Partial

RFC 2328 - OSPF Version 2

Every requirement this repository extracted from RFC 2328, the tests bound to it, and what a reader has verified about them. This summary is enrolled and gated by ./le rfc check.

Overview

Positive

what Ze has

Tested both ways96.0%24 of 25 binding obligations

a positive test proves Ze does what the requirement demands and a negative one proves it refuses what the requirement forbids

One polarity plus reason0.0%0 of 25 binding obligations

the requirement admits no counter-case, so one polarity plus a recorded reason is the whole proof available for it

One polarity, unexcused0.0%0 of 25 binding obligations

one direction is tested, the other is neither tested nor excused, and nothing states which

Proven by a recorded break0.0%0 of 59 tagged units

a red was observed once under a recorded procedure, and the unit, the claim and the producer it rested on still hash to what was recorded. The break is not re-run. A test pair is not a proof until one has been observed

Neutral

measures that are neither good news nor bad

Gated MUSTs25of 38 this summary declares

MUST-level requirements the gate HOLDS. A population, not a result: the shares beside it are what says how Ze stands

Out of scope0of 25 gated MUSTs

a {not-applicable} annotation says the obligation does not bind Ze. Scope, not coverage: it is in no share below

Negative

what Ze owes

No test at all4.0%1 of 25 binding obligations

no test carries the requirement id, whether or not a gap states why

The 4 shares marked as a part above are the whole of the 25 obligations that bind Ze: they add to 100%. Proven by a recorded break is a share of TAGGED UNITS, a different population, so it is not one of them.

How to read the colors

A color names what the measure MEANS, not how well Ze scores on it. Green is a good outcome at any value, red is a bad one, and neither a population nor a scope count is an outcome, so both take no color. The number under the label is what says how far Ze has got.

Card	Tone here	Why that color
Gated MUSTs	neutral	no color: a population is a scale, and a larger one is neither good news nor bad. It is the accounting total
Out of scope	neutral	no color: an obligation that never bound Ze is neither an achievement nor a failure, and counting it either way would be a claim
Tested both ways	ok	green at every value: a test pair is the outcome this gate exists to produce, and the share under the label is what says how far Ze has got
One polarity plus reason	ok	green at every value: where no counter-case exists, one polarity IS the complete answer, and a recorded reason is what the gate demands beside it
One polarity, unexcused	ok	green at zero, RED above it: half a proof with no reason for the other half
No test at all	bad	green at zero, RED above it: a binding obligation nothing exercises is a claim with nothing behind it, whether or not a reason is stated
Proven by a recorded break	ok	green at every value: an observed break is the outcome the discrimination gate exists to produce. The denominator is TAGGED UNITS, not obligations, so this share is not one of the parts above
Audit verdicts	warn	RED on the first weak, wrong or unimplemented verdict, amber while a verdict is no longer current or a gated MUST is unjudged, green when every one is judged sound and current

At a glance

Field	Value
Public status	Partial
Enrolment	Enrolled
Requirements	38
Gated MUST-level	25
Obligations that bind Ze	25
Not applicable, so out of scope	0
Declared gaps	1
Gated with no test	0
Nightly-only evidence	0
Test tags	61
Tagged units	59
Recorded audit verdicts	0
Discrimination records	0
Summary	`rfc/short/rfc2328.md`
Requirement shard	`rfc/requirements/rfc2328.md`
RFC text	`rfc/full/rfc2328.txt`

Enrolment

Enrolled: OSPF Version 2

What the public ledger says

Status: Partial

What the ledger says is covered

Native OSPFv2 engine, raw protocol 89: the 24-byte common header with Version-2 validation and the auth-excluding packet checksum, the Fletcher LS checksum, the Section 13 flooding procedure (checksum/unknown-type discard, stub-area Type-5 filter, Exchange-or-higher gate, Section 13.1 freshness ordering, MaxAge+MaxSequenceNumber silent discard, retransmission lists at RxmtInterval, Table 19 acknowledgment decisions, self-originated re-origination and premature-aging flush), Section 14 aging and purge retention, the Section 16 routing calculation (two-way check, ABR backbone-only summaries, LSInfinity/MaxAge/self skips, intra-over-inter-over-external path preference), Database Exchange with a single outstanding DD and the BadLSReq restart, virtual links with Interface MTU 0 in their DDs, positive interface output cost, and Appendix D authentication types 0/1/2 including the non-decreasing cryptographic sequence number. Requirements bound per line in rfc/short/rfc2328.md.

