> there has been a bit of confusion over whether announcement of a longer > prefix than is covered by a roa is valid, invalid, or not found. so let > me try to clarify the underlying decision process for valid, invalid, > and not found so we are all on the same page. i believe this is as it > is documented in pfx-validate.
I concur. >From a partial deployment perspective, it does mean that once a ROA is published for an address block (and follows the ops guideline of being precise), further sub-allocations NEED to have the ROA published. Otherwise, they would be marked invalid and risk being not routed. - Pradosh > > --- > > if i publish a roa for 10.0.0.0/16-16 for AS 42 (and there are no other > roas for 10/...) > > no announcement of 10.0.0.0/16 or any longer prefix thereof from any AS > may be marked NOT FOUND, after all, a covering roa is there. > > any announcement of any prefixes in that space, from /16 to /32, from an > AS other than 42 are INVALID. this is the purpose of the exercise. > > and, an announcement of 10.0.666.0/24 from AS 42 is INVALID, as it has a > prefix length not specified by the roa. someone is trying to punch a > hole, not allowed. this could be an origin forger trying to punch a /24 > in my /16. > > but if i publish a roa for 10.0.0.0/16-24 for AS 42, then an > announcement for 10.0.666.0/24 from AS 42, would be marked VALID. > > randy > _______________________________________________ > sidr mailing list > [email protected] > https://www.ietf.org/mailman/listinfo/sidr _______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
