
||||
deny 16864
|
||||
deny 16874
|
||||
deny 16885
|
||||
deny 16891
|
||||
deny 16906
|
||||
deny 16911
|
||||
deny 16960
|
||||
deny 16973
|
||||
deny 16975
|
||||
deny 16990
|
||||
deny 17069
|
||||
deny 17072
|
||||
deny 17079
|
||||
deny 17086
|
||||
deny 17108
|
||||
deny 17126
|
||||
deny 17147
|
||||
deny 17182
|
||||
deny 17205
|
||||
deny 17208
|
||||
deny 17222
|
||||
deny 17249 - 17250
|
||||
deny 17255
|
||||
deny 17257
|
||||
deny 17287
|
||||
deny 17329
|
||||
deny 17376
|
||||
deny 17379
|
||||
deny 17399
|
||||
deny 17401
|
||||
deny 18449
|
||||
deny 18455
|
||||
deny 18466
|
||||
deny 18479
|
||||
deny 18492
|
||||
deny 18496
|
||||
deny 18532
|
||||
deny 18547
|
||||
deny 18576
|
||||
deny 18579
|
||||
deny 18592
|
||||
deny 18644
|
||||
deny 18667
|
||||
deny 18678
|
||||
deny 18734
|
||||
deny 18739
|
||||
deny 18782
|
||||
deny 18809
|
||||
deny 18822
|
||||
deny 18836
|
||||
deny 18840
|
||||
deny 18846
|
||||
deny 18869
|
||||
deny 18881
|
||||
deny 18941
|
||||
deny 18998
|
||||
deny 19033
|
||||
deny 19037 - 19038
|
||||
deny 19064
|
||||
deny 19077
|
||||
deny 19089 - 19090
|
||||
deny 19109
|
||||
deny 19114
|
||||
deny 19132
|
||||
deny 19169
|
||||
deny 19180
|
||||
deny 19182
|
||||
deny 19192
|
||||
deny 19196
|
||||
deny 19200
|
||||
deny 19228
|
||||
deny 19244
|
||||
deny 19259
|
||||
deny 19278
|
||||
deny 19315
|
||||
deny 19332
|
||||
deny 19338
|
||||
deny 19361
|
||||
deny 19373
|
||||
deny 19411
|
||||
deny 19422
|
||||
deny 19429
|
||||
deny 19447
|
||||
deny 19519
|
||||
deny 19553
|
||||
deny 19582 - 19583
|
||||
deny 19611
|
||||
deny 19632
|
||||
deny 19688
|
||||
deny 19723
|
||||
deny 19731
|
||||
deny 19763
|
||||
deny 19767
|
||||
deny 19863
|
||||
deny 19873
|
||||
deny 19889
|
||||
deny 19960
|
||||
deny 19978
|
||||
deny 19989 - 19990
|
||||
deny 20002
|
||||
deny 20015
|
||||
deny 20032
|
||||
deny 20043 - 20044
|
||||
deny 20106
|
||||
deny 20116 - 20117
|
||||
deny 20121
|
||||
deny 20142
|
||||
deny 20173
|
||||
deny 20191
|
||||
deny 20207
|
||||
deny 20232
|
||||
deny 20244
|
||||
deny 20255 - 20256
|
||||
deny 20266
|
||||
deny 20297
|
||||
deny 20299
|
||||
deny 20305
|
||||
deny 20312
|
||||
deny 20321
|
||||
deny 20345
|
||||
deny 20361
|
||||
deny 20363
|
||||
deny 20418
|
||||
deny 21506
|
||||
deny 21520
|
||||
deny 21571
|
||||
deny 21574 - 21575
|
||||
deny 21578
|
||||
deny 21590
|
||||
deny 21599
|
||||
deny 21603
|
||||
deny 21612
|
||||
deny 21614
|
||||
deny 21674
|
||||
deny 21692
|
||||
deny 21741
|
||||
deny 21753
|
||||
deny 21756
|
||||
deny 21765
|
||||
deny 21768
|
||||
deny 21824
|
||||
deny 21826
|
||||
deny 21838
|
||||
deny 21862
|
||||
deny 21883
|
||||
deny 21888
|
||||
deny 21911
|
||||
deny 21917
|
||||
deny 21980
|
||||
deny 22010 - 22011
|
||||
deny 22019
|
||||
deny 22047
|
||||
deny 22055
|
||||
deny 22080
|
||||
