Radar - RPKI ASPA path validation on Cloudflare Radar

<p><a href="https://developers.cloudflare.com/radar/"><strong>Radar</strong></a> adds an <a href="https://radar.cloudflare.com/routing/aspa-validation" target="_blank" rel="noopener">ASPA validation tool<span class="external-link"> ↗︎</span></a> to its <a href="https://radar.cloudflare.com/routing" target="_blank" rel="noopener">Routing section<span class="external-link"> ↗︎</span></a>. Enter a BGP <code>AS_PATH</code> and the tool checks it against the <a href="https://blog.cloudflare.com/aspa-secure-internet/" target="_blank" rel="noopener">Autonomous System Provider Authorization (ASPA)<span class="external-link"> ↗︎</span></a> records currently published in the RPKI, returning a verdict of <code>Valid</code>, <code>Invalid</code>, or <code>Unknown</code>. An <code>Invalid</code> verdict means no chain of provider authorizations covers the whole path, which is the signature of a route leak.</p> <p>Validation follows <a href="https://datatracker.ietf.org/doc/draft-ietf-sidrops-aspa-verification/" target="_blank" rel="noopener">draft-ietf-sidrops-aspa-verification<span class="external-link"> ↗︎</span></a>, so verdicts match those produced by validators implementing the same draft. The draft is still a work in progress and not yet an RFC.</p> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="enter-a-path">Enter a path</h4><a class="anchor-link" href="#enter-a-path"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <p>Paths are read in BGP wire order: the rightmost AS is the origin, and the leftmost AS is the one closest to the collector or router that observed the route. AS numbers can be separated by spaces, commas, or hyphens, with or without an <code>AS</code> prefix. The full ASPA snapshot is loaded into the browser once, so the verdict, graph, and trace update as the path is edited, with no further requests. A set of example paths covers the interesting cases, including a route leak with an AS0 ASPA, where an AS declares that it has no providers at all.</p> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="choose-an-algorithm">Choose an algorithm</h4><a class="anchor-link" href="#choose-an-algorithm"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <p>The draft defines two verification algorithms that differ only in whether a down-ramp is permitted:</p> <ul> <li><strong>Upstream</strong> (<a href="https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-aspa-verification#section-5.4" target="_blank" rel="noopener">section 5.4<span class="external-link"> ↗︎</span></a>) — for routes received from a customer, peer, route server client, or route server. Only an up-ramp is permitted.</li> <li><strong>Downstream</strong> (<a href="https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-aspa-verification#section-5.5" target="_blank" rel="noopener">section 5.5<span class="external-link"> ↗︎</span></a>) — for routes received from a provider. Both an up-ramp and a down-ramp are permitted.</li> </ul> <p>An <strong>up-ramp</strong> is the run of consecutive customer-to-provider hops from the origin to the apex of the path, and a <strong>down-ramp</strong> is the equivalent run from the announcing neighbor back to that apex. The tool evaluates both algorithms at once and labels each with its verdict, so a path that is legitimate when received from one session type and a leak when received from another is visible without switching modes. Selecting an algorithm drives the graph and the trace.</p> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="read-the-result">Read the result</h4><a class="anchor-link" href="#read-the-result"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <p>The <strong>ASPA validation graph</strong> draws the path hop by hop, labeling each AS with its role, whether it publishes an ASPA, and how many providers that ASPA authorizes. Every hop is marked <code>Provider+</code>, <code>Not Provider+</code>, or <code>No attestation</code>, and the maximum and minimum bounds of each ramp are drawn against the length of the path. Hops that no ramp reaches are highlighted, because a path the ramps cannot cover end to end is <code>Invalid</code>. The accompanying <strong>ASPA records</strong> table lists every AS in the path with its ASPA status and its authorized providers, each linked to its Radar AS page.</p> <img src="https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1600,height=1222,format=webp/_astro/aspa-validation-graph.DQUq8KCm.png" alt="ASPA validation graph for the path 1003 6939 1299 553, showing a Valid verdict under the downstream algorithm, the Provider+, Not Provider+, and No attestation outcome on each hop, and the up-ramp and down-ramp bounds that together cover the path" loading="lazy" decoding="async" width="1600" height="1222"> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="follow-the-algorithm">Follow the algorithm</h4><a class="anchor-link" href="#follow-the-algorithm"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <p>The <strong>Algorithm step by step</strong> section shows the derivation rather than just the answer. Two columns run the same scans under different stopping rules: the upper bounds, which test for <code>Invalid</code> and stop only on <code>Not Provider+</code>, and the lower bounds, which test for <code>Unknown</code> and also stop on <code>No Attestation</code>. A hop is <code>Not Provider+</code> when the AS publishes an ASPA that does not list the next AS as a provider, and <code>No Attestation</code> when the AS publishes no ASPA at all. Each column lists the outcome for every hop scanned, marks where the scan stopped, gives the resulting ramp length, and then evaluates the verdict rule with the numbers filled in.</p> <img src="https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1392,height=586,format=webp/_astro/aspa-validation-algorithm-trace.Bb8SM4wT.png" alt="Step-by-step trace for the same path, with the upper-bound and lower-bound columns each listing the up-ramp and down-ramp scans, the ramp lengths they produce, and the verdict rule that neither Invalid nor Unknown satisfies, leaving a Valid verdict" loading="lazy" decoding="async" width="1392" height="586"> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="share-a-validation">Share a validation</h4><a class="anchor-link" href="#share-a-validation"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <p>The path and the selected algorithm are kept in the URL, so a link reproduces a result exactly — for example, this <a href="https://radar.cloudflare.com/routing/aspa-validation?path=22652-1299-9498-149765-14789" target="_blank" rel="noopener">route leak with an AS0 ASPA<span class="external-link"> ↗︎</span></a>. Appending <code>&amp;mode=upstream</code> pins the link to the upstream algorithm. The graph is a standard Radar widget, so it can also be embedded or shared as an image.</p> <p>The records behind the tool are the same ones served by the <a href="https://developers.cloudflare.com/api/resources/radar/subresources/bgp/subresources/rpki/subresources/aspa/methods/snapshot/"><code>/bgp/rpki/aspa/snapshot</code></a> endpoint of the <a href="https://developers.cloudflare.com/api/resources/radar/subresources/bgp/subresources/rpki/subresources/aspa/"><code>ASPA</code></a> API, and the number of records loaded and the snapshot timestamp are shown alongside the input.</p> <p>Try the <a href="https://radar.cloudflare.com/routing/aspa-validation" target="_blank" rel="noopener">ASPA validation tool<span class="external-link"> ↗︎</span></a> with a path of your own.</p>