Upgrade notes: after upgrading, run the
arouteserver setup-templates command to sync the local templates with those distributed with the new version. More details on the Upgrading section of the documentation.
ripe-rpki-validator-cacheis set as the source of ROAs, multiple URLs can now be specified to fetch data from.
URLs will be tried in the same order as they are configured; if the attempt to download ROAs from the first URL fails, the second URL will be tried, an so on.
By default, the RIPE NCC public instance of the RIPE RPKI Validator will be tried first, then the NTT instance. The list of URLs can be set in the
This is the last release of ARouteServer for which OpenBGPD/OpenBSD 6.1 and 6.2 CI tests are ran. From the next release, any new feature will not be tested against these versions of OpenBGPD. Users are encouraged to move to newer releases.
New: add support for OpenBGPD/OpenBSD 6.4 enhancements.
Use new sets for prefixes, ASNum, and origins (prefix + source-as), and also RPKI ROA sets.
Improvement: OpenBGPD, reduce the number of rules by combining some into the same rule.
Improvement: route server policies definition files built using the
configurecommand now have RPKI BGP Origin Validation and “use-ROAs-as-route-objects” enabled by default.
As announced with release 0.19.0, OpenBGPD/OpenBSD 6.0 is no longer tested. The implementation of new features may break compatibility of the configurations built for unsupported releases.
Most of this release is based on the work made by Claudio Jeker.
Fix (BIRD configuration only): change
When a route is originated from the aggregation of two different routes using the AS_SET,
bgp_path.lastalways returns 0, so the origin ASN validation against IRR always fails.
Related: issue #34 on GitHub.
This is the last release of ARouteServer for which OpenBGPD/OpenBSD 6.0 CI tests are ran. Starting with the next release, any new feature will not be tested against version 6.0 of OpenBGPD. Users are encouraged to move to newer releases.
New: use NIC.BR Whois data from Registro.br to enrich the dataset used for route validation.
Related: issue #28 on GitHub.
New: introduce support for OpenBGPD/OpenBSD 6.4.
OpenBSD 6.4 is not released yet, this is just in preparation of it.
Related: issue #31 on GitHub.
Fix (minor): RIPE NCC RPKI Validator v3 expects
Accept: text/jsonas HTTP header.
Related: PR #29 on GitHub.
New: add support for BIRD 1.6.4 and OpenBGPD/OpenBSD 6.3.
This release breaks backward compatibility (OpenBGPD configs only): the default target version used to build OpenBGPD configurations (when the
--target-versionargument is not given) is now 6.2; previously it was 6.0. Use the
--target-version 6.0command line argument to build 6.0 compatible configurations.
Improvement: transit-free ASNs filters are applied also to sessions toward transit-free peers.
Related: issue #21 on GitHub.
Fix (minor): better handling of user answers in
clients-from-peeringdb, list of IXPs retrieved from PeeringDB and no longer from IXFDB.
clients-from-euroixcommand, use the configured cache directory.
configurecommand, omit extended communities for OpenBGPD configurations.
This is to avoid the need of using the
--ignore-issues extended_communitiescommand line argument.
Improvement: environment variables expansion when YAML configuration files are read.
- Fix: minor installation issues.
New feature: allow to set the source of IRR objects.
AS-SETs can be prepended with an optional source:
New feature: support for RPKI-based Origin Validation added to OpenBGPD configurations.
RPKI ROAs must be loaded from a RIPE RPKI Validator cache file (local or via HTTP). Mostly inspired by Job Snijders’ tool https://github.com/job/rtrsub
Improvement: RPKI ROAs can be loaded from a local file too.
The file must be in RIPE RPKI Validator cache format.
Fix (minor): remove internal communities before accepting blackhole routes tagged with a custom blackhole community.
This bug did not affect routes tagged with the BLACKHOLE community; anyway, the internal communities were scrubbed before routes were announced to clients.
- Fix: avoid empty lists of prefixes when a client’s
white_list_prefcontains only prefixes for an IP version different from the current one.
Improvement: OpenBGPD, more flexibility for inbound communities values.
This allows to use inbound ‘peer_as’ communities which overlap with other inbound communities whose last part is a private ASN.
New feature: use ARIN Whois database dump to authorize routes.
This feature allows to accept those routes whose origin ASN is authorized by a client AS-SET, whose prefix has not a corresponding route object but is covered by an ARIN Whois record for the same origin ASN.
Improvement: extend the use of RPKI ROAs as route objects and ARIN Whois database dump to
Before of this, the RPKI ROAs as route objects and ARIN Whois DB dump features were used only when origin AS and prefix enforcing was set. Starting with this release they are used even when enforcing is not configured and only the
tag_as_setmode is used.
- New feature:
configure: it can be used to quickly generate a route server policy definition file (
general.yml) on the basis of best practices and suggestions.
show_config: to display current configuration settings and also options that have been left to their default values.