What the ledger says remains

One MUST gap, annotated in rfc/short/rfc2328.md and gated by ./le rfc check: RFC2328-13.3-2 -- the InfTransDelay increment of LS age is applied on retransmission (internal/plugins/ospf/lsdb/flooding.go) and on a direct database-copy reply (internal/plugins/ospf/lsdb/flooding.go), but the normal flood path copies the LSA with transmit delay 0 (floodExcept -> entry.LSA(d.now()) -> Raw(now, 0), internal/plugins/ospf/lsdb/flooding.go and internal/plugins/ospf/lsdb/entry.go), so a first-flooded LSA carries an unincremented age. The feature also remains pre-production pending hardening and deployment evidence.

Coverage

Bucket	Count	What it counts
Positive and negative tests	24	one part of the gated population
Annotated instead of tested	1	one part of the gated population
One polarity only	0	one part of the gated population
No test and no annotation	0	one part of the gated population
Evidence that runs nightly only	0	an overlay: each of these is also counted by the part it falls in
Gated MUST-level requirements	25	every gated MUST falls in exactly one bucket above

Positive and negative tests (24): RFC2328-A.3.1-1, RFC2328-A.3.1-2, RFC2328-12.1.7-1, RFC2328-13-1, RFC2328-13-2, RFC2328-13-3, RFC2328-13.1-1, RFC2328-13-4, RFC2328-13.3-1, RFC2328-14-1, RFC2328-14-2, RFC2328-13.5-1, RFC2328-13.4-1, RFC2328-16.1-1, RFC2328-16.4-1, RFC2328-16.2-1, RFC2328-16.2-2, RFC2328-D.2-1, RFC2328-D.3-1, RFC2328-D.3-2, RFC2328-A.3.3-1, RFC2328-10.1-1, RFC2328-10.2-1, RFC2328-C.3-1

