<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 29 Aug 2019, at 14:03, Klimek, Denis <<a href="mailto:DKlimek@Stadtwerke-Norderstedt.de" class="">DKlimek@Stadtwerke-Norderstedt.de</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><span style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">Matching two different invalid states (incorrect ASN/prefix length) could solve the issue :-)</span><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">But I don't think that the router vendors are going to implement this soon....<span class="Apple-converted-space"> </span></span></div></blockquote><br class=""></div><div>The routinator API will answer the question though:</div><div><a href="https://rpki.readthedocs.io/en/latest/routinator/interactive.html#validity-checker" class="">https://rpki.readthedocs.io/en/latest/routinator/interactive.html#validity-checker</a></div><div><br class=""></div><div>But.. I think it's ill-advised, if even possible, to hook api calls into your config.</div><div><br class=""></div><div><br class=""></div><div>and just fyi / background</div><div><br class=""></div><div>There was discussion about this in the IETF around 8 years ago? (could be even be 10..) And back then the conclusion was that there were no foreseeable scenarios in the context of RPKI where you would treat the error cases differently. So they got exactly the same status.</div><div><br class=""></div><div>It may be worth re-opening this discussion in the IETF, also in the context of the work that is being done on ASPA. Because, when you are quite certain that the path is correct, then you may want to be more lenient about invalid length. Although a corner case exists where a 3rd ASN is authorised to do covering announcements, but no specifics.</div><div><br class=""></div><div>In any case the outcome of such a discussion is unclear, and will for sure not see implementation overnight if the outcome was to recognise the difference.</div><div><br class=""></div><div>Tim</div><br class=""></body></html>