<div dir="ltr">Hi Maria.<div><br></div><div>Maybe I'm misunderstanding the RPKI instances. My local bird2 instance is connected to two routinator cache servers. Both are sending IPv4 and IPv6 information over. This is the outputs of both on this particular bird2 instance:</div><div><br></div><div><font face="monospace">bird> show protocols all routinator1<br>Name Proto Table State Since Info<br>routinator1 RPKI --- up 2019-10-22 Established<br> Cache server: <a href="http://10.0.0.1:3323">10.0.0.1:3323</a><br> Status: Established<br> Transport: Unprotected over TCP<br> Protocol version: 1<br> Session ID: 766<br> Serial number: 73<br> Last update: before 0.309 s<br> Refresh timer : 899.690/900<br> Retry timer : ---<br> Expire timer : 172799.690/172800<br> Channel roa4<br> State: UP<br> Table: roa_v4<br> Preference: 100<br> Input filter: ACCEPT<br> Output filter: REJECT<br> Routes: 96534 imported, 0 exported, 50987 preferred<br> Route change stats: received rejected filtered ignored accepted<br> Import updates: 96696 0 0 0 96696<br> Import withdraws: 162 0 --- 0 162<br> Export updates: 0 0 0 --- 0<br> Export withdraws: 0 --- --- --- 0<br> Channel roa6<br> State: UP<br> Table: roa_v6<br> Preference: 100<br> Input filter: ACCEPT<br> Output filter: REJECT<br> Routes: 16307 imported, 0 exported, 8638 preferred<br> Route change stats: received rejected filtered ignored accepted<br> Import updates: 16311 0 0 0 16311<br> Import withdraws: 4 0 --- 0 4<br> Export updates: 0 0 0 --- 0<br> Export withdraws: 0 --- --- --- 0<br></font></div><div><font face="monospace"><br></font></div><div><font face="monospace">bird> show protocols all routinator2<br>Name Proto Table State Since Info<br>routinator2 RPKI --- up 2019-10-22 Established<br> Cache server: <a href="http://10.0.0.2:3323">10.0.0.2:3323</a><br> Status: Established<br> Transport: Unprotected over TCP<br> Protocol version: 1<br> Session ID: 632<br> Serial number: 71<br> Last update: before 162.554 s<br> Refresh timer : 737.445/900<br> Retry timer : ---<br> Expire timer : 172637.445/172800<br> Channel roa4<br> State: UP<br> Table: roa_v4<br> Preference: 100<br> Input filter: ACCEPT<br> Output filter: REJECT<br> Routes: 96086 imported, 0 exported, 45547 preferred<br> Route change stats: received rejected filtered ignored accepted<br> Import updates: 96232 0 0 0 96232<br> Import withdraws: 146 0 --- 0 146<br> Export updates: 0 0 0 --- 0<br> Export withdraws: 0 --- --- --- 0<br> Channel roa6<br> State: UP<br> Table: roa_v6<br> Preference: 100<br> Input filter: ACCEPT<br> Output filter: REJECT<br> Routes: 16271 imported, 0 exported, 7669 preferred<br> Route change stats: received rejected filtered ignored accepted<br> Import updates: 16275 0 0 0 16275<br> Import withdraws: 4 0 --- 0 4<br> Export updates: 0 0 0 --- 0<br> Export withdraws: 0 --- --- --- 0</font><br></div><div><br></div><div> So here I see both instances with both address families, and the local bird instance is using both of them. </div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, 22 Oct 2019 at 08:36, Maria Matějka <<a href="mailto:jan.matejka@nic.cz">jan.matejka@nic.cz</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hello! <br>
<br>
On October 22, 2019 5:51:56 AM GMT+02:00, Darren O'Connor <<a href="mailto:mellow.drifter@gmail.com" target="_blank">mellow.drifter@gmail.com</a>> wrote:<br>
>I was reading the documentation for bird2 when I came across this:<br>
>You can validate routes (RFC 6483) using function roa_check() in filter<br>
>and<br>
>set it as import filter at the BGP protocol. BIRD should re-validate<br>
>all of<br>
>affected routes after RPKI update by RFC 6811, but we don't support it<br>
>yet!<br>
>You can use a BIRD's client command reload in bgp_protocol_name for<br>
>manual<br>
>call of revalidation of all routes.<br>
><br>
>Is there a rough timeline for when bird2 will correct re-validate<br>
>affected<br>
>routes? As I run multiple table, is the best thing to simply run a<br>
>cronjob<br>
>telling bird 'reload in all' a few times a day until that support is<br>
>added?<br>
<br>
There is no exact time line as we found out that we want first to do substantial changes in internal API between protocols and tables w.r.t. multithreading and parallel execution plans.<br>
<br>
Anyway, the parallel execution thing is currently under development and we suppose we'll get to automatic re-evaluation in several months. (To be honest, I said the same thing last year so don't trust me.)<br>
<br>
One workaround you can do is to enable debug on the rpki protocol instance and reload the affected channels on roa change detected by reading the log file. This is somehow dirty, yet developing a consistent automatic route reload also eats some time, sorry for the inconvenience. <br>
<br>
>The second item is this:<br>
>We currently support just one cache server per protocol. However you<br>
>can<br>
>define more RPKI protocols generally.<br>
><br>
>This doesn't seem true though, as I have two cache servers configured<br>
>for<br>
>both ipv4 and ipv6 and it seems to be fine?<br>
<br>
Do you mean two cache servers for one RPKI protocol instance? I'm not now looking into the code, I may be wrong, I'd only suppose that the latter server is used exclusively. <br>
<br>
Maria<br>
-- <br>
Sent from my Android device with K-9 Mail. Please excuse my brevity.<br>
</blockquote></div>