Annotated instead of tested (1): RFC2328-13.3-2

Requirements

Requirement	Level	Section	Tests
`RFC2328-A.3.1-1`	All OSPF packets begin with the standard 24-byte header; Version # MUST be 2 (§A.3.1)
	MUST	A.3.1	positive`unit/verifyTestOSPFHeaderRoundTrip` negative`unit/verifyTestOSPFHeaderRejectsBadVersionAndLength`
`RFC2328-A.3.1-2`	Compute the packet header IP checksum over the whole packet excluding the 64-bit authentication field (§A.3.1, §D.4)
	MUST	A.3.1	positive`unit/verifyTestOSPFPacketChecksumExcludesAuth` negative`unit/verifyTestPacketVerifyChecksum`
`RFC2328-12.1.7-1`	Compute the LS (Fletcher) checksum over the complete LSA excluding the LS age field; the LS checksum MUST NOT be zero (calculation is not optional) (§12.1.7)
	MUST	12.1.7	positive`unit/verifyTestOSPFLSAChecksum` positive`unit/verifyTestOSPFLSAChecksumExcludesAge` negative`unit/verifyTestRFC2328ZeroLSChecksumRejected`
`RFC2328-13-1`	In the flooding procedure, discard an LSA with an invalid LS checksum and discard an LSA of unknown LS type (only types 1-5 are defined) (§13)
	MUST	13	positive`unit/verifyTestOSPFFloodOutOtherInterfaces` negative`unit/verifyTestDecodeLSReqRejectsMalformed` negative`unit/verifyTestRFC2328BadLSChecksumDiscarded`
`RFC2328-13-2`	Flood AS-external (Type 5) LSAs into or throughout a stub area (§13, §3.6)
	MUST NOT	13	positive`unit/verifyTestOSPFStubFloodFilter` negative`unit/verifyTestOSPFStubAreaDropsType5`
`RFC2328-13-3`	Drop a Link State Update / Acknowledgment from a neighbor in a state lesser than Exchange (§13, §13.7)
	MUST	13	positive`unit/verifyTestRFC2328FloodingRequiresExchangeOrHigher` negative`unit/verifyTestRFC2328FloodingRequiresExchangeOrHigher`
`RFC2328-13.1-1`	Determine the more recent of two LSA instances using LS sequence number, then larger LS checksum, then MaxAge, then younger LS age beyond MaxAgeDiff (§13.1)
	MUST	13.1	positive`unit/verifyTestOSPFFreshnessCompareMatrix` negative`unit/verifyTestRFC2328OlderInstanceGetsDatabaseCopyBack`
`RFC2328-13-4`	If the database copy is MaxAge with LS sequence number MaxSequenceNumber, discard a received older instance without acknowledging (§13, step 8)
	MUST	13	positive`unit/verifyTestOSPFMaxSeqMaxAgeSilentDiscard` negative`unit/verifyTestRFC2328OlderInstanceGetsDatabaseCopyBack`
`RFC2328-13.3-1`	Add an LSA flooded out an adjacency to that adjacency's Link state retransmission list and retransmit at RxmtInterval until acknowledged (§13.3, §13.6)
	MUST	13.3	positive`unit/verifyTestOSPFFloodOutOtherInterfaces` positive`unit/verifyTestOSPFRetransmitTimer` negative`unit/verifyTestOSPFFloodQueuesExchangeAndLoadingNeighbors`
`RFC2328-13.3-2`	Increment an LSA's LS age by InfTransDelay (which MUST be > 0) when copying it into an outgoing Link State Update, capped at MaxAge (§13.3, §13.6, §14)
	MUST	13.3	positive`no test`no positive test negative`no test`no negative test {gap}: the InfTransDelay bump is applied on the retransmit path (RetransmitTick, lsdb/flooding.go:545) and on a direct database-copy reply (sendDirectLSUpdate, lsdb/flooding.go:745; sendDirectLinkLSUpdate, lsdb/link_scope.go:349), but NOT on the normal flood: floodExcept builds the outgoing copy with `entry.LSA(d.now())` (lsdb/flooding.go:351), and Entry.LSA calls `e.Raw(now, 0)` with transmitDelay 0 (lsdb/entry.go:62-68, 75-85), so the first flooded copy carries the unincremented LS age. The MaxAge cap itself is present wherever the bump is applied (LSAge.Add, types/lsage.go:54-63). Disclosed in docs/features/rfc-status.md RFC 2328 row
`RFC2328-14-1`	Never increment an LSA's LS age past MaxAge, and exclude MaxAge LSAs from the routing-table calculation (§14)
	MUST	14	positive`unit/verifyTestLSAgeAddSaturates` positive`unit/verifyTestOSPFLSDBAgeToPurge` negative`unit/verifyTestOSPFGraphSkipsMaxAge`
`RFC2328-14-2`	Remove a MaxAge LSA from the database only once it is on no neighbor retransmission list and no neighbor is in Exchange or Loading (§14)
