Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

path selection in bgp is not updated accordingly to rpki updates #16474

Open
2 tasks done
TrefoIV opened this issue Jul 25, 2024 · 16 comments · May be fixed by #16483
Open
2 tasks done

path selection in bgp is not updated accordingly to rpki updates #16474

TrefoIV opened this issue Jul 25, 2024 · 16 comments · May be fixed by #16483
Assignees
@ton31337
Labels
bgp

Comments

@TrefoIV
Copy link

TrefoIV commented Jul 25, 2024

Description

Hello,

I want that updates by the RPKI cache servers are applied to the adj-rib-in stored data and that stored announcements which become valid from an invalid state are considered in the best path selection process and inserted into the RIB.

In the documentation, I found the line: "Updates from the RPKI cache servers are directly applied and path selection is updated accordingly. (Soft reconfiguration must be enabled for this to work)" in the section "Feature of the Current Implementation".
However, when a new certificate makes an announcement valid (from invalid state) the adj-rib-in is correctly processed but the route is not installed in the RIB unless the peering is manually cleared with "clear bgp neighbor x.x.x.x soft in".

Am I missing something? Or have I incorrectly interpreted the meaning of the above sentence?

Version

10.0.1

How to reproduce

  • Using two routers setup a peering between two differen ASes.
  • Setup a certification authority (I used krill to setup it)
  • router1 announces a route, call it x.x.x.x/y with AS number A
  • router2 implements rpki filters: valid routes are filtered in with high local-pref, notfound routes are filtered in with low local-pref and invalid routes are denyed. (The example route-map in the documentation would work as well).
  • there are two certificates for the route announced: "x.x.x.x/y => A" and "x.x.x.x/y => B"
  • verify that the route is correctly installed in router2's RIB and stored in the adj-rib-in

The configuration of router2 is the following. The rpki cache is located on the router itself, which runs "routinator".

!
!  BGP CONFIGURATION
!
debug bgp keepalives
debug bgp updates in
debug bgp updates out
dump bgp all-et /shared/dumps/dump-r2
!
router bgp C
    no bgp ebgp-requires-policy
    neighbor a.a.a.a remote-as A
    neighbor a.a.a.a  route-map rpki in
    neighbor a.a.a.a  soft-reconfiguration inbound
!
!
! RPKI
!
rpki
rpki polling_period 10
rpki cache 127.0.0.1 3323 pref 1
!
route-map rpki permit 4
match rpki valid
set local-preference 150
!
route-map rpki permit 6
match rpki notfound
set local-preference 10
!
route-map rpki deny 8
match rpki invalid
!
route-map rpki permit 40

  • remove the certificate "x.x.x.x/y => A". The route announced by router1 is now invalid

  • verify that router2 removed the route from the RIB, and that in the adj-rib-in from router1 the value of the local pref is now absent

  • restore the certificate "x.x.x.x/y => A". The route is now valid again.

  • verify that for router2, the route stored in the adj-rib-in from router1 has been processed again (the local pref is now set to the value associated to valid routes)

  • verify that the route IS NOT present in the router2's RIB.

The following zip folder three-line-peering.zip contains a [Kathará] lab that can be used to replicate the issue in an emulated environment on docker containers. The docker images used by "router2" (kathara/routinator) and "krill" (kathara/krill) machines can be build from dockerfile.zip. Other images are available on docker hub.

Expected behavior

  • When the route from router1 becomes valid again, router2 should select it again as best path and insert it into the RIB

Actual behavior

  • The route stored in the adj-rib-in is correctly processed by the rpki route-map but not selected

Additional context

No response

Checklist

  • I have searched the open issues for this bug.
  • I have not included sensitive information in this report.
@TrefoIV TrefoIV added the triage Needs further investigation label Jul 25, 2024
@ton31337 ton31337 added the bgp label Jul 26, 2024
@ton31337 ton31337 self-assigned this Jul 26, 2024
@ton31337
Copy link
Member

Would you be able to test this patch #16483?

@ton31337 ton31337 removed the triage Needs further investigation label Jul 28, 2024
@TrefoIV
Copy link
Author

TrefoIV commented Jul 30, 2024 via email

@ton31337
Copy link
Member

You can get the rpm/deb from here https://ci1.netdef.org/browse/FRR-PULLREQ3-4323/artifact.

@TrefoIV
Copy link
Author

TrefoIV commented Jul 30, 2024 via email

@ton31337
Copy link
Member

Take librtr from here: https://ci1.netdef.org/artifact/RPKI-RTRLIB/shared/build-149.

@TrefoIV
Copy link
Author

TrefoIV commented Jul 30, 2024 via email

@ton31337
Copy link
Member

You don't need to compile. Just download librtr, install it, and then download the deb from https://ci1.netdef.org/browse/FRR-PULLREQ3-4323/artifact.

@riw777 riw777 linked a pull request Jul 30, 2024 that will close this issue
Open
@TrefoIV
Copy link
Author

TrefoIV commented Jul 30, 2024 via email

@ton31337
Copy link
Member

You don't need to compile anything. Just install those two debs :)

@TrefoIV
Copy link
Author

TrefoIV commented Jul 30, 2024 via email

@TrefoIV
Copy link
Author

TrefoIV commented Jul 30, 2024 via email

@TrefoIV
Copy link
Author

TrefoIV commented Jul 30, 2024 via email

@ton31337
Copy link
Member

Also, adjust the timer for revalidation to see the adj-rib-in faster, e.g.:

rpki
 rpki revalidate_interval 5

@TrefoIV
Copy link
Author

TrefoIV commented Jul 30, 2024 via email

@TrefoIV
Copy link
Author

TrefoIV commented Sep 9, 2024 via email

@ton31337
Copy link
Member

ton31337 commented Sep 9, 2024

The PR #16483 is still open.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@ton31337 ton31337

Labels
bgp
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

bgpd: Revalidate locally originated routes also when RPKI state changes opensourcerouting/frr
2 participants
@ton31337 @TrefoIV