RFC 8210 - The Resource Public Key Infrastructure (RPKI) to Router Protocol, Version 1

Overview

Positive

what Ze has

Neutral

measures that are neither good news nor bad

Negative

what Ze owes

The 8 shares marked as a part above are the whole of the 59 gated MUSTs: they add to 100%. Proven by a recorded break is a share of TAGGED UNITS, a different population, so it is not one of them.

At a glance

Enrolment

Enrolled: RPKI to Router Protocol, Version 1

What the public ledger says

Status: Partial

Coverage

Positive and negative tests (24): RFC8210-5-1, RFC8210-5.1-1, RFC8210-5.1-2, RFC8210-5.11-1, RFC8210-6-2, RFC8210-7-3, RFC8210-5.2-1, RFC8210-4-1, RFC8210-8.3-1, RFC8210-12-1, RFC8210-9-3, RFC8210-9.2-1, RFC8210-9.2-2, RFC8210-9.2-4, RFC8210-9.2-5, RFC8210-10-1, RFC8210-7-7, RFC8210-9.2-8, RFC8210-10-2, RFC8210-9.2-10, RFC8210-8.4-1, RFC8210-3-1, RFC8210-8.1-3, RFC8210-9.2-11

Annotated (including scoped evidence) (35): RFC8210-5.1-3, RFC8210-5.1-4, RFC8210-5.1-5, RFC8210-5.3-1, RFC8210-5.3-2, RFC8210-5.5-1, RFC8210-5.6-1, RFC8210-5.10-1, RFC8210-5.10-2, RFC8210-5.8-1, RFC8210-5.11-2, RFC8210-5.11-3, RFC8210-5.11-4, RFC8210-6-1, RFC8210-7-1, RFC8210-7-2, RFC8210-7-4, RFC8210-8.1-1, RFC8210-8.2-1, RFC8210-9-1, RFC8210-9-2, RFC8210-9.1-1, RFC8210-9.1-2, RFC8210-9.2-3, RFC8210-9.2-6, RFC8210-9.3-1, RFC8210-9.4-1, RFC8210-4-2, RFC8210-4-3, RFC8210-9.3-2, RFC8210-9.4-2, RFC8210-9.4-3, RFC8210-9.2-9, RFC8210-8.1-2, RFC8210-2-1

Requirements

Gaps and untested MUSTs

Proof state

A tagged unit reads unproven where no discrimination record exists for it: nothing in this tree has been observed to break it, so the claim its tag makes is unproven.

RFC8210-5-1

Reserved fields (marked "zero" in PDU diagrams) MUST be zero on transmission and MUST be ignored on receipt. (§5)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Transmit clause: TestWriteResetQueryZeroesReservedOverGarbage. Receipt clause: IPv4/IPv6 Prefix reserved fields (existing units) and now the Cache Reset's reserved octets 2-3: TestRTRReservedOctetsIgnoredOnReceipt sends 0xFFFF there over TCP and the sync still ends with errRtrCacheResetReceivedWillDo and serial 0. Negative: 0xFFFF in octets 2-3 of a Cache Response is adopted as its Session ID, so the positive is not a receiver that ignores octets 2-3 everywhere. Router Key is skipped whole; no other received v1 PDU carries a reserved field.

RFC8210-5.1-1

The remaining bits in the Flags field are reserved for future use. In protocol version 1, they MUST be zero on transmission and MUST be ignored on receipt. (§5.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden on receipt: letting reserved Flags bits affect acceptance or the announce/withdraw decision. TestParsePrefixPDUFlagsHighBitsIgnored (rtr_pdu_test.go) asserts 0xFF is accepted (require.NoError) and read as announce, and 0xFE is accepted and read as withdraw (assert.False announce), so a parser that validated or read the high bits goes red; negative TestReservedPrefixFieldsPreserveValidation repeats the withdrawal case through handlePDU for IPv4 and IPv6. Transmit clause: Ze writes only Reset Query, Serial Query and Error Report PDUs (rtr_pdu.go), none of which carries a Flags field, so there is no producer that could violate it.