	MUST	14	positive`unit/verifyTestOSPFASExternalPurgeRetainedAcrossAreas` negative`unit/verifyTestOSPFPurgeRetainedForExchangeOrLoading`
`RFC2328-13.5-1`	Acknowledge every newly received LSA (directly or implicitly per Table 19) (§13.5)
	MUST	13.5	positive`unit/verifyTestOSPFAckDecisionTable` positive`unit/verifyTestOSPFUnknownMaxAgeNoCopyIsAckedAndDiscarded` negative`unit/verifyTestOSPFDRRefloodsBackOutReceivingInterface`
`RFC2328-13.4-1`	Detect self-originated LSAs by Advertising Router == own Router ID, or network-LSA Link State ID == own interface address, and re-originate or flush via premature aging (§13.4, §14.1)
	MUST	13.4	positive`unit/verifyTestOSPFOriginateSelfReceivedHigherSeq` negative`unit/verifyTestOSPFSelfOriginatedNoLocalCopyFlush`
`RFC2328-16.1-1`	In intra-area SPF, include a transit-vertex link only if the neighbor LSA exists, is not MaxAge, and has a link back to the current vertex (two-way check) (§16.1)
	MUST	16.1	positive`unit/verifyTestOSPFSPFShortestPath` negative`unit/verifyTestOSPFTwoWayCheck`
`RFC2328-16.4-1`	Prefer intra-area and inter-area paths over AS-external paths; prefer Type 1 external over Type 2; among Type 2 prefer the smallest type-2 metric (§16.4)
	MUST	16.4	positive`unit/verifyTestOSPFRouteTablePreference` negative`unit/verifyTestOSPFExternalE1PreferredOverE2`
`RFC2328-16.2-1`	As an ABR, examine only backbone summary-LSAs when computing inter-area routes (§16.2)
	MUST	16.2	positive`unit/verifyTestOSPFInterAreaRoute` negative`unit/verifyTestOSPFABRBackboneOnlyAcceptance`
`RFC2328-16.2-2`	Skip a summary-LSA or AS-external-LSA whose cost is LSInfinity, whose LS age is MaxAge, or that is self-originated, during the routing calculation (§16.2, §16.4)
	MUST	16.2	positive`unit/verifyTestOSPFInterAreaRoute` negative`unit/verifyTestOSPFExternalLSInfinityDropped` negative`unit/verifyTestOSPFInterAreaLSInfinityDropped` negative`unit/verifyTestRFC2328ExternalSkipsMaxAgeAndSelf` negative`unit/verifyTestRFC2328InterAreaSkipsMaxAgeAndSelfSummary`
`RFC2328-D.2-1`	Discard a packet whose Simple-password (AuType 1) authentication field does not match the configured 64-bit password (§D.2, §D.5)
	MUST	D.2	positive`unit/verifyTestRFC2328SimplePasswordMismatchDiscarded` negative`unit/verifyTestRFC2328SimplePasswordMismatchDiscarded`
`RFC2328-D.3-1`	For Cryptographic auth (AuType 2), set the header checksum to 0, append the message digest (16 bytes for MD5), and exclude the digest from the OSPF header packet length while including it in the IP length (§D.3, §D.4.3)
	MUST	D.3	positive`unit/verifyTestOSPFAuthSignVerifyCrypto` negative`unit/verifyTestOSPFAuthCryptoRejectsExtraTrailerBytes`
`RFC2328-D.3-2`	Treat the crypto sequence number as non-decreasing, reset it to 0 when the neighbor goes Down, and set it to a received packet's value when accepted as authentic (§D.3)
	MUST	D.3	positive`unit/verifyTestNeighborDownResetsCryptoSeq` positive`unit/verifyTestOSPFAuthReplay` negative`unit/verifyTestOSPFAuthReplay`
`RFC2328-A.3.3-1`	Set Interface MTU to 0 in Database Description packets sent over virtual links (§A.3.3)
	MUST	A.3.3	positive`unit/verifyTestRFC2328VirtualInterfaceHasNoMTU` positive`unit/verifyTestRFC2328VirtualLinkDBDescCarriesZeroMTU` negative`unit/verifyTestRFC2328VirtualLinkDBDescCarriesZeroMTU`
`RFC2328-10.1-1`	Allow only one Database Description packet outstanding per adjacency at a time (§10.1, §10.3)
	MUST	10.1	positive`unit/verifyTestOSPFDDRetransmit` negative`unit/verifyTestOSPFDuplicateDD`
`RFC2328-10.2-1`	Generate the BadLSReq event and restart the Database Exchange when an LS Request names an LSA not in the database (§10.2, §13)
	MUST	10.2	positive`unit/verifyTestOSPFBadLSReqRestart` negative`unit/verifyTestOSPFValidLSReqSendsLSUpdate` negative`unit/verifyTestRFC2328KnownLSRequestDoesNotRestartExchange`
`RFC2328-C.3-1`	Use a positive Interface output cost (greater than 0) (§C.3)
