RPKI not working with protocol pipe

Dewangga Alam dewanggaba at xtremenitro.org
Tue Sep 28 02:01:23 CEST 2021


Hello!

I just migrating configuration using port pipe recently, but I just
realized the RPKI/ROA validation isn’t working.

Debian 10
Bird 2.0.8

… snip …

ipv4 table master4;
ipv6 table master6;

ipv4 table igptable4;
ipv6 table igptable6;

roa4 table t_roa4;
roa6 table t_roa6;

protocol rpki rpki1 {
  roa4 { table t_roa4; };
  roa6 { table t_roa6; };

  remote “ip.ad.dr.es" port 8282;

  retry keep 30;
  refresh keep 30;
  expire keep 3600;
}

function is_v4_rpki_invalid() {
  return roa_check(t_roa4, net, bgp_path.last_nonaggregated) = ROA_INVALID;
}

function is_v6_rpki_invalid() {
  return roa_check(t_roa6, net, bgp_path.last_nonaggregated) = ROA_INVALID;
}

protocol pipe pipe1 {			# sync routing table igp to master
        table master4;
        peer table igptable4;
        export all;
        import all;
}

… snip …

Starting using the filter to call is_v4_rpki_invalid(), isn’t working.
But if the setup without proto pipe, the filter and table t_roa4 and
t_roa6 are able validate the prefix.

The configuration for rpki is working.

# show proto rpki1
Name       Proto      Table      State  Since         Info
rpki1      RPKI       ---        up     2021-09-11    Established

Is it possible to pipe Roa with pipe protocol and put the RPKI in place?
Any feedback are welcome and appreciated.

Many thanks.



More information about the Bird-users mailing list