RFC8210-5.1-2

Max Length: An 8-bit unsigned integer denoting the longest prefix allowed by the Prefix element. This MUST NOT be less than the Prefix Length element. (§5.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: accepting a Prefix PDU whose Max Length is less than its Prefix Length. TestParseIPv4PrefixMaxLenLessThanPrefixLen builds a PDU with prefix length 24 and max length 16 and asserts parseIPv4Prefix returns an error containing 'invalid' (the prefix length alone is valid, so the buffer isolates the rule); positive TestParseIPv4Prefix accepts max length 24 over prefix length 8. Both buffers carry rtrVersionMin (1), the RFC 8210 version.

RFC8210-5.1-3

If, at any time after the protocol version has been negotiated (Section 7), either the router or the cache finds that the value of the Session ID is not the same as the other's, the party which detects the mismatch MUST immediately terminate the session with an Error Report PDU with code 0 ("Corrupt Data") (§5.1)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-5.1-3, so no unit is bound to it.

RFC8210-5.1-4

If, at any time after the protocol version has been negotiated (Section 7), either the router or the cache finds that the value of the Session ID is not the same as the other's, the party which detects the mismatch MUST immediately terminate the session with an Error Report PDU with code 0 ("Corrupt Data"), and the router MUST flush all data learned from that cache. (§5.1)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-5.1-4, so no unit is bound to it.

RFC8210-5.1-5

routers MUST treat sessions with different Protocol Version fields as separate sessions even if they do happen to have the same Session ID. (§5.1)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-5.1-5, so no unit is bound to it.

RFC8210-5.3-1

When replying to a Serial Query, the cache MUST return the minimum set of changes needed to bring the router into sync with the cache. (§5.3)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-5.3-1, so no unit is bound to it.

RFC8210-5.3-2

That is, if a particular prefix or router key underwent multiple changes between the Serial Number specified by the router and the cache's current Serial Number, the cache MUST merge those changes to present the simplest possible view of those changes to the router. (§5.3)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-5.3-2, so no unit is bound to it.

RFC8210-5.5-1

When replying to a Reset Query (Section 5.4), the cache sends the set of all data records it has; in this case, the withdraw/announce field in the payload PDUs MUST have the value 1 (announce). (§5.5)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-5.5-1, so no unit is bound to it.

RFC8210-5.6-1

The cache server MUST ensure that it has told the router client to have one and only one IPvX PDU for a unique {Prefix, Len, Max-Len, ASN} at any one point in time. (§5.6)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-5.6-1, so no unit is bound to it.

RFC8210-5.10-1

The cache server MUST ensure that it has told the router client to have one and only one Router Key PDU for a unique {SKI, ASN, Subject Public Key} at any one point in time. (§5.10)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-5.10-1, so no unit is bound to it.

RFC8210-5.10-2

For this reason, implementations MUST compare Subject Public Key values as well as SKIs when detecting duplicate PDUs. (§5.10)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-5.10-2, so no unit is bound to it.

RFC8210-5.8-1

The Session ID and Protocol Version MUST be the same as that of the corresponding Cache Response which began the (possibly null) sequence of payload PDUs. (§5.8)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-5.8-1, so no unit is bound to it.

RFC8210-5.11-1

An Error Report PDU MUST NOT be sent for an Error Report PDU. (§5.11)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: answering an Error Report with an Error Report. TestRTRErrorReportIsNotAnswered writes an Error Report with version 99 (which would otherwise draw Unsupported Protocol Version) into readLoop and asserts the cache side's one-byte io.ReadFull ends in io.EOF, so any reply byte goes red. Negative TestASPAProviderListErrorOnWire: a malformed ASPA PDU does draw an Error Report (report[1] == pduErrorRpt, code 9, the encapsulated PDU echoed), so a router that never sent Error Reports goes red.

RFC8210-5.11-2

If the error is generic (e.g., "Internal Error") and not associated with the PDU to which it is responding, the Erroneous PDU field MUST be empty and the Length of Encapsulated PDU field MUST be zero. (§5.11)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-5.11-2, so no unit is bound to it.