deny 22085
|
||||
deny 22092
|
||||
deny 22122
|
||||
deny 22128 - 22129
|
||||
deny 22133
|
||||
deny 22148
|
||||
deny 22177
|
||||
deny 22185
|
||||
deny 22227
|
||||
deny 22250
|
||||
deny 22305
|
||||
deny 22313
|
||||
deny 22341
|
||||
deny 22356
|
||||
deny 22368
|
||||
deny 22371
|
||||
deny 22381 - 22382
|
||||
deny 22407
|
||||
deny 22411
|
||||
deny 22431
|
||||
deny 22453
|
||||
deny 22501
|
||||
deny 22508
|
||||
deny 22515
|
||||
deny 22529
|
||||
deny 22541
|
||||
deny 22548
|
||||
deny 22566
|
||||
deny 22628
|
||||
deny 22661
|
||||
deny 22678
|
||||
deny 22689
|
||||
deny 22698 - 22699
|
||||
deny 22706
|
||||
deny 22724
|
||||
deny 22726
|
||||
deny 22745
|
||||
deny 22798
|
||||
deny 22818 - 22819
|
||||
deny 22833
|
||||
deny 22860
|
||||
deny 22869
|
||||
deny 22876
|
||||
deny 22882
|
||||
deny 22884
|
||||
deny 22889
|
||||
deny 22894
|
||||
deny 22908
|
||||
deny 22924
|
||||
deny 22927
|
||||
deny 22975
|
||||
deny 23002
|
||||
deny 23007
|
||||
deny 23020
|
||||
deny 23031
|
||||
deny 23074
|
||||
deny 23091
|
||||
deny 23105 - 23106
|
||||
deny 23113
|
||||
deny 23128
|
||||
deny 23140
|
||||
deny 23201 - 23202
|
||||
deny 23216
|
||||
deny 23243
|
||||
deny 23246
|
||||
deny 23289
|
||||
deny 23353
|
||||
deny 23360
|
||||
deny 23382 - 23383
|
||||
deny 23416
|
||||
deny 23487 - 23488
|
||||
deny 23495
|
||||
deny 23541
|
||||
deny 25607
|
||||
deny 25620
|
||||
deny 25701
|
||||
deny 25705
|
||||
deny 25718
|
||||
deny 25734
|
||||
deny 25812
|
||||
deny 25832
|
||||
deny 25908
|
||||
deny 25927
|
||||
deny 25933
|
||||
deny 25998
|
||||
deny 26048
|
||||
deny 26061
|
||||
deny 26090
|
||||
deny 26104 - 26105
|
||||
deny 26107
|
||||
deny 26112
|
||||
deny 26118 - 26119
|
||||
deny 26136
|
||||
deny 26162
|
||||
deny 26173
|
||||
deny 26194
|
||||
deny 26210
|
||||
deny 26218
|
||||
deny 26317
|
||||
deny 26418
|
||||
deny 26426
|
||||
deny 26434
|
||||
deny 26473
|
||||
deny 26505
|
||||
deny 26592 - 26623
|
||||
|
||||
# AFRINIC IPv4 resources cannot be transferred to RIPE NCC
|
||||
# From https://www.iana.org/assignments/ipv4-address-space/
|
||||
deny 41.0.0.0/8
|
||||
deny 102.0.0.0/8
|
||||
deny 105.0.0.0/8
|
||||
deny 154.0.0.0/16
|
||||
deny 154.16.0.0/16
|
||||
deny 154.65.0.0 - 154.255.255.255
|
||||
deny 196.0.0.0 - 196.1.0.255
|
||||
deny 196.1.4.0/24
|
||||
deny 196.1.7.0 - 196.1.63.255
|
||||
deny 196.1.71.0/24
|
||||
deny 196.1.74.0 - 196.1.103.255
|
||||
deny 196.1.115.0 - 196.1.133.255
|
||||
deny 196.1.137.0/24
|
||||
deny 196.1.143.0 - 196.1.159.255
|
||||
deny 196.1.176.0 - 196.1.255.255
|
||||
deny 196.2.2.0/23
|
||||
deny 196.2.8.0 - 196.2.255.255
|
||||
deny 196.3.14.0/23
|
||||
deny 196.3.57.0 - 196.3.64.255
|
||||
deny 196.3.90.0/24
|
||||
deny 196.3.92.0 - 196.3.94.255
|
||||
deny 196.3.96.0/21
|
||||
deny 196.3.105.0/24
|
||||
deny 196.3.107.0 - 196.3.131.255
