Re: [Sidrops] Reason for Outage report (was: Re: ARIN RPKI Service Impact - 12 August 2020 - manifest issue - resolved)

[Tim Bruijnzeels <[e-mail]>]

Hi,

> On 27 Aug 2020, at 19:49, Randy Bush <[e-mail]> wrote:
> 
>> If the ROAs for the more specifics are gone, then the less specific
>> ROA for the larger prefix will invalidate announcements for the more
>> specific prefixes.
> 
> yep; simply stated.  and perhaps the more likely common case.
> 
> a less common case could be if i am doing a provider switch where my
> upstreams do my announcements.  for "make before break" i would have
> roas for both providers.  if the roa for the one which is currently
> announcing is dropped, kaboom.
> 
> similarly a transfer of ip space from one AS to another.

Indeed, I believe that, if the publication point for a Certification Authority in the RPKI is rejected for whatever reason, then all VRPS for prefixes overlapping the resources issued to them in their CA certificate for said publication point should be filtered out.

Note that most RP software already implements SLURM - and this kind of post-validation filtering can be done in a very similar way.

It is important to only do this for VALID CA certificates with invalid publication points. This is what I said above, but I just want to be overly clear here.. because if one would start doing this for invalid over-claiming CA certificates then this would of course open a wide vector for people to DoS legitimate statements about other people's address space.

Tim