[sidr] RPKI-RTR implementation clues

Denis Fondras <ietf@ledeuns.net> Wed, 27 September 2017 09:19 UTC

Return-Path: <ietf@ledeuns.net>
X-Original-To: sidr@ietfa.amsl.com
Delivered-To: sidr@ietfa.amsl.com
Received: from localhost (localhost []) by ietfa.amsl.com (Postfix) with ESMTP id BCF60134828 for <sidr@ietfa.amsl.com>; Wed, 27 Sep 2017 02:19:01 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.107
X-Spam-Status: No, score=-1.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RDNS_NONE=0.793, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=no autolearn_force=no
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id LlkhPeSBNMZe for <sidr@ietfa.amsl.com>; Wed, 27 Sep 2017 02:18:59 -0700 (PDT)
Received: from carcass.ledeuns.net (unknown [IPv6:2a00:6060:ffff::1005:ff02]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 726B4134874 for <sidr@ietf.org>; Wed, 27 Sep 2017 02:18:08 -0700 (PDT)
Received: from localhost (carcass.ledeuns.net [local]) by carcass.ledeuns.net (OpenSMTPD) with ESMTPA id a10bf6fd for <sidr@ietf.org>; Wed, 27 Sep 2017 11:18:05 +0200 (CEST)
Date: Wed, 27 Sep 2017 11:18:05 +0200
From: Denis Fondras <ietf@ledeuns.net>
To: sidr@ietf.org
Message-ID: <20170927091805.GH41648@carcass.ledeuns.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.6.2 (2016-07-01)
Archived-At: <https://mailarchive.ietf.org/arch/msg/sidr/JROvMjqBsd6Sf6FQyX9iJi9BZPc>
Subject: [sidr] RPKI-RTR implementation clues
X-BeenThere: sidr@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Secure Interdomain Routing <sidr.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sidr>, <mailto:sidr-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/sidr/>
List-Post: <mailto:sidr@ietf.org>
List-Help: <mailto:sidr-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sidr>, <mailto:sidr-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 27 Sep 2017 09:19:02 -0000


I'm in the process of adding RPKI-RTR (RFC6810) support to OpenBGPd and I am
wondering about how others have implemented it.

- How is the process started ?
Currently, when I start bgpd, it will fetch a list of VRP from the cache and at
the same time get prefixes from its peers.  As soon as it gets a VRP, it will
try to validate prefixes in the RIB. The goal is to get a state as sooner as
possible to apply filters if needed.
The problem is I can have an unknown state in the case a prefix tries to get
validated while the VRP list is not complete. The solution is to make another
round of validation when I get a complete VRP list.
Do you wait until you get a complete VRP list (ENDOFDATA message) before
starting the validation process ?

- How are subsequent validation handled ?
Do you start the validation process as soon as you get a new VRP or do you wait
for a refresh timer ? In the former, a prefix could stay in the wrong state for
some time. I am assuming that every new prefix is validated as it arrives.

Thank you in advance,