|
||||
deny 196.3.148.0/22
|
||||
deny 196.3.154.0 - 196.3.183.255
|
||||
deny 196.3.224.0 - 196.4.45.255
|
||||
deny 196.4.71.0 - 196.11.171.255
|
||||
deny 196.11.174.0 - 196.11.239.255
|
||||
deny 196.11.248.0/21
|
||||
deny 196.12.10.0 - 196.12.31.255
|
||||
deny 196.12.128.0/19
|
||||
deny 196.12.192.0 - 196.15.15.255
|
||||
deny 196.15.64.0 - 196.26.255.255
|
||||
deny 196.27.64.0 - 196.28.47.255
|
||||
deny 196.28.64.0 - 196.29.63.255
|
||||
deny 196.29.96.0 - 196.31.255.255
|
||||
deny 196.32.8.0 - 196.32.31.255
|
||||
deny 196.32.96.0/19
|
||||
deny 196.32.160.0 - 196.39.255.255
|
||||
deny 196.40.96.0 - 196.41.255.255
|
||||
deny 196.42.64.0 - 196.216.0.255
|
||||
deny 196.216.2.0 - 197.255.255.255
|
||||
|
||||
# AFRINIC ASNs cannot be transferred to RIPE NCC
|
||||
# From https://www.iana.org/assignments/as-numbers/
|
||||
deny 36864 - 37887
|
||||
deny 327680 - 330751
|
||||
|
||||
# AFRINIC ASNs cannot be transferred to RIPE NCC
|
||||
# From nro-delegated-stats 20240417
|
||||
deny 1228 - 1232
|
||||
deny 2018
|
||||
deny 2561
|
||||
deny 2905
|
||||
deny 3067 - 3068
|
||||
deny 3208
|
||||
deny 3741
|
||||
deny 4178
|
||||
deny 4571
|
||||
deny 5536
|
||||
deny 5713
|
||||
deny 5734
|
||||
deny 6083
|
||||
deny 6089
|
||||
deny 6127
|
||||
deny 6149
|
||||
deny 6180
|
||||
deny 6187
|
||||
deny 6351
|
||||
deny 6529
|
||||
deny 6560
|
||||
deny 6713
|
||||
deny 6879
|
||||
deny 6968
|
||||
deny 7020
|
||||
deny 7154
|
||||
deny 7231
|
||||
deny 7390
|
||||
deny 7420
|
||||
deny 7460
|
||||
deny 7971 - 7972
|
||||
deny 8094
|
||||
deny 8524
|
||||
deny 8770
|
||||
deny 9129
|
||||
deny 10247
|
||||
deny 10262
|
||||
deny 10331
|
||||
deny 10393
|
||||
deny 10474
|
||||
deny 10505
|
||||
deny 10540
|
||||
deny 10575
|
||||
deny 10798
|
||||
deny 10803
|
||||
deny 10898
|
||||
deny 11125
|
||||
deny 11157
|
||||
deny 11201
|
||||
deny 11259
|
||||
deny 11265
|
||||
deny 11380
|
||||
deny 11569
|
||||
deny 11645
|
||||
deny 11744
|
||||
deny 11845
|
||||
deny 11909
|
||||
deny 12091
|
||||
deny 12143
|
||||
deny 12258
|
||||
deny 12455
|
||||
deny 12556
|
||||
deny 13224
|
||||
deny 13402
|
||||
deny 13519
|
||||
deny 13569
|
||||
deny 13854
|
||||
deny 14029
|
||||
deny 14115
|
||||
deny 14331
|
||||
deny 14429
|
||||
deny 14516
|
||||
deny 14988
|
||||
deny 15022
|
||||
deny 15159
|
||||
deny 15399
|
||||
deny 15475
|
||||
deny 15706
|
||||
deny 15804
|
||||
deny 15825
|
||||
deny 15834
|
||||
deny 15964
|
||||
deny 16058
|
||||
deny 16214
|
||||
deny 16284
|
||||
deny 16416
|
||||
deny 16547
|
||||
deny 16630
|
||||
deny 16637
|
||||
deny 16800
|
||||
deny 16853
|
||||
deny 16907
|
||||
deny 17148
|
||||
deny 17220
|
||||
deny 17260
|
||||
deny 17312
|
||||
deny 17400
|
||||
deny 17652
|
||||
deny 18775
|
||||
deny 18922
|
||||
deny 18931
|
||||
deny 19136
|
||||
deny 19232
|
