fort 1.5.4 production impact with Amazon ROAs: The 'subject' name has an unknown attribute. (NID: 18)

[lukastribus]

Hello,

I'm currently seeing production impact with Amazon ROAs in Fort 1.5.4:

• Amazon has multiple ROAs for the same prefix but with different origin AS --> this causes production impact when one of the ROAs fails to validate (because the prefix becomes INVALID as opposed to UNKNOWN)

For example here we are missing the VRP for AS16509 :

root@rpki-test:~# grep '99\.86\.0\.0' /var/lib/fort/all-roas.csv
AS8987,99.86.0.0/16,24
AS14618,99.86.0.0/16,24
root@rpki-test:~#

Because there is no VRP with origin AS16509 (which is currently used for a lot of important stuff, networks will see this prefix as INVALID and drop it, causing production impact to Amazon prefixes.

• This is probably caused by the numerous failures Fort sees with the ROAs on the Amazon PP:

Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/ed432fea-e545-4d6d-beae-21ab78adea7b.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/ed8937b3-68ff-4f10-a9ad-ae1b58a444db.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/ed9ea5ca-e728-4639-afa6-20b57823ca6e.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/edb45c4e-a0b6-471b-a016-e9b2a212afe3.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/edb8e22d-8fd9-4355-82ae-616a726299c4.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/edd8edc1-825f-4c87-9038-1836604bc490.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/ede737e7-07b8-4704-a4be-c92b050a8065.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/ee2fdf06-81e8-4e0a-8595-822d19ded480.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/ee626b04-ab9a-43ab-b5ca-5a0f338f1007.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/eefecc86-9a13-4739-98c4-e5b08bb89dac.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/ef7411dd-5096-4786-98d0-4438424a95cd.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/efb54f3e-2c1a-4dbb-876a-f86620b04208.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/efc992f9-00af-49f7-9474-d7a5b0a4a931.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/efda7646-c506-4e56-917a-b2b5864226db.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f016afaa-75f3-4156-b627-c3d5103adf92.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f08dd47b-add6-4614-855b-8bf2bf29919a.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f08de5e4-c8c2-4b82-8bc4-63108694d6b2.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f09b41b9-1746-42a6-a74b-8ab258b99e97.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f11c572d-2d7b-44ce-8aba-9d15cd5e3082.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f1a1447c-63be-441c-867b-64a338ff41ca.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f2522f75-0635-4530-a445-619eab7c98fc.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f27b8e34-cd21-4d24-8eaa-49a01e2fa77c.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f29adbc5-b5cd-46c1-8740-37db8845b968.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f2a754c4-0b3d-441b-81c9-2750f00e6d7e.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f2ad3121-7e1e-4e90-b0a2-3352c5db99e1.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f2dc01e0-46f0-442f-9781-7cfe4eef20c1.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f2f2a1b5-7277-45b1-a673-5d7786ef1a9f.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f324e7ee-d7f9-4f11-8a0d-e4bf6c04b89b.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f36037d7-b8da-4cd1-ae36-aec9cebaece3.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f436c19b-de87-4b48-9f8a-0ef0e3aacd19.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f44932be-f5f7-4c01-bf66-7863d3be3948.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f4564d2f-04ba-44fc-9fa4-fa2b81601b69.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f4aaf30f-12de-4067-8c3b-1211ddf4a4c6.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f4e2a13f-7777-41ad-9df2-db48ea0d6fab.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f4e43f91-1caf-4ca4-ab49-bdb39392f879.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f4e9e7a4-393b-42d6-803d-19287d423648.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f51894b0-dbd6-4f96-a454-29198b9733d7.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f542397a-2664-4186-9a24-a87ab5343f33.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f56c4be3-99ab-4a96-9991-7ca42e876348.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f5f0c1cf-2889-4c7c-96c7-06ec497306e4.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f70155f2-8fe7-44ff-80c6-4afbb7ac50d8.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f7356e20-34b3-4ead-a435-c95c6ca47073.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f7f6cfe2-da5d-4339-b2ac-376776a0d64c.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f80d56bb-0a1b-4165-8232-5fbfdfebfb12.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f83d3e7e-fe46-457f-9157-bc461580b1bb.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f8587f66-a9c6-4256-b171-7bf2bdb7915f.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f85e01b8-c490-4a13-a34f-3fca5f7dd45f.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f87a9582-6af0-4f07-9f6d-a560db59783c.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f8d3fa5b-5772-4960-9360-47fe8bba7e3e.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f91999a5-5bfa-4baa-94df-c344a43f2398.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f94f74ca-6ca5-4e75-82b7-9f76704ec476.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f962418c-9cd6-4d29-bc13-088cd1d70e66.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f988af58-3f98-44dc-8761-52f7a5896132.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/f9f6b130-b872-44a5-81fd-7378d400647c.