RFC8210-5.11-3

If error text is present, it MUST be a string in UTF-8 encoding (see [RFC3629]). (§5.11)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-5.11-3, so no unit is bound to it.

RFC8210-5.11-4

The diagnostic text is optional; if not present, the Length of Error Text field MUST be zero. (§5.11)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: a nonzero Length of Error Text on a report carrying no diagnostic text. TestASPAProviderListErrorOnWire reads the transmitted Error Report and asserts the uint32 after the encapsulated PDU is 0 (assert.Equal uint32(0)). Row carries {single-polarity: positive}: writeErrorReport takes no text, so no input produces a report with text to contrast.

RFC8210-6-1

Caches MUST set Expire Interval to a value larger than either Refresh Interval or Retry Interval. (§6)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-6-1, so no unit is bound to it.

RFC8210-6-2

Expire Interval: This parameter tells the router how long it can continue to use the current version of the data while unable to perform a successful subsequent query. The router MUST NOT retain the data past the time indicated by this parameter. (§6)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: using VRPs or ASPAs after the Expire Interval measured from the last completed End of Data. TestRTRDataExpiryAndRenewal (synctest) asserts the payloads still validate at expire-1s (assertLive) and, after a renewal and an incomplete response, that at the lease deadline cache.Validate is NotFound and aspaCache.isProvider false ("expired payloads still authorize routes"), with both consumers notified; the negatives assert a completed EOD renews (assertLive after renewal), an incomplete response neither renews nor publishes, and TestRTRSerialDeltaCannotRenewAnElapsedLease asserts a serial EOD after the deadline returns errRtrDataExpired and publishes nothing even with the expiry timer stopped. The quote now carries the Expire Interval definition sentence, which names the parameter the MUST NOT refers to and adds no obligation.

RFC8210-7-1

A router MUST start each transport connection by issuing either a Reset Query or a Serial Query. (§7)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: a transport connection on which the router does not speak first with a Reset or Serial Query. TestFirstPDUOnConnectionIsAQuery accepts the connection at a real listener and require.NoError on io.ReadFull of the first PDU (a silent router times out), then asserts buf[1] == pduResetQuery for a fresh session and pduSerialQuery for a resuming one. Row carries {single-polarity: positive}.

RFC8210-7-2

If a cache which supports version 1 receives a query from a router which specifies version 0, the cache MUST downgrade to protocol version 0 [RFC6810] or send a version 1 Error Report PDU with Error Code 4 ("Unsupported Protocol Version") and terminate the connection. (§7)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-7-2, so no unit is bound to it.

RFC8210-7-3

The cache may reply with a version 0 response. In this case, the router MUST either downgrade to version 0 or terminate the connection. (§7)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: after a version 0 reply to the router's query, continuing at the router's own version (neither downgrading nor terminating). TestRTRUnknownNegotiationVersion "unsupported v0": the cache sends a version 0 Cache Response, and the test asserts syncOnce returns errRtrUnsupportedProtocol and the cache's trailing read reaches io.EOF (require.ErrorIs got.err io.EOF), so a router that kept the stream open or loaded the v0 reply goes red. Ze supports no version 0, so terminating is the branch it takes. Negative TestRFC8210V1CacheResponseIsNotTerminated: a reply at the router's own version keeps s.version, publishes its VRP (Validate Valid), and draws no trailing bytes (assert.Empty), so a check that terminated on every Cache Response goes red. The quote now carries the conditioning sentence (the cache replies with a version 0 response).

RFC8210-5.2-1

If the router receives a Serial Notify PDU during the initial startup period where the router and cache are still negotiating to agree on a protocol version, the router MUST simply ignore the Serial Notify PDU, even if the Serial Notify PDU is for an unexpected protocol version. (§5.2, §7)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: a startup Serial Notify erroring the session or being adopted, including one of unexpected version. TestRTRStartupSerialNotifyOfAnyVersionIsIgnored over net.Pipe: a v99 Serial Notify (Session ID 0xBEEF, serial 999) before the Cache Response draws no byte (EOF), readLoop returns nil, and the session ends with the Cache Response's Session ID 7 and the EOD serial 5; negative: a v99 Cache Response in the same window fails with errRtrUnsupportedProtocol and an Error Report code 4, so the exemption is Serial Notify's alone. Removing the Serial Notify exemption from handlePDU's version check reds the positive. TestSerialNotifyIgnoredDuringStartup keeps the same-version pair.