||||
deny 19676
|
||||
deny 19711
|
||||
deny 19832
|
||||
deny 19847
|
||||
deny 20011
|
||||
deny 20086
|
||||
deny 20095
|
||||
deny 20180
|
||||
deny 20294
|
||||
deny 20459
|
||||
deny 20484
|
||||
deny 20858
|
||||
deny 20928
|
||||
deny 21003
|
||||
deny 21152
|
||||
deny 21242
|
||||
deny 21271
|
||||
deny 21278
|
||||
deny 21280
|
||||
deny 21391
|
||||
deny 21452
|
||||
deny 21739
|
||||
deny 21819
|
||||
deny 22354 - 22355
|
||||
deny 22386
|
||||
deny 22572
|
||||
deny 22690
|
||||
deny 22735
|
||||
deny 22750
|
||||
deny 22939
|
||||
deny 23058
|
||||
deny 23549
|
||||
deny 23889
|
||||
deny 24736
|
||||
deny 24757
|
||||
deny 24788
|
||||
deny 24801
|
||||
deny 24835
|
||||
deny 24863
|
||||
deny 24878
|
||||
deny 24987
|
||||
deny 25163
|
||||
deny 25250
|
||||
deny 25362
|
||||
deny 25364
|
||||
deny 25543
|
||||
deny 25568
|
||||
deny 25576
|
||||
deny 25695
|
||||
deny 25726
|
||||
deny 25793
|
||||
deny 25818
|
||||
deny 26106
|
||||
deny 26130
|
||||
deny 26422
|
||||
deny 26625
|
||||
deny 26754
|
||||
deny 27576
|
||||
deny 27598
|
||||
deny 28683
|
||||
deny 28698
|
||||
deny 28913
|
||||
deny 29091
|
||||
deny 29338
|
||||
deny 29340
|
||||
deny 29428
|
||||
deny 29495
|
||||
deny 29544
|
||||
deny 29571
|
||||
deny 29614
|
||||
deny 29674
|
||||
deny 29918
|
||||
deny 29975
|
||||
deny 30073
|
||||
deny 30306
|
||||
deny 30429
|
||||
deny 30619
|
||||
deny 30896
|
||||
deny 30980
|
||||
deny 30982 - 30999
|
||||
deny 31065
|
||||
deny 31245
|
||||
deny 31619
|
||||
deny 31810
|
||||
deny 31856
|
||||
deny 31960
|
||||
deny 32017
|
||||
deny 32279
|
||||
deny 32398
|
||||
deny 32437
|
||||
deny 32653
|
||||
deny 32714
|
||||
deny 32717
|
||||
deny 32842
|
||||
deny 32860
|
||||
deny 33567
|
||||
deny 33579
|
||||
deny 33762 - 33791
|
||||
|
||||
# Private use IPv4 & IPv6 addresses and ASNs
|
||||
deny 0.0.0.0/8 # RFC 1122 Local Identification
|
||||
deny 10.0.0.0/8 # RFC 1918 private space
|
||||
deny 100.64.0.0/10 # RFC 6598 Carrier Grade NAT
|
||||
deny 127.0.0.0/8 # RFC 1122 localhost
|
||||
deny 169.254.0.0/16 # RFC 3927 link local
|
||||
deny 172.16.0.0/12 # RFC 1918 private space
|
||||
deny 192.0.2.0/24 # RFC 5737 TEST-NET-1
|
||||
deny 192.88.99.0/24 # RFC 7526 6to4 anycast relay
|
||||
deny 192.168.0.0/16 # RFC 1918 private space
|
||||
deny 198.18.0.0/15 # RFC 2544 benchmarking
|
||||
deny 198.51.100.0/24 # RFC 5737 TEST-NET-2
|
||||
deny 203.0.113.0/24 # RFC 5737 TEST-NET-3
|
||||
deny 224.0.0.0/4 # Multicast
|
||||
deny 240.0.0.0/4 # Reserved
|
||||
deny 23456 # RFC 4893 AS_TRANS
|
||||
deny 64496 - 64511 # RFC 5398
|
||||
deny 64512 - 65534 # RFC 6996
|
||||
deny 65535 # RFC 7300
|
||||
deny 65536 - 65551 # RFC 5398
|
||||
deny 65552 - 131071 # IANA Reserved
|
||||
deny 4200000000 - 4294967294 # RFC 6996
|
||||
deny 4294967295 # RFC 7300
|
||||
|
||||
