On Wed, Nov 16, 2022 at 05:14:20PM +0100, Claudio Jeker wrote:
> On Wed, Nov 16, 2022 at 03:37:31PM +0100, Claudio Jeker wrote:
> > On Wed, Nov 16, 2022 at 02:52:59PM +0100, Theo Buehler wrote:
> > > On Wed, Nov 16, 2022 at 12:47:46PM +0100, Claudio Jeker wrote:
> > > > ASPA sets are the 2nd thing that will be generated out of rpki (and
> > > > rpki-client). ASPA is used to further prevent leaks by providing
> > > > customer
> > > > provider attestation (and blocking paths which violate these
> > > > attestations).
> > > >
> > > > I started to implement this and while this code does no checks yet it is
> > > > enough plumbing to parse and "merge" the ASPA sets. Similar to the
> > > > roa-set
> > > > an aspa-set in the config will be parsed and passed to the rtr process
> > > > where it will be merged with the data from RTR sessions.
> > > > What is missing is all the code needed in the RDE to do the lookups.
> > > >
> > > > A aspa-set is defined like this:
> > > > aspa-set {
> > > > source-as 1 transit-as { 5 }
> > > > source-as 2 expires 1668181648 transit-as { 3 4 }
> > > > source-as 5 transit-as { 1 2 allow inet 7 allow inet6 }
> > > > }
> > >
> > > Adding this to the end of the default bgpd.conf I get
> > >
> > > /tmp/bgpd.conf:134: syntax error, expires not allowed
> > > /tmp/bgpd.conf:136: syntax error
> > >
> > > Deleting the expire time, it parses fine. I suspect the duplicate
> > > aspa_set rules in parse.y don't work as intended.
> >
> > No this is actually the roa-set code that triggers this. It changes
> > noexpires to 1 and then after that aspa-set fails.
> > I changed to code to set noexpires in the origin-set case (where expires
> > is not allowed) and then set it back to 0 when leaving that node.
>
> So here is an updated version that should fix all of the remarks from tb@
> Also I changed 'transit-as' to 'upstream-as'. As you can guess I'm not a
> fan of the terms customer and provider.
I have no opinion on the color of this particular bikeshed :)
I like how you dealt with my nits, thanks
ok tb