- New feature:
ixf-member-exportcommand, to build IX-F Member Export JSON files from the list of clients.
- Improvement: cache expiry time values can be set for each external resource type: PeeringDB info, IRR data, …
This release breaks backward compatibility (OpenBGPD configs only): for OpenBGPD configurations, starting with this release the Site of Origin Extended BGP communities in the range 65535:* (
soo 65535:*) are reserved for internal reasons.
New feature: use RPKI ROAs as if they were route objects.
This feature allows to accept those routes whose origin ASN is authorized by a client AS-SET, whose prefix is not but it is covered by a RPKI ROA for the same origin ASN.
Related: issue #19 on GitHub.
New feature: automatic checking for new releases.
This can be disabled by setting
check_new_releaseto False in
Improvement: routes accepted solely because of a
white_list_routeentry are now tagged with the
Fix: on OpenBGPD configurations, in case of duplicate definition of a client’s AS-SETs, duplicate BGP informational communities were added after the IRR validation process.
New feature: an option to set RFC1997 well-known communities (NO_EXPORT/NO_ADVERTISE) handling policy: pass-through or strict RFC1997 behaviour.
This breaks backward compatibility: previously, NO_EXPORT/NO_ADVERTISE communities were treated accordingly to the default implementation of the BGP speaker daemon (BIRD, OpenBGPD). Now, ARouteServer’s default setting is to treat routes tagged with those communities transparently, that is to announce them to other clients and to pass-through the original RFC1997 communities.
Improvement: when using PeeringDB records to configure the max-prefix limits, a margin is took into account to accomodate networks that fill the PeeringDB records with their exact route announcement count.
This breaks backward compatibility: if using max-prefix from PeeringDB, current limits will be raised by the default increment values (+100, +15%): this behaviour can be reverted to the pre-v0.13.0 situation by explicitly setting the
max_prefix.peering_db.incrementconfiguration section to
Related: issue #12 on GitHub.
New feature: client-level white lists for IRRdb-based filters.
This allows to manually enter routes that must always be accepted by IRRdb-level checks and prefixes and ASNs that must be treated as if they were included within client’s AS-SETs.
Related: issue #16 on GitHub.
Improvement: always take the AS*n* macro into account when building IRRdb-based filters.
Related: issue #15 on GitHub.
Fix: an issue on OpenBGPD builder class was preventing features offered via large BGP communities only from being actually implemented into the final configuration.
Related: issue #11 on GitHub.
Fix an issue that was impacting templates upgrading under certain circumstances.
Related: issue #10 on GitHub.
Python 3.4 support.
Improvement: GT registry removed from the sources used to gather info from IRRDB.
Related: PR #8 on GitHub.
Improvement: multiple AS-SETs used for the same client are now grouped together and queried at one time. This allows to leverage bgpq3’s ability and speed to aggregate results in order to have smaller configuration files.
New feature: when IRRDB-based filters are enabled and no AS-SETs are configured for a client, if the
cfg.filtering.irrdb.peering_dboption is set ARouteServer tries to fetch their values from the client’s ASN record on PeeringDB.
Related: issue #7 on GitHub.
Improvement: config building process performances,
- reduced memory consumption by moving IRRDB information from memory to temporary files;
- responses for empty/missing resources are also cached;
- fix a wrong behaviour that led to multiple PeeringDB requests for the same ASN.
clients-from-euroixcommand, the new
--merge-from-peeringdboption can be used to integrate missing information into the output clients list by fetching AS-SETs and max-prefix limit from PeeringDB.
- Fix: OpenBGPD, an issue was causing values > 65535 to be used in standard BGP communities matching.
- Fix: remove quotes from clients description.
- Fix: OpenBGPD, syntax error for prefix lists with ‘range X - X’ format.
clients-from-euroixcommand, members with multiple
vlanobjects with the same
vlan_idwere not properly listed in the output, only the first object was used.
Improvement: BIRD, new default debug options (
states, routes, filters, interfaces, events, was
If needed, they can be overwritten using the
headercustom .local file.
Fix: enrichers errors handling reported a generic message with no further details.
Fix: HTTP 404 error handling for “Entity not found” error from PeeringDB.
Fix: OpenBGPD, large prefix lists were causing a “string too long” error.
Fix: OpenBGPD, clients descriptions longer than 31 characters were not properly truncated.
- New feature: RTT-based communities to control propagation of routes on the basis of peers round trip time.
- Improvement: in conjunction with the “tag” reject policy, the
rejected_route_announced_byBGP community can be used to track the ASN of the client that announced an invalid route to the server.
- Fix: when the “tag” reject policy is used, verify that the
reject_causeBGP community is also set.
- Fix: default user configuration path not working.