RFC8210-7-4

If either party receives a PDU for a different Protocol Version once the above negotiation completes, that party MUST drop the session (§7)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-7-4, so no unit is bound to it.

RFC8210-4-1

The router MUST choose the most preferred, by configuration, cache or set of caches so that the operator may control load on their caches and the Global RPKI. (§4)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: selecting a cache other than the most preferred one that answers (config order, or reading every cache at once). TestCacheGroupLoadsFromTheMostPreferredCacheThatAnswers lists the standby (preference 200) first and the preferred (10) second; it waits for the preferred cache's accept and t.Fatal fires if the standby accepts within 500ms, so a group that followed config order or dialled all caches goes red. The failover subtest asserts that when the preferred cache refuses, the next in preference order (snaps[1].Synced) carries the load, and snapshots are held most preferred first. The 'or set of caches' alternative is a permission, not a forbidden behaviour.

RFC8210-8.1-1

To limit the length of time a cache must keep the data necessary to generate incremental updates, a router MUST send either a Serial Query or a Reset Query periodically. (§8.1, §8.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: a router that never re-polls. TestRunPollsOnRefreshAfterSuccessRetryAfterFailure (cacheGroup.Run against a real listener, refresh 1s, retry 7200s) waits for a second accept (waitAccept fails the test if none arrives) and asserts it comes within 30s, and that the queries are a Reset Query then a Serial Query. Row carries {single-polarity: positive}.

RFC8210-8.3-1

Regardless of how this state arose, the cache replies with a Cache Reset to tell the router that it cannot honor the request. When a router receives this, the router SHOULD attempt to connect to any more-preferred caches in its cache list. If there are no more-preferred caches, it MUST issue a Reset Query and get an entire new load from the cache. (§8.3)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Judges the MUST only. TestRTRCacheResetReloadsTheWholeSet runs a one-session cacheGroup (no more-preferred cache) against a scripted cache: wire sequence Reset, Serial, Reset after the Cache Reset, the new load's VRP validates Valid and the old one NotFound (replaced, not merged). Negative: the same Serial Query answered with data keeps Serial Queries and merges the delta (old VRP still Valid). TestCacheResetTriggersResetQuery prose corrected to the single-session state it asserts.

RFC8210-12-1

Errors which are considered fatal MUST cause the session to be dropped. (§12)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: keeping the session after a fatal Error Report. TestRTRFatalErrorReportDropsTheSession drives codes 0,1,3,5,6,7,8 over TCP: each fails syncOnce and the cache's Read returns io.EOF (red if the router keeps reading). Negative: a fatal code 0 followed by a full load on the same connection publishes nothing (VRP NotFound, Synced false), red for a router that logs and continues. Code 4 is dispatched by handlePDU's downgrade branch, which also closes the transport; its EOF is asserted under TestRTRUnknownVersionErrorReportIsNotAnswered (code 4) and the downgrade tests, not in this unit.

RFC8210-8.2-1

The cache MUST rate-limit Serial Notifies to no more frequently than one per minute. (§8.2)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-8.2-1, so no unit is bound to it.

RFC8210-9-1

Caches and routers MUST implement unprotected transport over TCP using a port, rpki-rtr (323); see Section 14. (§9)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Single-polarity positive (row annotation). TestRTRUnprotectedTCPFromConfig parses a trusted-network cache-server with no port to 323, starts the plugin's sessions from that entry (port moved to the listener, 323 being privileged), the cache reads a clear-text v2 Reset Query, the plugin syncs, and the served VRP validates Valid.

RFC8210-9-2

If unprotected TCP is the transport, the cache and routers MUST be on the same trusted and controlled network. (§9)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-9-2, so no unit is bound to it.

