Re: [Sidrops] ASPA duplicates

[Randy Bush <[e-mail]>]

> This might not be easy for existing RPs - with ROAs the thought has
> also been that they are cumulative. Now you would need to keep much
> more state, and even check between all configured TAs - which until
> now could just be processed in parallel.
> 
> I understand your reasoning, but I think this warrants at least some
> normative wording in the document and discussion in the security
> section. And most importantly I am curious to learn what RP software
> implementers think (nowadays I do the CA side, which is much easier in
> this context).

from draft-ietf-sidrops-8210bis

11.  ROA PDU Race Minimization

   When a cache is sending ROA PDUs to the router, especially during an
   initial full load, two undesirable race conditions are possible:

   Break Before Make:  For some prefix P, an AS may announce two (or
      more) ROAs because they are in the process of changing what
      provider AS is announcing P.  This is is a case of "make before
      break."  If a cache is feeding a router and sends the one not yet
      in service a significant time before sending the one currently in
      service, then BGP data could be marked invalid during the
      interval.  To minimize that interval, the cache SHOULD announce
      all ROAs for the same prefix as close to sequentially as possible.

   Shorter Prefix First:  If an AS has issued a ROA for P0, and another
      AS (likely their customer) has issued a ROA for P1 which is a sub-
      prefix of P0, a router which receives the ROA for P0 before that
      for P1 is likely to mark a BGP prefix P1 invalid.  Therefore, the
      cache SHOULD announce the sub-prefix P1 before the covering prefix
      P0.

randy