- New feature: reject policy configuration option, to control how invalid routes must be treated: immediately discarded or kept for troubleshooting purposes, analysis or statistic reporting.
- New tool: invalid routes reporter.
- Fix: the following networks have been removed from the bogons.yml file: 220.127.116.11/22, 18.104.22.168/21, 22.214.171.124/29.
New feature: custom BGP communities can be configured on a client-by-client basis to tag routes entering the route server (for example, for informative purposes).
Fix: validation of BGP communities configuration for OpenBGPD.
Error is given if a peer-AS-specific BGP community overlaps with another community, even if the last part of the latter is a private/reserved ASN.
Improvement: the custom
!include <filepath>statement can be used now in YAML configuration files to include other files.
More details here.
Improvement: IRRDB-based filters can be configured to allow more specific prefixes (
OpenBGPD 6.1 support: enable large BGP communities support.
clients-from-peeringdbcommand now uses the IX-F database to show a list of IXP and their PeeringDB ID.
Improvement: enable NEXT_HOP rewriting for IPv6 blackhole filtering requests on OpenBGPD after OpenBSD 6.1 fixup.
Related: issue #3.
Improvement: BIRD, client-level .local file.
Improvement: next-hop checks, the
authorized_addressesoption allows to authorize IP addresses of non-client routers for NEXT_HOP attribute of routes received from a client.
Fix: avoid the use of standard communities in the range 65535:x.
Improvement: option to set max-prefix restart timer for OpenBGPD.
Deleted feature: tagging of routes a’ la RPKI-Light has been removed.
reject_invalidflag, that previously was on general scope only, now can be set on a client-by-client basis.
roa_unknowncommunities no longer exist.
Related: issue #4 on GitHub
This breaks backward compatibility.
New feature: BIRD hooks to add site-specific custom implementations.
Improvement: BIRD local files.
This breaks backward compatibility: previously, *.local, *.local4 and *.local6 files that were found in the same directory where the BIRD configuration was stored were automatically included. Now, only the header([4|6]).local and footer([4|6]).local files are included, depending on the values passed to the
--use-local-filescommand line argument.
setupcommand and program’s configuration file.
The default path of the cache directory (cache_dir option) has changed: it was
/var/lib/arouteserverand now it is
cache, that is a directory which is relative to the cfg_dir option (by default, the directory where the program’s configuration file is stored).
- OpenBGPD support (some limitations apply).
- Add MD5 password support on clients configuration.
buildcommand used to generate route server configurations has been removed in favor of BGP-speaker-specific sub-commands:
--test-onlyflag for builder commands.
New BGP communities: add NO_EXPORT and/or NO_ADVERTISE to any client or to specific peers.
New option (set by default) to automatically add the NO_EXPORT community to blackhole filtering announcements.
setup-templatescommand to just sync local templates with those distributed within a new release.
Multithreading support for tasks that acquire data from external sources (IRRDB info, PeeringDB max-prefix).
Can be set using the
threadsoption in the
template-contextcommand, useful to dump the list of context variables and data that can be used inside a template.
New empty AS-SETs handling: if an AS-SET is empty, no errors are given but only a warning is logged and the configuration building process goes on.
Any client with IRRDB enforcing enabled and whose AS-SET is empty will have its routes rejected by the route server.
Fix local files usage among IPv4/IPv6 processes.
Before of this release, only .local files were included into the route server configuration, for both the IPv4 and IPv6 configurations. After this, .local files continue to be used for both the address families but .local4 and .local6 files can also be used to include IP version specific options, depending on the IP version used to build the configuration. Details here.
# pull from GitHub master branch or use pip: pip install --upgrade arouteserver # install the new template files into local system arouteserver setup
- Add local static files into the route server’s configuration.
- First beta version.
filtering.rpslsection of general and clients configuration files has been renamed into
- The command line argument
--template-dirhas been renamed into
- New options in the program’s configuration file:
bgpq3_sources, used to set bgpq3
-Sarguments when gathering info from IRRDBs.
- New command to build textual representations of configurations:
- New command to initialize a custom live test scenario:
- New feature: selective path prepending via BGP communities.
control_communitiesgeneral option has been removed: it was redundant.
- Improved communities configuration and handling.
- Fix issue on standard communities matching against 32-bit ASNs.
- Fix issue on IPv6 prefix validation.
- New feature: RPKI-based filtering/tagging.
- New feature: transit-free ASNs filtering.
- Program command line: subcommands +
- More logging and some warning.
- Fix issue with GTSM default value.
- Add default route to bogons.
- Better as-sets handling and cache handling.
- Config syntax change: clients ‘as’ -> ‘asn’.
- AS-SETs at AS-level.
- Live tests: path hiding mitigation scenario.
- Improvements in templates.
- Fix some cache issues.
- System setup via
First push on GitHub.