RFC8210-9-3

If available to the operator, caches and routers MUST use one of the following more protected protocols: (§9)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: using an unprotected stream when the operator has configured a protected transport. TestRTRTLSAuthenticatedCache asserts the RTR exchange completes over TLS 1.2 and 1.3 (observed state.Version, queryType, published VRP and ASPA); negative TestRTRTLSNoPlaintextFallback offers a plaintext RTR server at the TLS address and assertRTRTLSRefused asserts syncOnce errors, zero RTR query bytes reach the peer on any connection, and nothing is published, so a plaintext fallback goes red. Availability is the operator's configuration; the refusal of a cache with neither tls nor trusted-network sits in untagged TestRTRTLSConfigRejectsUnsafeTransport and is RFC8210-3-1's concern.

RFC8210-9.1-1

Cache servers supporting SSH transport MUST accept RSA authentication (§9.1)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-9.1-1, so no unit is bound to it.

RFC8210-9.1-2

User authentication MUST be supported (§9.1)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-9.1-2, so no unit is bound to it.

RFC8210-9.2-1

Client routers using TLS transport MUST present client-side certificates to authenticate themselves to the cache in order to allow the cache to manage the load by rejecting connections from unauthorized routers. (§9.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: a TLS session in which the router presents no client certificate, or not the configured one. The fixture server uses RequireAndVerifyClientCert, and TestRTRTLSAuthenticatedCache asserts the cache received the configured leaf (bytes.Equal chain[0].Raw) and both intermediates, so a router sending no certificate fails the handshake (t.Fatalf on syncOnce) and one sending another goes red. Negative TestRTRTLSRejectsUnusableClientIdentity: missing CA, missing certificate, missing or mismatched key, wrong EKU and missing IP SAN all go through assertRTRTLSRefused, with a working alternate identity present so a silent substitution goes red.

RFC8210-9.2-2

Certificates used to authenticate client routers in this protocol MUST include a subjectAltName extension [RFC5280] containing one or more iPAddress identities (§9.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: authenticating to the cache with a router certificate that carries no iPAddress SAN. Negative TestRTRTLSRejectsUnusableClientIdentity "missing IP SAN" installs a client-auth certificate without an IP SAN and asserts assertRTRTLSRefused (syncOnce error, zero query bytes); the fixture server does not check IP SANs, so the refusal is Ze's and a Ze that sent the certificate would sync and go red. Positive TestRTRTLSAuthenticatedCache presents the fixture router certificate (issued with an iPAddress SAN) and asserts it is the one the cache received; it does not assert the SAN content itself.

RFC8210-9.2-3

when authenticating the router's certificate, the cache MUST check the IP address of the TLS connection against these iPAddress identities (§9.2)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-9.2-3, so no unit is bound to it.

RFC8210-9.2-4

Routers MUST also verify the cache's TLS server certificate, using subjectAltName dNSName identities as described in [RFC6125], to avoid MITM attacks. (§9.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: accepting a cache certificate without verifying it against the dNSName reference. Negative TestRTRTLSRejectsUnauthenticatedCaches "wrong DNS" (server-name other.rtr.test) and "CN only" (no dNSName SAN) both go through assertRTRTLSRefused: syncOnce error, zero query bytes, nothing published, so a router that skipped name verification goes red. Positive TestRTRTLSAuthenticatedCache: a trusted certificate whose dNSName matches syncs and publishes VRP and ASPA.

RFC8210-9.2-5

rpki-rtr implementations which use TLS MUST NOT use Common Name (CN-ID) identifiers (§9.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: authenticating a cache by its Common Name. Negative TestRTRTLSRejectsUnauthenticatedCaches "CN only" issues a server certificate whose CN matches the reference and has no DNS SAN, and assertRTRTLSRefused asserts it is refused, so a CN fallback goes red. Positive TestRTRTLSAuthenticatedCache: a certificate whose CN differs from the reference but whose DNS-ID matches authenticates, so a CN check that overrode DNS-ID goes red.

RFC8210-9.2-6

the DNS-ID identifier type MUST be present in rpki-rtr server certificates. (§9.2)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-9.2-6, so no unit is bound to it.

