as-sets in route-sets

[job]

It appears that route-sets expands into something different than older IRRd versions do.

hanna:~ job$ bgpq3 -h irrd01.ip.gin.ntt.net RS-INTEROUTE | wc -l
     436

versus:

hanna:~ job$ bgpq3 -h rr.ntt.net RS-INTEROUTE | wc -l
  987652

Smaller route-sets expand the same though

hanna:~ job$ bgpq3 -h irrd01.ip.gin.ntt.net RS-UUNET | md5sum
9d090fe5840bf10622073dd6d73f8a10  -
hanna:~ job$ bgpq3 -h rr.ntt.net RS-UUNET | md5sum
9d090fe5840bf10622073dd6d73f8a10  -

I suspect the issue may be around linking AS-SETs from a ROUTE-SET:

hanna:a job$ bgpq3 -h irrd01.ip.gin.ntt.net RS-IBM-CLOUD | wc -l
       9
hanna:a job$ bgpq3 -h rr.ntt.net RS-IBM-CLOUD | wc -l
     770

There is an as-set hidden here:

hanna:a job$ whois -h rr.ntt.net RS-IBM-CLOUD | grep AS
members:        AS-VIRTELA-COMM

[mxsasha]

AS-sets as members of route-sets are indeed not supported, and are not expanded. Per RFC 2622 5.2, a route-set can not have as-sets as members.

[job]

Did you take RFC 2622 section 5.3 into consideration? I have a feeling this is actually valid, and expected to happen.

5.3 Predefined Set Objects

   In a context that expects a route set (e.g.  members attribute of the
   route-set class), an AS number ASx defines the set of routes that are
   originated by ASx; and an as-set AS-X defines the set of routes that
   are originated by the ASes in AS-X. A route p is said to be
   originated by ASx if there is a route object for p with ASx as the
   value of the origin attribute.  For example, in Figure 15, the route
   set rs-special contains 128.9.0.0/16, routes of AS1 and AS2, and
   routes of the ASes in AS set AS-FOO.

     route-set: rs-special
     members: 128.9.0.0/16, AS1, AS2, AS-FOO

   Figure 15:  Use of AS numbers and AS sets in route sets.

[mxsasha]

5.3 indeed suggests that this should be possible. However, 5.2 is entirely unambiguous that the behaviour in 5.3 is not allowed:

 members      list of <address-prefix-range> or 
              <route-set-name> or
              <route-set-name><range-operator>

We can implement the behaviour where in route sets:

• as-sets are expanded into the prefixes originated by the ASes in the as-set (recursively resolved)
• ASes are expanded into the prefixes originated by that AS

I'll need to review to see how much time this would take, my rough guess for now is 4-8 hours.

[job]

@mxsasha full agree that the two paragraphs are put together poorly. Please proceed implementing this "feature", I don't think we can do without it.