For the benefit of the WG members, I would like to point out that the Use Cases and Interpretation doc (draft-ietf-sidr-usecases-02) should also be quite useful in the context of this discussion (complementing Pradosh's/Randy's explanations (below) and Section 3 in draft-ietf-sidr-origin-ops-10).
In Sections 3.3 and 3.4 in the Use Cases doc - http://tools.ietf.org/html/draft-ietf-sidr-usecases-02#section-3.3 it is pointed out by examples that max-length should be used in a restrained manner (similar to Randy's example below) when more specific prefixes are intended to be originated from the same AS or a different (say, customer) AS. Also, if you are interested in enumeration of use cases pertaining to validation outcomes vis-à-vis existence of certain ROAs and max-length in the ROAs, then Section 7.1 is worth a read as well. http://tools.ietf.org/html/draft-ietf-sidr-usecases-02#section-7.1 Sriram > -----Original Message----- > From: [email protected] [mailto:[email protected]] On Behalf Of > Pradosh > Mohapatra > Sent: Thursday, September 29, 2011 11:21 PM > To: Randy Bush > Cc: sidr wg list > Subject: Re: [sidr] is a longer announce invalid or not found? > > > there has been a bit of confusion over whether announcement of a longer > > prefix than is covered by a roa is valid, invalid, or not found. so let > > me try to clarify the underlying decision process for valid, invalid, > > and not found so we are all on the same page. i believe this is as it > > is documented in pfx-validate. > > > I concur. > > From a partial deployment perspective, it does mean that once a ROA is > published for an address block (and follows the ops guideline of being > precise), > further sub-allocations NEED to have the ROA published. Otherwise, they > would be marked invalid and risk being not routed. > > - Pradosh > > > > > --- > > > > if i publish a roa for 10.0.0.0/16-16 for AS 42 (and there are no other > > roas for 10/...) > > > > no announcement of 10.0.0.0/16 or any longer prefix thereof from any AS > > may be marked NOT FOUND, after all, a covering roa is there. > > > > any announcement of any prefixes in that space, from /16 to /32, from an > > AS other than 42 are INVALID. this is the purpose of the exercise. > > > > and, an announcement of 10.0.666.0/24 from AS 42 is INVALID, as it has a > > prefix length not specified by the roa. someone is trying to punch a > > hole, not allowed. this could be an origin forger trying to punch a /24 > > in my /16. > > > > but if i publish a roa for 10.0.0.0/16-24 for AS 42, then an > > announcement for 10.0.666.0/24 from AS 42, would be marked VALID. > > > > randy _______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