RFC8210-9.3-1

If TCP MD5 is used, implementations MUST support key lengths of at least 80 printable ASCII bytes, per Section 4.5 of [RFC2385]. (§9.3)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-9.3-1, so no unit is bound to it.

RFC8210-9.4-1

Implementations MUST support key lengths of at least 80 printable ASCII bytes. Implementations MUST also support hexadecimal sequences of at least 32 characters, i.e., 128 bits. Message Authentication Code (MAC) lengths of at least 96 bits MUST be supported, per Section 5.1 of [RFC5925]. (§9.4)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-9.4-1, so no unit is bound to it.

RFC8210-10-1

If data from multiple caches are held, implementations MUST NOT distinguish between data sources when performing validation of BGP announcements. (§10)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Ze holds one cache's set at a time (the group holder's End of Data replaces it), so the reachable form of the rule is that validation is blind to which configured cache supplied the data. TestRTRValidationIgnoresWhichCacheSupplied starts the plugin's sessions twice, VRP served by the preferred cache then by the standby (preferred refused): the Valid/Invalid/NotFound triple is identical, and the Invalid and NotFound members are asserted, so a source that weighted, marked or wildcarded data goes red.

RFC8210-4-2

As a cache server must evaluate certificates and ROAs (Route Origin Authorizations; see [RFC6480]), which are time dependent, servers' clocks MUST be correct to a tolerance of approximately an hour. (§4)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-4-2, so no unit is bound to it.

RFC8210-4-3

Note that the Serial Number comparison used to determine "since the given Serial Number" MUST take wrap-around into account; see [RFC1982]. (§4)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-4-3, so no unit is bound to it.

RFC8210-8.3-2

When a router receives this, the router SHOULD attempt to connect to any more-preferred caches in its cache list. (§8.3)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independently read RFC8210 Section 8.3, including its complete conditional context: 'Regardless of how this state arose, the cache replies with a Cache Reset to tell the router that it cannot honor the request. When a router receives this, the router SHOULD attempt to connect to any more-preferred caches in its cache list. If there are no more-preferred caches, it MUST issue a Reset Query and get an entire new load from the cache.' This row owns the more-preferred-cache attempt, not the separate no-more-preferred-cache MUST. Read TestRTRCacheResetReturnsToPreferredCache and the actual producers through cacheGroup.poll, syncOnce, connectAndSync/readLoop and handlePDU, plus the ROACache.Validate consumer. The test uses two real loopback TCP caches and private populated ROA/ASPA caches. The preferred server initially returns No Data Available without closing its connection, so router-side handling—not a server disconnect—must finish those attempts. The standby supplies a complete set; its next Serial Query receives a real Cache Reset. The test requires the next normal polling round to send a Reset Query to the recovered preferred cache. It then holds back End of Data after two distinct preferred VRPs have actually reached pendingVRPs and requires validation to retain the complete standby set. After preferred End of Data, distinct assertions require the old-only prefix to become NotFound, the shared prefix to reject the old origin and accept the new origin, and the new-only prefix to become Valid; no further standby query is permitted. Thus the positive connection/load observation and negative refusal to retain the standby authorization are separate assertions, not one assertion tagged twice. The test never assigns holder, serial, or published cache content to manufacture recovery. Production poll iterates the ordered list from its head each round; startSessions supplies that list via a stable preference sort. Cache Reset explicitly clears the serial/full-sync state and returns an error through readLoop/syncOnce to poll, rather than being silently dropped. A switch calls startFullSync, and handlePDU publishes the full replacement only at End of Data. Run consumes poll's returned delay and starts another round. The carrier directly invokes those normal rounds and checks Refresh=3600s and Retry=600s; it does not run out those wall-clock intervals, force an immediate retry, or prove a new immediate-retry obligation. Section 8.3 does not prescribe one. The distinct storage/validation assertions additionally protect the existing Section 10 handoff contract; they do not expand this row into whole RFC8210 compliance, route revalidation, ASPA, authentication, or timing coverage. Main's retained race run job-aigp-rpki-new-producer-proof-1c8759f1.log records this root PASS and the rpki package PASS; its overall failure belongs to the separate AIGP bind-address fixture. No new execution or semantic mutation is claimed by this judgment.

