From 48188ebd14b6dfceb25e5d404768f5f4fbb2e93e Mon Sep 17 00:00:00 2001 From: Tim Bruijnzeels Date: Fri, 19 Jun 2020 10:35:28 +0200 Subject: [PATCH] Only set max length on ROAs if it is effectively longer than the prefix length. --- src/daemon/ca/routes.rs | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/daemon/ca/routes.rs b/src/daemon/ca/routes.rs index dbe0660b..7326225d 100644 --- a/src/daemon/ca/routes.rs +++ b/src/daemon/ca/routes.rs @@ -304,7 +304,13 @@ impl Roas { let signing_key = certified_key.key_id(); let mut roa_builder = RoaBuilder::new(auth.asn().into()); - roa_builder.push_addr(prefix.ip_addr(), prefix.addr_len(), auth.max_length()); + + if auth.effective_max_length() > auth.prefix().prefix().addr_len() { + roa_builder.push_addr(prefix.ip_addr(), prefix.addr_len(), auth.max_length()); + } else { + roa_builder.push_addr(prefix.ip_addr(), prefix.addr_len(), None); + } + let mut object_builder = SignedObjectBuilder::new( Serial::random(signer).map_err(ca::Error::signer)?, SignSupport::sign_validity_years(ROA_CERTIFICATE_VALIDITY_YEARS),