Index | Thread | Search

From:
Theo Buehler <tb@theobuehler.org>
Subject:
Re: bgpd: flip reject as-set default to yes
To:
tech@openbsd.org
Date:
Thu, 9 Jan 2025 17:06:05 +0100

Download raw body.

Thread
On Thu, Jan 09, 2025 at 02:22:23PM +0100, Claudio Jeker wrote:
> BGP AS_PATH AS_SET are deprecated (or in the process to be).
> In short AS_SET don't play nice with Route Origin Validation (ROV) and
> with ASPA validation any AS_SET makes the path invalid and ineligible.
> 
> We already have a knob for removing them as suggested by
> https://datatracker.ietf.org/doc/html/draft-ietf-idr-deprecate-as-set-confed-set-16
> 
> I think it is time to flip the switch on that knob an make the filtering 
> the new default.

Yes. Agreed.

> The diff is more involved since I flipped the logic also in the code.
> Mainly BGPD_FLAG_NO_AS_SET becomes BGPD_FLAG_PERMIT_AS_SET and
> peer_accept_no_as_set() becomes peer_permit_as_set().
> Overall I like the new names better :)

Me too, but I'm rather biased against _NO_ konfig knobs :)

ok tb