RPKI 路由验证
对照我们从五个 RIR 信任锚验证的 ROA 数据副本，进行路由来源验证（RFC 6811）。
此内容尚无中文（中国）版本。在发布译文之前以英语显示。
The Resource Public Key Infrastructure lets the holder of an IP block publish a signed Route Origin Authorisation (ROA): a statement that a given AS may originate the block, up to a maximum prefix length. Networks that perform route origin validation use these to reject routes that contradict them.
Route origin validation (RFC 6811) has three outcomes. A route is valid when a ROA covers the prefix, names its origin AS and allows its length. It is invalid when ROAs cover the prefix but none matches: either a different AS originates it, or it is more specific than the max length allows. It is not found when no ROA covers it, so RPKI says nothing about it.
We validate against our own copy of the validated ROA payloads, built from the five RIRs’ trust anchors by the rpki-client project and refreshed every few hours. Leave the AS field empty to validate the origin our BGP table currently sees.
常见问题
My route is invalid. What now?
Usually the ROA is out of date: the prefix moved to another AS, or a more-specific was announced without raising the max length. The holder of the address block can fix it in their RIR's RPKI portal (for Turkish networks, the RIPE NCC's LIR Portal).
Does 'not found' mean something is wrong?
No. It means the holder has not created ROAs. The route is accepted as before; it simply is not protected.
What is an AS0 ROA?
A ROA naming AS 0 states that no one should originate the prefix. Routes it covers become invalid unless another ROA validates them.