Invalid ROA

[Cybertinus]

Hello Ondrej,

Thanks for pointing this out. In the network I maintain, we were using 
bgp_path.last_nonaggregated. This resulted in 200 IPv4 and 1100 IPv6 
prefixed to be marked as RPKI invalid while they were in fact valid. So, 
like the worst thing that could happen. But this only happened on a few 
EBGP sessions. On other sessions on the same router, with the same 
settings (apart from obvious things, like remote ASN) they were valid. 
Very strange behavior. All this is done with Bird 1.6.6, installed from 
the Debian 10 repos.
I've changed the config to bgp_path.last and all is fine now.

Kind regards,
Cybertinus

On 2020-04-20 04:45, Ondrej Zajicek wrote:
> On Sun, Apr 19, 2020 at 07:18:37PM +0200, Job Snijders wrote:
>> Hi,
>> 
>> On Sun, Apr 19, 2020, at 19:09, Fabiano D'Agostino wrote:
>> > how can I check which prefixes are not valid and so rejected? It seems
>> > the rpki is working, but I'd like to be sure. I have this:
>> > if (roa_check(r4, net, bgp_path.last) = ROA_INVALID) then
>> > {
>> > print "Ignore RPKI invalid ", net, " for ASN ", bgp_path.last;
>> >
>> > but I don't understand where the prints go.
>> 
>> They go to syslog.
>> 
>> Make sure to match in this: bgp_path.last_nonaggregated
> 
> Hi
> 
> No. If you want proper RPKI match consistent with RFC 6907 7.1.9-11,
> you should use bgp_path.last, not bgp_path.last_nonaggregated.