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fa628970-b51f-4235-8866-b34eb9ef3808.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fa7ca3cb-7a9b-46bf-85d7-befa60cde930.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fa8716a0-10f9-4da0-9b35-3e6053d2448d.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fa8b41ca-33f6-47fc-bd57-8878fb26021c.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fa8d7ca2-3d43-49d9-8d0e-fbbc57f6c979.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fabe41e0-da56-423e-bc4e-5300b28e5d64.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fae3eabc-4cd1-446b-b61d-51ce31c26fb8.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fb06a2ce-83e0-475f-ae5d-b325b2ee99fe.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fb0e2934-f44c-47a1-89ff-f989460d93bf.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fb49774f-902f-4ee3-908c-01333b37acc3.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fb93ff40-e5a4-4ee8-8469-335582128ff1.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fbd49bcd-224f-4a8b-93d2-80dc17cdd84c.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fc10483c-70c3-4bce-8108-55e2ec35820d.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fc14eed1-8236-4842-9526-26b0265b42a1.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fcb18923-2d39-4a89-83ae-b48736a572e4.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fcddbf1e-022e-430f-aca7-a70f4ae3a8d2.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fd994899-e94f-4f77-902d-57047ef303ce.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fdc0bec5-5566-4d7c-90f3-fecba50a5a5f.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fde9c1c3-421c-4a06-bf2e-7aaf12c44ee5.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fe22b9e2-c52d-411d-b618-c609be37456e.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fe22efef-165a-4c56-b6e4-5fada83003b5.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fe3b2250-6416-4bd0-8836-136078e6dbdb.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fe5bf133-3d81-4137-ac73-2c66456c6024.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fe6d92fb-df44-41d5-9f4e-795e4dd03395.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fec1144c-66c6-4fc1-990d-28699f0e8700.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/fecd908d-7d5c-4011-bbf5-716d32188043.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/feef2431-67fe-49cd-bf34-5014adc5df6f.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/ff131040-e0e9-409f-a8db-131840b52809.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/ff5c3423-096e-4dd0-a666-00ff7fc00fa6.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/ffb5c531-407d-444e-95b8-a49b80cd6e6c.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/ffd7718a-d687-49fb-bdcc-c33449661d32.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:05 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/ffe12830-146b-4ace-aa76-00c674bbaa36.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:06 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/a841823c-a10d-477c-bfdf-4086f0b1594c/GCPJMZh-nJw38EAgqrq_m03_m2Q.mft: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:15 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/42582c67-dd3f-4bc5-ba60-e97e552c6e35/_YzK5b5juSvdyQt6W3TmlEnB6wQ.mft: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:29 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/065b233b-96e8-4d1b-95a7-c81f87b4ba9f.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:29 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/1ad26571-c674-4a73-b205-77cb32fe83bd.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:29 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/256c0a13-9cbc-490b-8be7-23b43e85292c.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:29 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/348f5e60-8c02-48e8-8bab-280a4365a7cb.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:29 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/39b45593-f3f3-4a2e-aa3a-895815db366a.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:29 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/5443f26e-949a-460a-b187-e26290bfcf24.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:29 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/595ebfb9-e548-4d3e-9fa8-016973527359.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:29 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/63586974-b35a-4b49-953d-2bcf6d3fd94e.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:29 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/6632e911-ee11-4bc9-a573-00ef83fd31d7.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:29 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/73712e14-51d5-41db-bcf2-73aa504e6eab.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:29 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/789a1aef-77f7-4108-9d41-1a97c18e12cb.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:29 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/a0024e00-f937-4b63-91df-d45ce0a6a27d.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:29 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/b4163a38-a8e2-48d9-855f-dd53ae7f6dcf.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:29 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/c5e869f4-a046-4227-a965-632f217c044e.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:42 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/2f059a21-d41b-4846-b7ae-7ea38c32fd4c/HwZxfSr2LjgJByCEw6-PSJSOQOI.mft: The 'subject' name has an unknown attribute. (NID: 18)
Jul  8 18:14:43 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/71e5236f-c6f1-4928-a1b9-8def09c06085/gRVsLhSv751hliJ-LGA1oJ7w0lc.mft: The 'subject' name has an unknown attribute. (NID: 18)