# RIPE NCC supports IPv4 and ASN transfers: allow the complement of what is denied
|
||||
allow 0.0.0.0/0
|
||||
allow 1 - 4199999999
|
||||
10
tals/ripe.tal
Normal file
10
tals/ripe.tal
Normal file
@@ -0,0 +1,10 @@
|
||||
https://rpki.ripe.net/ta/ripe-ncc-ta.cer
|
||||
rsync://rpki.ripe.net/ta/ripe-ncc-ta.cer
|
||||
|
||||
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0URYSGqUz2myBsOzeW1j
|
||||
Q6NsxNvlLMyhWknvnl8NiBCs/T/S2XuNKQNZ+wBZxIgPPV2pFBFeQAvoH/WK83Hw
|
||||
A26V2siwm/MY2nKZ+Olw+wlpzlZ1p3Ipj2eNcKrmit8BwBC8xImzuCGaV0jkRB0G
|
||||
Z0hoH6Ml03umLprRsn6v0xOP0+l6Qc1ZHMFVFb385IQ7FQQTcVIxrdeMsoyJq9eM
|
||||
kE6DoclHhF/NlSllXubASQ9KUWqJ0+Ot3QCXr4LXECMfkpkVR2TZT+v5v658bHVs
|
||||
6ZxRD1b6Uk1uQKAyHUbn/tXvP8lrjAibGzVsXDT2L0x4Edx+QdixPgOji3gBMyL2
|
||||
VwIDAQAB
|
||||
@@ -91,3 +91,50 @@ fn config_mode_and_mutually_exclusive_inspection_flags_are_rejected() {
|
||||
assert_eq!(result.status.code(), Some(2));
|
||||
assert!(String::from_utf8_lossy(&result.stderr).contains("mutually exclusive"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn all5_examples_load_vendored_constraints_and_disable_ignores_missing_files() {
|
||||
let directory = tempfile::tempdir().unwrap();
|
||||
let repo = std::path::Path::new(env!("CARGO_MANIFEST_DIR"));
|
||||
for (mode, example) in [
|
||||
("validate", "validate-all5.toml"),
|
||||
("daemon", "daemon-all5.toml"),
|
||||
] {
|
||||
let raw = std::fs::read_to_string(repo.join("docker/examples").join(example))
|
||||
.unwrap()
|
||||
.replace("/input", repo.join("tals").to_str().unwrap())
|
||||
.replace("/output", directory.path().join("out").to_str().unwrap())
|
||||
.replace("/state", directory.path().join("state").to_str().unwrap())
|
||||
.replace("/data", directory.path().join("data").to_str().unwrap());
|
||||
let config = directory.path().join(example);
|
||||
for (enabled, missing, expected) in [(true, false, 0), (true, true, 2), (false, true, 0)] {
|
||||
let mut text = raw.replace(
|
||||
"ta-constraints-enabled = true",
|
||||
&format!("ta-constraints-enabled = {enabled}"),
|
||||
);
|
||||
if missing {
|
||||
text = text.replace(".constraints\"", ".missing\"");
|
||||
}
|
||||
std::fs::write(&config, text).unwrap();
|
||||
for inspect in ["--check-config", "--print-config"] {
|
||||
let result = command()
|
||||
.args([mode, "--config", config.to_str().unwrap(), inspect])
|
||||
.output()
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
result.status.code(),
|
||||
Some(expected),
|
||||
"{}",
|
||||
String::from_utf8_lossy(&result.stderr)
|
||||
);
|
||||
if inspect == "--print-config" && expected == 0 {
|
||||
let printed: serde_json::Value =
|
||||
serde_json::from_slice(&result.stdout).unwrap();
|
||||
assert_eq!(printed["effective"]["ta-constraints-enabled"], enabled);
|
||||
}
|
||||
}
|
||||
}
|
||||
assert!(!directory.path().join("out").exists());
|
||||
