bgpd: Do not advertise aggregate routes to contributing ASes

[ton31337]

=> updates according to https://datatracker.ietf.org/doc/html/draft-ietf-idr-deprecate-as-set-confed-set-16

[enkechen-panw]

@ton31337 This mechanism does not look safe, and I don't think we should do it.

The AS-SET has been there for more than 20+ years, and most likely will continue to exist for years to come as people usually do not change working configs. This mechanism would cause an outage for a customer that receives and accepts the aggregate currently (say, along with "allows-as" feature).

[taspelund]

@ton31337 This mechanism does not look safe, and I don't think we should do it.

The AS-SET has been there for more than 20+ years, and most likely will continue to exist for years to come as people usually do not change working configs. This mechanism would cause an outage for a customer that receives and accepts the aggregate currently (say, along with "allows-as" feature).

Maybe the new logic introduced in this PR could be coupled with the sender-as-path-loop-detection knob?
Then the improvement is there for folks who want to enable this, but operators won't be surprised by this change after an update?

[ton31337]

I disagree, it was implemented from the beginning incorrectly, and here is just a fixup. At least saying that in the documentation would be good.

[enkechen-panw]

Ok, then my comment is more about the proposal of "Do not advertise aggregate routes to contributing ASes", not the specific code in the patch.

[ton31337]

Then it's not a best place to discuss the draft, there's already a long discussion ongoing on this draft, and most likely it's going to be RFC'ed anyway. as-set causes more issues than gives the benefits in terms of security.

[enkechen-panw]

Then it's not a best place to discuss the draft, there's already a long discussion ongoing on this draft, and most likely it's going to be RFC'ed anyway. as-set causes more issues than gives the benefits in terms of security.

I have seen "as-set" in a number of customers' configs. Usually they will not change working configs regardless what a RFC says. To be safe, I think there should be a knob for this, and it should off be default.

[ton31337]

There is a knob, see "bgp reject-as-set".