RPKI doesn’t work with a FQDN

11 Jan 2020

      Hi,

I have this configuration:
asbr02 ~ # cat /etc/bird.conf.d/protocol_rpki/*
protocol rpki rpki_alarig {
        roa4 { table r4; };
        roa6 { table r6; };

        #remote "msi.no.swordarmor.fr";
        remote 2a0e:f42::1;
}
protocol rpki rpki_conan {
        roa4 { table r4; };
        roa6 { table r6; };

        remote "conan.grifon.fr";
}

The first protocol establish with the second fails

bird> show protocols all rpki_alarig
Name       Proto      Table      State  Since         Info
rpki_alarig RPKI       ---        up     15:54:25.902  Established
  Cache server:     2a0e:f42::1:323
  Status:           Established
  Transport:        Unprotected over TCP
  Protocol version: 1
  Session ID:       28569
  Serial number:    285
  Last update:      before 84.055 s
  Refresh timer   : 323.944/408
  Retry timer     : ---
  Expire timer    : 7115.944/7200
  Channel roa4
    State:          UP
    Table:          r4
    Preference:     100
    Input filter:   ACCEPT
    Output filter:  REJECT
    Routes:         100516 imported, 0 exported, 100516 preferred
    Route change stats:     received   rejected   filtered    ignored   accepted
      Import updates:         100816          0          0          0     100816
      Import withdraws:          300          0        ---          0        300
      Export updates:              0          0          0        ---          0
      Export withdraws:            0        ---        ---        ---          0
  Channel roa6
    State:          UP
    Table:          r6
    Preference:     100
    Input filter:   ACCEPT
    Output filter:  REJECT
    Routes:         16578 imported, 0 exported, 16578 preferred
    Route change stats:     received   rejected   filtered    ignored   accepted
      Import updates:          16641          0          0          0      16641
      Import withdraws:           63          0        ---          0         63
      Export updates:              0          0          0        ---          0
      Export withdraws:            0        ---        ---        ---          0

bird> show protocols all rpki_conan
Name       Proto      Table      State  Since         Info
rpki_conan RPKI       ---        start  15:54:25.847  Transport-Error
  Cache server:     conan.grifon.fr:323
  Status:           Transport-Error
  Transport:        Unprotected over TCP
  Protocol version: 1
  Session ID:       ---
  Serial number:    ---
  Last update:      ---
  Refresh timer   : ---
  Retry timer     : 451.669/600
  Expire timer    : ---
  Channel roa4
    State:          DOWN
    Table:          r4
    Preference:     100
    Input filter:   ACCEPT
    Output filter:  REJECT
  Channel roa6
    State:          DOWN
    Table:          r6
    Preference:     100
    Input filter:   ACCEPT
    Output filter:  REJECT

I see the DNS request (and the answer):
15:54:25.851095 IP6 asbr02.cogent-rns.grifon.fr.35411 > drogon.grifon.fr.domain: 167+ A? conan.grifon.fr. (33)
15:54:25.851105 IP6 asbr02.cogent-rns.grifon.fr.35411 > drogon.grifon.fr.domain: 14516+ AAAA? conan.grifon.fr. (33)
15:54:25.851495 IP6 drogon.grifon.fr.domain > asbr02.cogent-rns.grifon.fr.35411: 167 1/0/0 A 89.234.186.8 (49)
15:54:25.851515 IP6 drogon.grifon.fr.domain > asbr02.cogent-rns.grifon.fr.35411: 14516 1/0/0 AAAA 2a00:5884::8 (61)

But no SYN over 323.
However, I can telnet to it:
asbr02 ~ # mtr -bzwe msi.no.swordarmor.fr
Start: Sat Jan 11 15:55:59 2020
HOST: asbr02.cogent-rns.grifon.fr                                       Loss%   Snt   Last   Avg  Best  Wrst StDev
  1. AS204092 regis.swordarmor.fr (2a00:5884::1f)                        0.0%    10    0.2   0.2   0.1   0.3   0.0
  2. AS208627 tinc0.core02-arendal.no.swordarmor.fr (2a0e:f42:fffe::6)   0.0%    10   51.5  51.7  51.2  52.2   0.0
  3. AS208627 msi.no.swordarmor.fr (2a0e:f42::1)                         0.0%    10   52.0  52.3  51.4  52.8   0.0
asbr02 ~ # mtr -bzwe conan.grifon.fr
Start: Sat Jan 11 15:57:47 2020
HOST: asbr02.cogent-rns.grifon.fr             Loss%   Snt   Last   Avg  Best  Wrst StDev
  1. AS204092 conan.grifon.fr (2a00:5884::8)   0.0%    10    0.3   0.3   0.2   0.5   0.0
asbr02 ~ # telnet msi.no.swordarmor.fr 323
Trying 2a0e:f42::1...
Connected to msi.no.swordarmor.fr.
Escape character is '^]'.
^]
telnet> quit
Connection closed.
asbr02 ~ # telnet conan.grifon.fr 323
Trying 2a00:5884::8...
Connected to conan.grifon.fr.
Escape character is '^]'.
^]
telnet> quit
Connection closed.

And then I see the SYN:
16:01:28.787297 IP6 asbr02.cogent-rns.grifon.fr.60330 > conan.grifon.fr.323: Flags [S], seq 1340260165, win 28800, options [mss 1440,sackOK,TS val 4034128416 ecr 0,nop,wscale 7], le
ngth 0
16:01:28.787677 IP6 conan.grifon.fr.323 > asbr02.cogent-rns.grifon.fr.60330: Flags [S.], seq 287295091, ack 1340260166, win 64260, options [mss 1440,sackOK,TS val 4292064010 ecr 403
4128416,nop,wscale 7], length 0
16:01:28.787713 IP6 asbr02.cogent-rns.grifon.fr.60330 > conan.grifon.fr.323: Flags [.], ack 1, win 225, options [nop,nop,TS val 4034128416 ecr 4292064010], length 0
16:01:31.114241 IP6 asbr02.cogent-rns.grifon.fr.60330 > conan.grifon.fr.323: Flags [F.], seq 1, ack 1, win 225, options [nop,nop,TS val 4034130743 ecr 4292064010], length 0
16:01:31.114709 IP6 conan.grifon.fr.323 > asbr02.cogent-rns.grifon.fr.60330: Flags [F.], seq 1, ack 2, win 503, options [nop,nop,TS val 4292066337 ecr 4034130743], length 0
16:01:31.114725 IP6 asbr02.cogent-rns.grifon.fr.60330 > conan.grifon.fr.323: Flags [.], ack 2, win 225, options [nop,nop,TS val 4034130743 ecr 4292066337], length 0

The first protocol only established when I put the IP address directly.

Plus, not having the brackets over the literal IPv6 address is a bit
confusing. The IP isn’t 2a0e:f42::1:323.

Regards,
-- 
Alarig

RPKI doesn’t work with a FQDN

Alarig Le Lay