Symptom
Seen in IOS-XR 6.7.3 and 6.1.4 that BGP is not conforming to RFC6811 or RFC6907 in RPKI Route Origin Validation dealing with BGP route that has AS_SET.
Based on RFC6811.
==========
o Route Origin ASN: The origin AS number derived from a Route as
follows:
* the rightmost AS in the final segment of the AS_PATH attribute
in the Route if that segment is of type AS_SEQUENCE, or
* the BGP speaker's own AS number if that segment is of type
AS_CONFED_SEQUENCE or AS_CONFED_SET or if the AS_PATH is empty,
or
* the distinguished value "NONE" if the final segment of the
AS_PATH attribute is of any other type.
==========
AS_SET is of the "other type"
Thus, a Route whose Origin ASN is "NONE" cannot be Matched by any VRP and should be marked as "Invalid" or "NotFound". Based on RFC6907 section 7.1.9 below, it should be "Invalid".
rfc6907#section-7.1.9
In IOS-XR today, it seems we mark it as Valid OR Invalid states for such routes which have multiple AS'es in an AS_SET or even a singleton AS (shows Valid). AS_SET is an unordered list so matching only the leftmost within the AS_SET or rightmost within the AS_SET is incorrect as well.
Scenario#2: RFC6907 section 7.1.11
Scenario#3: RFC6907 section 7.1.11
Further Problem Description
BGP RPKI did not conform to RFC when AS-SETs were in the originating AS position