	MUST	C.3	positive`unit/verifyTestInterfaceCostAndTransmitDelayBoundary` negative`unit/verifyTestInterfaceCostAndTransmitDelayBoundary`
`RFC2328-A.2-1`	Reset (clear) unrecognized Options bits when sending Hellos / DD packets and when originating LSAs (§A.2)
	SHOULD	A.2	positive`no test`no positive test negative`no test`no negative test
`RFC2328-A.2-2`	Ignore unrecognized Options bits on receipt and process the packet/LSA normally (§A.2)
	SHOULD	A.2	positive`no test`no positive test negative`no test`no negative test
`RFC2328-9.5-1`	Set the E-bit in Hello Options iff the attached area can process AS-external-LSAs (not a stub); a mismatch causes Hello rejection (§9.5, §10.5)
	SHOULD	9.5	positive`no test`no positive test negative`no test`no negative test
`RFC2328-C.1-1`	Keep RFC1583Compatibility set identically on all routers; "disabled" (the 16.4.1 rules) when no un-updated routers are present (§C.1, §16.4.1)
	SHOULD	C.1	positive`no test`no positive test negative`no test`no negative test
`RFC2328-B-1`	Refresh a self-originated LSA when its LS age reaches LSRefreshTime (30 minutes) (§B, §12)
	SHOULD	B	positive`no test`no positive test negative`no test`no negative test
`RFC2328-14-3`	Restart the router (at least) on detecting an LS checksum failure during database aging at a CheckAge multiple (§14, §12.1.7)
	SHOULD	14	positive`no test`no positive test negative`no test`no negative test
`RFC2328-14.1-1`	Flush a self-originated AS-external-LSA via premature aging rather than re-originating with metric LSInfinity when the route becomes unreachable (§14.1)
	SHOULD	14.1	positive`no test`no positive test negative`no test`no negative test
`RFC2328-13.5-2`	Keep delayed-acknowledgment intervals shorter than RxmtInterval to avoid needless retransmissions (§13.5)
	SHOULD	13.5	positive`no test`no positive test negative`no test`no negative test
`RFC2328-C.3-2`	Make RouterDeadInterval some multiple of HelloInterval (e.g. 4) (§C.3)
	SHOULD	C.3	positive`no test`no positive test negative`no test`no negative test
`RFC2328-A.4.5-1`	Set the Forwarding address in an AS-external-LSA to 0.0.0.0 to direct traffic to the originating ASBR (§A.4.5, §16.4)
	MAY	A.4.5	positive`no test`no positive test negative`no test`no negative test
`RFC2328-16.1-2`	Use a more efficient SPF algorithm (e.g. incremental SPF) provided it produces an identical shortest-path tree (§16.1)
	MAY	16.1	positive`no test`no positive test negative`no test`no negative test
`RFC2328-15-1`	Configure virtual links through non-backbone (non-stub) Transit areas to repair backbone connectivity (§15)
	MAY	15	positive`no test`no positive test negative`no test`no negative test
`RFC2328-D.3-3`	Configure multiple Cryptographic auth keys per interface with KeyStart/KeyStop time constants for smooth rollover (§D.3)
	MAY	D.3	positive`no test`no positive test negative`no test`no negative test

Gaps and untested MUSTs

Requirement	State	Reason
`RFC2328-13.3-2` Increment an LSA's LS age by InfTransDelay (which MUST be > 0) when copying it into an outgoing Link State Update, capped at MaxAge (§13.3, §13.6, §14)	{gap}, no test	the InfTransDelay bump is applied on the retransmit path (RetransmitTick, lsdb/flooding.go:545) and on a direct database-copy reply (sendDirectLSUpdate, lsdb/flooding.go:745; sendDirectLinkLSUpdate, lsdb/link_scope.go:349), but NOT on the normal flood: floodExcept builds the outgoing copy with `entry.LSA(d.now())` (lsdb/flooding.go:351), and Entry.LSA calls `e.Raw(now, 0)` with transmitDelay 0 (lsdb/entry.go:62-68, 75-85), so the first flooded copy carries the unincremented LS age. The MaxAge cap itself is present wherever the bump is applied (LSAge.Add, types/lsage.go:54-63). Disclosed in docs/features/rfc-status.md RFC 2328 row

Proof state

A tagged unit reads unproven where no discrimination record exists for it: nothing in this tree has been observed to break it, so the claim its tag makes is unproven.