Can you help clarify what this error is about?

Thank you!

[job]

This is a know issue with (some) Amazon ROAs. Not all AWS ROAs are complying with the RPKI standards. I’ve reported this compliance issue to AWS a few months ago.

Only 'commonName' and 'serialNumber' are allowed in Subject DNs, as specified in RFC 6480 section 2.2 and RFC 6487 section 4.4/4.5.

The problem with these ROAs that in the Subject field the X.509 distinguished name (in addition to the permitted 'commonName' and 'serialNumber') also erroneously includes 'organizationalUnitName' and 'organizationName'.

The non-compliant ROAs need to be re-issued without 'organizationalUnitName' and 'organizationName' in the Subject.

AWS is the only issuer in the whole RPKI ecosystem which issues with incorrect elements in the subject.

[lukastribus]

Some more information on this:

As Job explained, AWS previously all of its ROAs non compliant. Because none of the ROAs passed validation in Fort, AWS prefixes remained UNKNOWN in networks using Fort.

For example:

https://console.rpki-client.org/rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/92e3388a-3322-44eb-9d70-a9abc7a26fb3.roa.html

Which is:

99.86.0.0/16 maxlen: 24 with origin AS 16509 (this is what's in BGP, but the ROA is invalid and rejected)

This ROA has the wrong attributes though and is therefor discarded by Fort.

It appears that Amazon started to reissue some ROA's correctly , for example:

https://console.rpki-client.org/rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/8db8b283-32d5-451e-ae3f-a594ab33edc2.roa.html

Which is:

99.86.0.0/16 maxlen: 24 with origin AS 8987

This ROA is correctly validated by Fort. However it doesn't match the origin ASN actually used in the routing tables.

So because now only the ROA with incorrect origin AS validate, and the ROA with correct ASN is still (correctly) discarded by Fort, the VRPs from Fort are incomplete. This is turn causes networks to mark the prefix as INVALID (where previously it would have been UNKNOWN).

One way to circumvent this issue would be to include a validator in the mix that does not check this particular attribute (as routers combine the results from different RTR sources).

edit: The ROA has since been reissued and is now VALID: https://console.rpki-client.org/rpki-rsync.us-east-2.amazonaws.com/volume/20aa329b-fc52-4c61-bf53-09725c042942/92e3388a-3322-44eb-9d70-a9abc7a26fb3.roa.html

edit2: for the record, there is nothing that Fort should do differently here. However I did not know that in the beginning and at least I got all the details now. I suggest we leave this open just for a few days in case someone else needs to read this.

[job]

I had a phone call with AWS folks to explain the urgency and help progress the issue.

[lukastribus]

As of today 07:57 UTC the amount of non compliant Amazon manifests and ROAs rejected decreased about 80% compared to yesterday, so it looks like progress is being made:

Jul  9 07:57:26 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/54602fb0-a9d4-4f9f-b0ca-be2a139ea92b/773a-32cceKetxwAXjT8GfH3xCQ.mft: The 'subject' name has an unknown attribute. (NID: 18)
Jul  9 07:57:26 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/b8a1dd25-c313-4f25-ac21-bf55514d9c7d/axsOri1uP1xG6cLy0dMJ372dKvU.mft: The 'subject' name has an unknown attribute. (NID: 18)
Jul  9 07:57:29 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/a841823c-a10d-477c-bfdf-4086f0b1594c/GCPJMZh-nJw38EAgqrq_m03_m2Q.mft: The 'subject' name has an unknown attribute. (NID: 18)
Jul  9 07:57:38 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/42582c67-dd3f-4bc5-ba60-e97e552c6e35/_YzK5b5juSvdyQt6W3TmlEnB6wQ.mft: The 'subject' name has an unknown attribute. (NID: 18)
Jul  9 07:57:54 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/065b233b-96e8-4d1b-95a7-c81f87b4ba9f.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  9 07:57:54 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/1ad26571-c674-4a73-b205-77cb32fe83bd.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  9 07:57:54 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/256c0a13-9cbc-490b-8be7-23b43e85292c.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  9 07:57:54 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/39b45593-f3f3-4a2e-aa3a-895815db366a.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  9 07:57:54 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/5443f26e-949a-460a-b187-e26290bfcf24.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  9 07:57:54 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/595ebfb9-e548-4d3e-9fa8-016973527359.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  9 07:57:54 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/63586974-b35a-4b49-953d-2bcf6d3fd94e.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  9 07:57:54 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/6632e911-ee11-4bc9-a573-00ef83fd31d7.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  9 07:57:54 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/73712e14-51d5-41db-bcf2-73aa504e6eab.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  9 07:57:54 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/789a1aef-77f7-4108-9d41-1a97c18e12cb.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  9 07:57:54 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/a0024e00-f937-4b63-91df-d45ce0a6a27d.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  9 07:57:54 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/517f3ed7-58b5-4796-be37-14d62e48f056/c5e869f4-a046-4227-a965-632f217c044e.roa: The 'subject' name has an unknown attribute. (NID: 18)
Jul  9 07:58:07 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/2f059a21-d41b-4846-b7ae-7ea38c32fd4c/HwZxfSr2LjgJByCEw6-PSJSOQOI.mft: The 'subject' name has an unknown attribute. (NID: 18)
Jul  9 07:58:07 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/71e5236f-c6f1-4928-a1b9-8def09c06085/gRVsLhSv751hliJ-LGA1oJ7w0lc.mft: The 'subject' name has an unknown attribute. (NID: 18)
Jul  9 07:59:19 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/e7518af5-a343-428d-bf78-f982b6e60505/XnrVTgTwQuSsDp5lxW5Vx3R40s4.mft: The 'subject' name has an unknown attribute. (NID: 18)
Jul  9 07:59:20 ERR [Validation]: rsync://rpki-rsync.us-east-2.amazonaws.com/volume/dfd7f6d3-e6e9-4987-9ae7-d052c5353898/2bTwgky4C6j8EkC0eUtRUHHpdR0.mft: The 'subject' name has an unknown attribute. (NID: 18)

So some impact is still possible.

All test yesterday and today are ARIN TAL only. When I include all TALs, more AWS errors show.

[lukastribus]

From RIPE RRC (RRC10) looking for the amount of prefixes with AS 8987 / 14618 / 16509 from the specific peer (AS20811) we can see the drop of about 500 prefixes on July 8th and it's recovery:

bgpdump extract example:

bgpdump -v -M -t change bview.20230707.0000.gz | grep -F "217.29.66.88|20811" | grep -w -e 8987 -e 14618 -e 16509

root@rpki-test-2:~/routingdumps# wc -l *20811-aws-prefixes.txt
   9522 bview.20230707.0000-20811-aws-prefixes.txt
   9529 bview.20230707.0800-20811-aws-prefixes.txt
   9523 bview.20230707.1600-20811-aws-prefixes.txt
   9520 bview.20230708.0000-20811-aws-prefixes.txt
   9051 bview.20230708.0800-20811-aws-prefixes.txt
   9229 bview.20230708.1600-20811-aws-prefixes.txt
   9544 bview.20230709.0000-20811-aws-prefixes.txt
   9545 bview.20230709.0800-20811-aws-prefixes.txt
   9543 bview.20230709.1600-20811-aws-prefixes.txt
  85006 total
root@rpki-test-2:~/routingdumps#

Closing this issue now.