assert!(!directory.path().join("data").exists());
|
||||
}
|
||||
}
|
||||
|
||||
@@ -47,6 +47,8 @@ fi
|
||||
run_validator() {
|
||||
local out="$1"
|
||||
local mode="$2"
|
||||
local enabled="${3:-true}"
|
||||
local policy="${4:-}"
|
||||
local config="$work_root/validate-$mode.toml"
|
||||
cat >"$config" <<EOF
|
||||
config-version = 1
|
||||
@@ -54,6 +56,7 @@ mode = "validate"
|
||||
out = "/output"
|
||||
rrdp-state-dir = "/state"
|
||||
rrdp-sync-mode = "$mode"
|
||||
ta-constraints-enabled = $enabled
|
||||
ccr-out = "/output/result.ccr"
|
||||
http-timeout-secs = 5
|
||||
http-root-cert = ["/fixture/certs/rrdp-ca.pem"]
|
||||
@@ -66,6 +69,7 @@ log-format = "json"
|
||||
id = "custom"
|
||||
tal = "/fixture/tal/custom.tal"
|
||||
ta = "/fixture/ta/custom-ta.cer"
|
||||
$policy
|
||||
EOF
|
||||
docker run --rm --network host --user "$(id -u):$(id -g)" \
|
||||
-v "$fixture:/fixture:ro" \
|
||||
@@ -103,6 +107,29 @@ timing = json.loads((delta / "stage-timing.json").read_text(encoding="utf-8"))
|
||||
assert timing["analysis_counts"]["rrdp_delta_ops_applied_total"] > 0, timing
|
||||
PY
|
||||
|
||||
# Policy changes must affect payloads even when RRDP is a noop.
|
||||
printf 'deny 0.0.0.0/0\ndeny ::/0\ndeny 0 - 4294967295\n' >"$fixture/tal/custom.constraints"
|
||||
mkdir -p "$work_root/output-denied" "$work_root/output-custom" "$work_root/output-disabled"
|
||||
run_validator "$work_root/output-denied" delta true
|
||||
printf 'allow 0.0.0.0/0\nallow ::/0\nallow 0 - 4294967295\n' >"$fixture/tal/allow.constraints"
|
||||
run_validator "$work_root/output-custom" delta true 'constraints = "/fixture/tal/allow.constraints"'
|
||||
printf 'malformed policy\n' >"$fixture/tal/custom.constraints"
|
||||
run_validator "$work_root/output-disabled" delta false 'constraints = "/fixture/tal/missing.constraints"'
|
||||
python3 - "$work_root" <<'PYTEST'
|
||||
import json, pathlib, sys
|
||||
root = pathlib.Path(sys.argv[1])
|
||||
for name, expected, enabled in [("denied", 0, True), ("custom", 2, True), ("disabled", 2, False)]:
|
||||
out = root / f"output-{name}"
|
||||
summary = json.loads((out / "summary.json").read_text())
|
||||
assert summary["vrps"] == expected, summary
|
||||
assert summary["taConstraintsEnabled"] == enabled, summary
|
||||
assert len(summary["taConstraintsApplied"]) == int(enabled), summary
|
||||
assert len((out / "vaps.csv").read_text().splitlines()) - 1 == (0 if name == "denied" else 1)
|
||||
assert (out / "result-complete.json").exists()
|
||||
print("Constraints deny/custom/disabled payload checks passed with reused RRDP state")
|
||||
PYTEST
|
||||
rm "$fixture/tal/custom.constraints"
|
||||
|
||||
echo "Synthetic Docker snapshot+delta E2E passed"
|
||||
|
||||
# Exercise the actual public daemon in the image with a fresh protocol root.
|
||||
|
||||
Reference in New Issue
Block a user