pierky / arouteserver / 1274 / 4

72%

master: 73%

push

travis-ci

Use ExaBGP to validate RFC6907 7.1.9 and AS_SET origins

This commit adds test cases related to the way AS_PATHs whose origin
is an AS_SET are treated with regards to RPKI origin validation and
IRR checks.

RFC6907:

> Route has {10.1.0.0/24, AS_SET [AS 64496] appears in the rightmost
> position in the AS_PATH}
>
> ROA: {10.1.0.0/22, maxLength = 24, AS 64496}
>
> Recommended RPKI prefix-origin validation interpretation: Route is
> Invalid.

> In the spirit of [RFC6472], any route with an AS_SET in it
> should not be considered valid (by ROA-based validation). If the
> route contains an AS_SET and a covering ROA prefix exists for the
> route prefix, then the route should get an Invalid status.
> (Note: AS match or mismatch consideration does not apply.)

So basically any route with an AS_SET in the AS_PATH for which a
covering ROA exists should be treated as an INVALID.
With this commit a test case to validate this is introduced.
Even though such test case is not strictly related to verify the
behaviour of ARouteServer but rather the implementation of the
BGP speakers, it was useful to deal with PR #56.

Two more test cases cover the way IRR checks are performed when the
AS_PATH ends with an AS_SET.

BIRD and OpenBGPD behave differently under that circumstance.

In BIRD, comparing a list of valid origin ASNs (generated from info
fetched from IRRs) against `bgp_path.last` leads to a mismatch,
regardless of the content of the AS_SET

In OpenBGPD, the vanilla origin AS validation in presence of an
AS_SET looks like the same that could be obtained in BIRD using
`bgp_path.last_nonaggregated`. A route with an AS_PATH like
222 333 { 444 555 } fails the BOV validation against a ROA whose
AS is 333, as wanted by RFC6907 7.1.9, but then a match like the
following one succeeds:

as-set "AS_SET_AS_AS222_asns" {
    333
}
match ... source-as as-set AS_SET_AS_AS222_asns

The goal of both the mechanisms (RPKI OV and IRR-based filtering)
is to someway validate the ori... (continued)

1253 of 1821 branches covered (68.81%)

Branch coverage included in aggregate %.

3371 of 4519 relevant lines covered (74.6%)

0.75 hits per line