From: Job Snijders Subject: Re: rpki-client: expose superfluous ROAIPAddress maxLength To: Theo Buehler Cc: tech@openbsd.org Date: Sat, 17 Oct 2026 07:32:56 +0000 On Sat, Oct 17, 2026 at 08:32:11AM +0200, Theo Buehler wrote: > Per RFC 9582, section 4.3.2.2, the optional maxLength element of a > ROAIPAddress indicates the maximum length of an IP address prefix that > the ROA authorizes the AS to advertise. If it matches the prefix length, > this carries no additional information, so it can and SHOULD be omitted. > In the good old tradition of sacrificing far too many lambs on the altar > of Postel, this SHOULD could not be made a MUST. > > As of today, 26606 out of 398347 ROAs (6.7%) carry this extra element. > > Our internal struct roa_ip has a maxlength containing the value of the > maxLength (if present) or the prefix length. This lossy representation > discards the info whether the maxlength should have been there. > > This diff adds that info. I made the slightly dubious choice of using a > 1-byte boolean because then it lands in a padding byte, thus avoiding a > few megs of memory overhead in normal mode and shows this in file mode: > > IP address blocks: 154.208.186.0/24 maxlen: 24 (superfluous maxlen) > > I added a -vv warning emitted once per ROA so we can find such ROAs and > a boolean to the JSON output. Having metrics for these kinds of things > would be nice, but it needs a bit more thought. Thanks. # rpki-client -p1 -vv 2>&1 | grep 'superfluous max' | sed 's,/, ,' \ | awk '{ print $2 }' | sort | uniq -c | sort -rn | column -t 10508 rpki.apnic.net 9729 rpki.afrinic.net 6369 rpki.arin.net Perhaps in the future in a similar way non-canonically encoded ROA eContent can be tracked? OK job@