RFC8210-6-6

If the router has never issued a successful query against a particular cache, it SHOULD retry periodically using the default Retry Interval, above. (§6)

Audit verdict: enforced (the tests do what the requirement demands), fresh. TestRTRRetriesAtTheDefaultRetryIntervalBeforeAnySuccess: a cacheGroup whose only cache refuses every connection returns 600s (rtrIntervalRetryDefault) from poll; negative: after one successful sync whose EOD sets Retry 30, a failed poll waits 30s, so the default governs only before the first success. Run repeats poll, which is the periodic retry.

RFC8210-9.2-12

when authenticating the router's certificate, the cache MUST check the IP address of the TLS connection against these iPAddress identities and SHOULD reject the connection if none of the iPAddress identities match the connection. (§9.2)

Audit verdict: not-applicable (the requirement has no reachable code path in Ze), fresh. cache-side TLS obligation

No test carries RFC8210-9.2-12, so no unit is bound to it.

RFC8210-9.1-5

host authentication MAY be supported. Implementations MAY support password authentication. (§9.1)

Audit verdict: not-applicable (the requirement has no reachable code path in Ze), fresh. SSH-transport option

No test carries RFC8210-9.1-5, so no unit is bound to it.

RFC8210-7-7

If either party receives a PDU containing an unrecognized Protocol Version (neither 0 nor 1) during this negotiation, it MUST either downgrade to a known version or terminate the connection, with an Error Report PDU unless the received PDU is itself an Error Report PDU. (§7)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: accepting an unrecognized-version PDU, terminating without a report, or answering an unknown-version Error Report. TestRTRUnknownNegotiationVersion: v99 PDU yields errRtrUnsupportedProtocol plus Error Report code 4 then EOF; v2 completes. New negative TestRTRUnknownVersionErrorReportIsNotAnswered: a v99 Error Report with code 0 and code 4 fails the sync and the cache's io.ReadFull of one byte ends in io.EOF, so any reply byte goes red (the exception clause, guarded by handlePDU's Error Report exemption and readLoop's hdr.Type != pduErrorRpt).

RFC8210-9.2-8

o The client router MUST set its "reference identifier" to the DNS name of the rpki-rtr cache. (§9.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: using a reference identifier other than the cache DNS name (the connected IP, or any name the certificate carries). Negative TestRTRTLSRejectsUnauthenticatedCaches: 'wrong DNS' (server-name other.rtr.test vs cert cache.rtr.test) and 'IP SAN only' (connect to 127.0.0.1, cert has only that IP SAN) both go red via assertRTRTLSRefused (syncOnce error, zero query bytes, nothing published). Positive TestRTRTLSDNSAddressIsTheReference: omitted server-name uses the configured cache DNS name, asserting state.ServerName == localhost and a published VRP.

RFC8210-10-2

A client may hold data from multiple caches but MUST keep the data marked as to source, as later updates MUST affect the correct data. (§10)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: an update from one cache applied to another cache's data (unmarked source). TestRTRCacheSwitchKeepsSerialBasesSeparate gives both caches the same Session ID and serial; after switching 2->3->2 it asserts the query sequence ends {2, pduResetQuery} (not a Serial Query against the other cache's base) and that only the selected cache's prefix and ASPA provider validate (roas.Validate / aspas.isProvider per candidate), so a merge or reuse goes red.

RFC8210-9.3-2

Implementations MUST also support hexadecimal sequences of at least 32 characters, i.e., 128 bits. (§9.3)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-9.3-2, so no unit is bound to it.

RFC8210-9.4-2

Implementations MUST also support hexadecimal sequences of at least 32 characters, i.e., 128 bits. (§9.4)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-9.4-2, so no unit is bound to it.

RFC8210-9.4-3

The cryptographic algorithms and associated parameters described in [RFC5926] MUST be supported. (§9.4)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-9.4-3, so no unit is bound to it.

RFC8210-9.2-9

Certification authorities which issue rpki-rtr server certificates MUST support the DNS-ID identifier type (§9.2)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-9.2-9, so no unit is bound to it.

