search

dragonresearch / rpki.net

Dragon Research Labs rpki.net RPKI toolkit
54 stars 26 forks source link

add support for removing ROAs covering child's prefixes #763

Open sraustein opened 9 years ago

sraustein commented 9 years ago

In #719 we added the ability to create ROAs to cover a child's prefix space when the parent's ROA would invalidate the child's existing routes.

We also need a way to remove all of those extra ROAs at the point when they are no longer required (child has created their own).

This can probably either be done on a per-child basis, or in aggregate.

Trac ticket #754 component gui priority minor, owner None, created by melkins on 2015-03-05T00:50:24Z, last modified 2015-03-05T18:03:11Z

sraustein commented 9 years ago

operationally, i think it is the reverse. the problem being addresses is that the parent wants to protect their /16, but has a child to whom it has delegated a /24, and that child has issued no roa (yet)

if there are no roas the parent wants to issue for /16 the child is announcing a /24 but has made no roa the parent makes a roa for the child so the child's bgp announcement does not become invalid

if/when the child finally makes a roa for the /24, the overshadowing parent should remove the /24 one they created so as not to control the child's space unnecessarily

if the child has made a roa for the /24 before the parent makes one for the /16, the parent's /16 will not actually make the bgp announcement for the /24 invalid, it just overshadows

Trac comment by randy on 2015-03-05T02:58:19Z

sraustein commented 9 years ago

I think we are in full agreement.

What I envision is a button in the GUI for the parent that revokes all of its own ROAs that cover only prefixes sub-allocated to a direct child IFF revoking said ROA does not cause the child's route to become invalid. Sort of a garbage-collection feature.

Trac comment by melkins on 2015-03-05T18:03:11Z