SAVNET: Intra- and Inter-domain Source Address Validation Architecture + BAR-SAV — draft-ietf-savnet-intra-domain-architecture, draft-ietf-savnet-inter-domain-architecture, draft-ietf-sidrops-bar-sav#
IETF 123 (Madrid) digest Program Core pick Madrid · 19–25 July 2025
- Tier: Core
- Why: Anti-spoofing that's actually automated. uRPF and hand-maintained ACLs both fail in asymmetric-routing reality; SAVNET generates SAV rules from routing plus dedicated SAV signaling, and BAR-SAV derives filters from BGP UPDATEs + ASPA + ROA. This is the security-meets-routing intersection, and it directly affects edge/fabric filtering correctness.
- What: The intra-domain architecture produces accurate SAV at network edges automatically, using both local routing info and SAV-specific info exchanged between routers — more accurate than uRPF under asymmetric routing and less manual than ACLs. The inter-domain architecture does AS-level SAV by sharing SAV-specific info between ASes, falling back to general routing info during partial deployment. BAR-SAV (updates RFC 8704) derives robust SAV filters from BGP UPDATEs, ASPA, and ROA while preserving directionality and minimizing false positives. (from abstract only)
- How: SAVNET routers exchange purpose-built SAV information rather than inferring validity solely from the FIB, which is what kills uRPF accuracy in asymmetric paths; BAR-SAV combines three existing RPKI/BGP data sources to reduce both over-blocking and under-blocking.
- Where applicable: Intra-domain version applies to any operator edge; inter-domain version assumes incremental cross-AS adoption (designed to degrade gracefully when peers haven't deployed it). Broadly applicable, not vendor-specific.