RFC8210-9.2-10

a CN field may be present in the server certificate's subject name but MUST NOT be used for authentication within the rules described in [RFC6125]. (§9.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: authenticating a cache by its CN. Negative TestRTRTLSRejectsUnauthenticatedCaches 'CN only' (CN cache.rtr.test, no DNS SAN) is refused via assertRTRTLSRefused. Positive TestRTRTLSAuthenticatedCache: a cert whose CN is not-the-cache-reference.invalid but whose DNS-ID matches authenticates, so a CN check is not used either way.

RFC8210-8.1-2

When a transport connection is first established, the router MUST send either a Reset Query or a Serial Query. (§8.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: a new transport on which the router sends nothing first, or something other than a Reset/Serial Query. TestFirstPDUOnConnectionIsAQuery requires io.ReadFull of the first PDU to succeed and asserts buf[1] == pduResetQuery (fresh) and == pduSerialQuery (resuming). Row carries {single-polarity: positive}.

RFC8210-8.4-1

When a router receives this kind of error, the router SHOULD attempt to connect to any other caches in its cache list, in preference order. If no other caches are available, the router MUST issue periodic Reset Queries until it gets a new usable load from the cache. (§8.4)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: after No Data Available with no other cache, stopping, sending Serial Queries, or not repeating the Reset Query until a usable load arrives. TestNoDataAvailableKeepsResetQueryMode runs a single-session cacheGroup (no other cache), the cache answers two queries with Error Report code 2, and the test asserts three consecutive queries are pduResetQuery each within 4s at a 1s retry (a router that stopped hits t.Fatal, one that sent a Serial Query fails assert.Equal); the negative asserts that once a complete load is published the next query is pduSerialQuery, which pins the 'until it gets a new usable load' bound. The widened quote adds the SHOULD failover sentence only as the condition's context; this row judges its MUST.

RFC8210-2-1

While a cache is receiving updates, new incoming data and implicit deletes are associated with the new serial but MUST NOT be sent until the fetch is complete (§2)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC8210-2-1, so no unit is bound to it.

RFC8210-3-1

A Relying Party, e.g., router or other client, MUST have a trust relationship with, and a trusted transport channel to, any cache(s) it uses. (§3)

Audit verdict: enforced (the tests do what the requirement demands), fresh. TLS path: TestRTRTLSRejectsUnauthenticatedCaches / TestRTRTLSAuthenticatedCache. Unprotected-TCP path: TestRTRUnprotectedTCPFromConfig syncs and uses data from a cache declared trusted-network; negative: cache-server {} and trusted-network false are refused by parseRPKIConfig, the only difference from the accepted entry being the declaration, so no session over an undeclared channel can start.

RFC8210-8.1-3

In all other cases, the router lacks the necessary data for fast resynchronization and therefore MUST fall back to a Reset Query. (§8.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. TestRTRResetQueryWithoutFastResyncData records the first query on the wire in each lacking-data case: no remembered session, expired lease (serial 42 held), cache switch (standby holds serial 42 over a current lease, so only startFullSync forces the Reset), and version downgrade (v2 Serial answered with code 4 at v1, retried as v1 Reset). Negative: same cache with a current lease opens with a Serial Query carrying Session ID 7 and serial 42. Each case isolated from the others.

RFC8210-9.2-11

o Support for the DNS-ID identifier type (that is, the dNSName identity in the subjectAltName extension) is REQUIRED in rpki-rtr server and client implementations which use TLS. (§9.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Forbidden: a TLS client that cannot authenticate the cache by DNS-ID (dNSName SAN). Positive TestRTRTLSAuthenticatedCache: a DNS-ID cert with a differing CN syncs and publishes VRP and ASPA. Negative TestRTRTLSRejectsUnauthenticatedCaches: wrong DNS, CN only, IP SAN only are refused (assertRTRTLSRefused). The server-implementation clause binds a role Ze does not fill: Ze has no RTR cache server (only rtr_session.go and rtr_pdu.go, both client-side).

Extraction sign-off

Sections

Excluded sentences

Superseded

No document obsoletes RFC 8210, so its obligations are stated where they were written.