Subject: Re: [sidr] [rpki] Some test results of ROA issuing for sharing

From: "Yu Fu" <[email-masked]>
Date: Fri, 25 Sep 2015 08:59:41 +0800

Hi Rob

If the command of load_roa_requests works like as you described, I have one
other question.

It would have problems with the load_roa_requests command in the case as
below : 
We have issued ROA1 for AS1-> IP Prefix1 five minutes ago. Then we want to
issue ROA2 for AS1-> IP Prefix2. As you described below, we need to include
ROA1 in the new set when we are issuing the ROA2. But AS1 has not been
authorized to announce IP prefix2. So we are failed to issue the ROA2. And
the ROA1 are also failed for issuing as together with the ROA2. This will be
a mistake for this use case.

BR
Yu

-----Original Message-----
From: Rob Austein [mailto:[email-masked]] 
Sent: Thursday, September 24, 2015 11:59 AM
To: Yu Fu
Cc: [email-masked]
Subject: Re: [rpki] [sidr] Some test results of ROA issuing for sharing

I think you misunderstood how the load_roa_requests command works.  It
REPLACES the set of ROA requests with a new set.  If you want to keep an
existing ROA in the set, you have to include it in the new set.

Putting it another way: the way you would tell rpkic that you want to delete
all your roas would be to load_roa_requests /dev/null.

So, as I can tell from your report, the code is working as designed.

---

From: Rob Austein <[email-masked]>
Date: Fri, 25 Sep 2015 02:29:39 -0400

> a mistake for this use case.

Not sure I really understand your question.  Taking a guess, you're
saying that, when you tried adding a ROA that should fail (because it
doesn't have the necessary resources), this somehow broke an existing
ROA.  That would indeed be a bug, but I tried setting up a regression
test for that specific scenario and, as expected, was not able to get
it to fail.  So I suspect there's something else going on.

Note: The [email-masked] list is probably not the correct place to be
asking about user interface details of a particular implementation.